Skip to main content

Get Started with AIDR for Workforce

Overview​

The AIDR browser collector is a lightweight browser extension that you install on managed endpoints to capture AI interactions in supported browsers and send data to AIDR for visibility and policy enforcement.

You can use the AIDR browser collector to monitor and analyze employee use of web-based AI tools like ChatGPT, Claude, Gemini, and other supported providers in managed enterprise environments. Based on the analysis, you can apply policies to protect your organization from risks identified in user inputs.

This guide covers installing a browser collector by adding the AIDR Chrome browser extension to Google Chrome or Microsoft Edge on your machine. You will:

  • Verify the browser collector reaches a successful deployment state.
  • View AI activity captured by the collector in the AIDR console event logs.

You can apply this experience when deploying browser collectors at scale using enterprise endpoint management tools.

Requirements​

To start monitoring employee AI usage using browser collectors, ensure you have:

  • A customer account in one of the supported CrowdStrike clouds:
    • US-1
    • US-2
    • EU-1
  • AIDR for Workforce Falcon subscription
  • AIDR Admin role explicitly assigned to your Falcon user account for the current customer
  • Supported operating system:
    • Windows
    • macOS
  • Admin privileges on the user machine(s), necessary for updating system-level configuration:
    • Registry on Windows
    • Configuration profile on macOS
note:

For quick evaluation and testing, this guide covers deployment of the AIDR Chrome extension on your machine.

You can deploy AIDR browser collectors in organizations with managed endpoints. For production deployment in enterprise environments, use supported device management tools:

  • Microsoft Intune (cross-platform)
  • JAMF (macOS)
  • Chrome Enterprise (browser-specific)
  • Group Policy (Windows)

These options are outlined on the collector Install tab in the AIDR console.

note:

The AIDR browser extension must be installed and used independently from the Falcon Sensor.

Register browser collector​

In the Falcon console, click Open menu (☰) and go to

AI detection and response > Collectors .

  1. On the Collectors page, click + Collector.

  2. Choose Browser as the collector type, then select the browser you want to support (Chrome, Edge) and click Next.

  3. On the Add a Collector screen:

    • Collector Name - Enter a descriptive name for the collector to appear in dashboards and reports.
    • Logging - Select Log with prompt data, which will enable full analysis by logging:
      • User prompts and AI service responses
      • Request metadata, including available user and AI service information
    • Policy - Select Browser Monitor, which will:
      • Record user activity.
      • Detect risks in AI interactions using pre-configured detectors and save the results in event logs. You can view the configured detectors by following the policy link on the collector details page.

      Use the assigned policy to determine which detections run on data sent to AIDR. Policies define rules for detecting malicious activity, sensitive data exposure, topic violations, and other risks in AI interactions.

      • You can select an existing policy available for this collector type or create policies on the Policies page.

        The selected policy name appears under the dropdown. After you save the collector registration, this label becomes a link to the corresponding policy page.

      • You can also select No Policy, Log Only. Without a policy, AIDR records activity for visibility and analysis without applying detection rules.

  1. In the Sites section, leave all AI provider sites set to Use Policy.

    note:

    The Sites section lists supported AI provider websites that the extension monitors. You can set each site to one of the following modes to apply or override the collector-level policy rules:

    • Use Policy (default) - Apply the collector's policy rules to this site. User prompts and AI system responses are sent to AIDR for analysis and logging. User prompts may be blocked or transformed. To review your collector policy rules, find the assigned policy on the Policies page in the AIDR console.
    • Monitor Only - Apply the collector's policy rules to this site in report-only mode. User prompts and AI system responses are sent to AIDR for analysis and logging. The user experience isn't affected.
    • Discovery - Skip sending AI traffic to AIDR. Only record that users visited the site.
    • Disabled - Ignore this site entirely. No monitoring or logging is done.

  2. Click Save to complete collector registration.

This opens the collector details page, where you can:

  • View installation instructions for the collector type on the Install tab.
  • Update the collector name, logging preference, and policy assignment.
  • Click the policy link to view the policy details.
  • View the collector configuration activity logs.

To return to the collector details page later, select your collector from the list on the Collectors page.

Deploy collector​

To deploy a browser collector, you must:

  • Install the browser extension.
  • Save AIDR collector configuration in the extension's Managed storage.

Select Install option​

On the collector details page, switch to the Install tab, which provides instructions, links, and templates for common deployment methods.

