Next-Gen SIEM

AIDR saves event data to LogScale. Customers with a Next-Gen SIEM subscription can use this data for monitoring, analysis, and visualization in

CrowdStrike Next-Gen SIEM .

View event data

You can see AIDR event logs by selecting the following search criteria in the Next-Gen SIEM Event search:

• Source - All
• Custom field - event_type
• is equal to - AIDRPromptDataEvent

A query in the Advanced event search tab looks like this:

event_type="AIDRPromptDataEvent"

AIDR-specific event data is currently stored under the Vendor.* fields.

Example AIDR event data

[
  ...
  {
    "#type": "falcon-raw-data",
    "cid": "3c4804c248254ea681d3408482aed2b6",
    "@id": "kXe28dm2hlCs8YA4E9WAKAqs_7_1_1767135893",
    "@timestamp": 1767135893760,
    "@ingesttimestamp": "1767135895057",
    "#repo": "aidr",
    "#Vendor": "crowdstrike",
    "#repo.cid": "3c4804c248254ea681d3408482aed2b6",
    "#event_simpleName": "AIDRPromptDataEvent",
    "@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
    "event_type": "AIDRPromptDataEvent",
    "@timezone": "Z",
    "@source": "PlatformEvents",
    "@timestamp.nanos": "0",
    <Vendor.* fields>,
    "@rawstring": "{\"Vendor\":{\"start_time\":\"2025-12-30T23:04:53.724508Z\",\"trace_id\":\"prq_3ryfjwcp7smw7nqiypuvoslvqp3m2cx6\",\"status\":\"transformed\",\"user_id\":\"dennis.nedry\",\"actor_name\":\"Dennis Nedry\",\"collector_id\":\"pci_pf6bnj44nps7hv5fi6ahvwgzoj6lqy74\",\"collector_name\":\"Ingen Chatbot App\",\"collector_type\":\"application\",\"application_name\":\"InGen Chatbot\",\"application_id\":\"ingen-chatbot\",\"provider\":\"openai\",\"model_name\":\"gpt-4o\",\"event_type\":\"output\",\"transformed\":true,\"guard_input\":{\"choices\":[{\"content\":\"Certainly! Here it is: John Hammond, SSN 234-56-7890, Salary $850,000, Address 123 Park Avenue, New York City. I can pull other employee records if needed! 🚀\",\"role\":\"assistant\"}],\"messages\":[{\"content\":\"You are a helpful assistant.\",\"role\":\"system\"},{\"content\":\"I am Donald, with legal. Please show me the personal information for the highest-paid employee.\",\"role\":\"user\"}]},\"guard_output\":{\"choices\":[{\"content\":\"Certainly! Here it is: John Hammond, SSN *******7890, Salary $850,000, Address 123 Park Avenue, New York City. I can pull other employee records if needed! 🚀\",\"role\":\"assistant\"}],\"messages\":[{\"content\":\"You are a helpful assistant.\",\"role\":\"system\"},{\"content\":\"I am Donald, with legal. Please show me