Select the Self-Service option to quickly evaluate the collector on your own machine before deploying it at scale. This option:

  • Introduces the key browser collector deployment steps
  • Requires no management tools
  • Lets you perform both installation and configuration steps manually on your machine
  • Describes the extension deployment statuses and functionality, also applicable to production deployments using enterprise management tools
Self-service limitations:

Self-service deployment is intended for testing and evaluation purposes. It isn't a supported option for production deployments.

The first time you select this option, you must acknowledge these limitations in a confirmation dialog before proceeding.

tip:

For enterprise environments with device management, follow the instructions for a supported management tool on the Install tab.

Install browser extension​

The AIDR collector for Google Chrome and Microsoft Edge is a Chrome extension in the Chrome Web Store.

  1. Use the Get the AIDR Extension link to open the extension page in Chrome Web Store.
  2. Click Add to Chrome (or Add to Edge) to install the extension in your browser.

After the extension is installed, you can manage it on the chrome://extensions (or edge://extensions) page.

Configure browser extension​

  1. Return to the Install tab and download the configuration file for your operating system:

    • macOS - AIDR Chrome Profile (.mobileconfig)
    • Windows - AIDR Windows registry file (.reg)

    This file contains the collector instance configuration, including credentials to authenticate the extension with the AIDR service.

  2. Apply the configuration:

    • macOS

      1. Double-click the downloaded configuration profile (.mobileconfig), then activate it in System Settings > General > Device Management > Profiles. If a previous profile for this extension exists, remove it first.

        The exact path may vary depending on your macOS version.

    • Windows - Double-click the registry file (.reg) to merge it into the Registry and confirm the prompts.

      warning:

      The registry file modifies the Windows Registry under the extension-specific key path. This doesn't affect other settings, but as a precaution, you can make a registry backup before applying the file. If you're unsure how to back up the Registry, contact your IT or system administrator.

  3. Fully close and restart your browser for the settings to take effect.

Verify deployment status​

Extension status page​

To open the extension status page:

  • If you have pinned the extension to the browser toolbar, click its icon (CrowdStrike AIDR).
  • If you haven't pinned the extension, click the puzzle piece icon (Extensions) in the toolbar and select it from the list.

The extension status page shows:

  • CrowdStrike AIDR - Extension vendor and name
  • Version - Semantic version number (for example, 0.6.6). The first two digits indicate major and minor feature releases. The last digit indicates a patch with improvements or bug fixes.
  • Device - Unique identifier for this extension instance. Appears in AIDR logs and findings. Re-installing the extension generates a new device ID. Collector instances are listed on the collector details page under the Devices tab.
  • UserId - Identifier assigned to the userId field in the extension managed storage. If no userId is configured, this field isn't displayed.
  • One of the status values in the top right, indicating the current state of the extension.

Status progression flow​

  1. Deployment
  2. Configuration check
  3. Registration
  4. Site monitoring

Unsuccessful deployment​

Not configured​

The extension has no configuration in its managed storage.

  1. Verify that the configuration profile or registry changes were properly applied to the system.

    Check the following OS and browser-specific locations:

    • Chrome

      • macOS - Managed preference plist files

        Configuration profile
        plutil -p /Library/Managed\ Preferences/<user>/com.google.Chrome.extensions.folndgmoekgkipoolphnkclopeopkecc.plist
        Example configuration
        {
          ...
          "registrationIdentity" => "eyJzIj...YiOjF9"
          "urlTemplate" => "https://api.crowdstrike.com/aidr/aiguard"
          "userFullName" => "<user-full-name>"
          "userId" => "<user-id>"
        }

      • Windows - Registry keys

        Registry keys
        Get-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc\policy"
        Example configuration
        urlTemplate          : https://api.crowdstrike.com/aidr/aiguard
        registrationIdentity : eyJzIj...I6MX0=
        userId               : <user-id>
        userFullName         : <user-full-name>
        ...

    • Edge

        • macOS - Managed preference plist files

          Configuration profile
          plutil -p /Library/Managed\ Preferences/<user>/com.microsoft.Edge.extensions.folndgmoekgkipoolphnkclopeopkecc.plist
          Example configuration
          {
            ...
            "registrationIdentity" => "eyJzIj...YiOjF9"
            "urlTemplate" => "https://api.crowdstrike.com/aidr/aiguard"
            "userFullName" => "<user-full-name>"
            "userId" => "<user-id>"
          }

        • Windows - Registry keys

          Registry keys
          Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc\policy"
          Example configuration
          urlTemplate          : https://api.crowdstrike.com/aidr/aiguard
          registrationIdentity : eyJzIj...I6MX0=
          userId               : <user-id>
          userFullName         : <user-full-name>
          ...

    Next steps:

  2. Verify the extension managed storage has been updated.

    1. In your browser address bar, go to chrome://extensions (or edge://extensions).
    2. Enable Developer mode.
    3. In the AIDR extension card, click service_worker.
    4. In the DevTools console for the background service worker, switch to the Application tab.
    5. Expand Extension storage and click Managed.
    6. Verify the storage keys are populated.

    • Required fields:

      • registrationIdentity - Encoded credentials the extension uses to authenticate with the AIDR service and obtain an authorization token
      • urlTemplate - AIDR API base URL

      You can find collector-specific values for registrationIdentity and urlTemplate on the Install tab of the collector details page in the AIDR console. Configuration files and templates available on the Install tab are pre-populated with these values.

    • Optional user identity fields that appear in AIDR event logs:

      • userId - User identifier (for example, email address). Appears in AIDR logs and findings.
      • userFullName - User's display name. Appears in AIDR logs and findings.

      note:

      Downloaded configuration files are pre-populated with values from the current session:

      • urlTemplate - Set to the AIDR API URL for your CrowdStrike cloud.
      • registrationIdentity - Set to collector-specific credentials.
      • userId and userFullName - Set to the current AIDR console user's information.

      If you distribute the configuration file to other users, update the userId and userFullName fields to match the target user's identity. In production deployments, you typically set these values dynamically per user using variables in endpoint management tools or scripts.

    Next steps:

    • If the extension managed storage isn't populated, fully close and restart your browser.
    • If the issue persists, contact your IT or system administrator.
Invalid configuration​

The configuration exists but is malformed due to invalid format or missing value for registrationIdentity or urlTemplate.

Next steps:

Error - registration​

Device registration failed due to network issues or invalid credentials provided in:

  • registrationIdentity
  • urlTemplate

Next steps:

  • Check network connectivity to the AIDR service.
  • Ensure you configured your extension with the correct values from the Install tab on the collector details page. You can check your extension configuration as described for Not configured status. Try to Download and apply the collector configuration again.

Successful registration​

Pending approval​

The extension instance is registered but awaiting admin activation in the AIDR console.

By default, devices are auto-approved and activated. If auto-approval isn't enabled or this extension instance has been disabled, it remains in this state until activated.

Next steps:

  • On the collector details page, under Devices, find the extension instance by its ID in the list of devices. Open the menu (⋮) in the device row and select Activate.

    tip:

    When activating a collector instance, ensure the device ID shown in the AIDR console matches the one on the extension status page.

Error - logging​

The extension is registered but can't send monitoring data from a provider site to the AIDR service. Connectivity issues are the most common cause.

Next steps:

  • Check network connectivity to the AIDR service.

Successful deployment​

After successful installation and configuration, the status progresses to:

Configured​

The extension has valid configuration but hasn't obtained an access token yet. This normal transitional state occurs during extension startup. It progresses to Ready automatically within minutes if the configuration values are valid.

note:

Invalid configuration values result in Unsuccessful deployment.

Ready​

The extension is configured, authenticated, and ready to monitor supported AI sites. No activity has been detected yet.

Active​

The extension is operational and monitors AI interactions when the user interacts with a supported provider site.

Verify data flow​

A properly deployed collector captures user input and AI service responses on supported provider sites and sends them to AIDR. AIDR evaluates the data against your collector policy rules and logs the results. If the collector's Logging is set to Log with prompt data, the logs include the user input and AI response.

Provider website​

Visit a supported provider site (for example, ChatGPT or Claude ) and start interacting with the chat application.

Browser UI​

Depending on the collector policy, the AIDR collector can visibly alter the end-user experience in the standard browser UI:

  • If No Policy, Log Only is assigned, or all policy rule actions are set to Alert and Report, the AIDR collector produces no visible effects.
  • If your policy rules include blocking or data-transforming actions, you may see blocked or redacted prompts when a rule matches. Responses may also appear unexpected when sensitive values were removed before reaching the AI system.

Next steps:

If you don't see AIDR policies applied to the user input:

  • Check Input Rules for the policy assigned to your collector.

    tip:

    To identify your extension instance:

    1. Match the extension urlTemplate value and the AIDR cloud domain.
    2. Switch to the correct customer account in the Falcon console (CID).
    3. Select the correct collector on the Collectors page in the AIDR console.
    4. Match the device ID on the extension status page with the registered device listed on the collector details page under Devices.
Extension DevTools​

Use the extension DevTools to confirm that it's active and sending data to AIDR:

  1. In your browser address bar, go to chrome://extensions (or edge://extensions).
  2. Enable Developer mode.
  3. In the AIDR extension card, click service_worker to open its developer tools.
  4. In DevTools, switch to the Network tab.
  5. Check for outbound requests to and responses from the AIDR APIs while interacting with a supported AI provider. You may see the following request names:

    • check - Authenticating with the AIDR service and obtaining an authorization token

    • guard_chat_completions - Sending user input or AI system response to AIDR for analysis

      Click a request row to inspect the collector payload under the Payload tab and AIDR API responses under the Preview and Response tabs.

      tip:

      See AIDR APIs documentation to better understand the content of the payloads and responses.

Next steps:

If you don't observe network traffic to AIDR APIs from the correctly configured extension, possible causes include:

  • Changes on the provider site - Contact AIDR support .
  • Your machine policies blocking extension functionality - Contact your IT or system administrator.

AIDR console​

In the AIDR console, review detailed event logs saved by your collector, visualize them in a Sankey dashboard, and view associated metrics.

Data flow timing:

Data appears in AIDR only when users visit and interact with AI provider sites. Installing the extension alone doesn't create data flow.

View detailed logs​

Click Findings in the top menu to review events processed by AIDR. Identify your collector logs by attributes associated with the collector and provider, for example:

  • COLLECTOR TYPE - (for example, Chrome)
  • APPLICATION NAME - Provider service name (for example, ChatGPT)
  • COLLECTOR NAME - Name you gave to your collector
  • TIME - Time of the request

These columns show AIDR processing results:

  • STATUS - Policy decision:
    • Allowed - No risks were detected, and the user prompt or AI system response is allowed by AIDR.
    • Reported - Risks were detected and logged, but the user prompt or AI system response is allowed by AIDR.
    • Blocked - Risks were detected, and AIDR responded with a blocked result. Blocking actions set in policy rules are automatically enforced in Browser, MCP, and (depending on configuration) Gateway collectors.
    • Alerted - A blocked result was logged but not enforced in Report Only mode .
    • Transformed - Sensitive data or malicious references were detected and redacted or defanged. The user prompt or AI system response was allowed with the transformed data.
  • FINDINGS - Detector(s) that identified risks. If AIDR detected no risks and allowed the request, No detections is displayed.

Expand each event log to see additional details, including:

  • User prompt or AI response data - If the collector's Logging is set to Log with prompt data, the event logs contain:

    • Guard Input - Original prompt or response submitted to AIDR
    • Guard Output - Processed response, present only if the data was transformed; otherwise, null

  • Metadata associated with the request, including:

    • User - Username saved in the extension managed storage
    • AIGuard Config
      • policy - Policy assigned to the collector
    • Findings - Detailed detections report
    • Extra Info
      • app_name - Provider website application name
      • user_name - User's full name saved in the extension managed storage
      • site_url - Provider website location

Use the reload icon to refresh the event log table.

Learn more about the Findings page in the Logs & Findings documentation .

Visualize your data​

Click Visibility in the top menu to explore patterns in AIDR-processed AI data flows and associated metrics.

In the interactive Sankey diagram, you can visualize relationships between entities captured in event logs. Select up to three attributes from the event metadata. For example, connect User Name - Application Name - Status to see which users visited which AI providers and the AIDR outcomes.

Learn more about visualizing AI flows, supported metadata attributes, and metrics dashboards in the Data Flows & Dashboards documentation .

Uninstall collector​

When you're done testing, remove the browser extension and its system configuration.

  1. Remove the browser extension in your browser's extension manager, the same way you would remove any other Chrome or Edge extension.

  2. Remove the system configuration:

    • macOS - Remove the configuration profile in System Settings > General > Device Management > Profiles. The exact path may vary depending on your macOS version.

    • Windows - Delete the registry key for the browser you used.

      warning:

      This modifies the Windows Registry. You can make a registry backup before proceeding. If you're unsure how to back up the Registry, contact your IT or system administrator.

      Run the following command in a PowerShell session as Administrator:

      Remove the registry key for Chrome
      Remove-Item -Path "HKLM:\Software\Policies\Google\Chrome\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc" -Recurse
      Remove the registry key for Edge
      Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc" -Recurse

Next steps​

  • View collected data on Visibility and Findings. Analyze it in NextGen SIEM to decide on further implementation steps.

  • Determine which policy to apply:

    • Start with monitoring policies and report actions.
    • Apply protection to identified risks by enforcing blocking and data transformation actions based on your organization’s AI usage guidelines.

  • Learn more about collector types and deployment options in the Collectors documentation.

636 Ramona St Palo Alto, CA 94301

Guides
Services
SDKs & APIs

©2026 CrowdStrike. All rights reserved.

PrivacyYour Privacy ChoicesTerms of UseLegal Notices
Contact Us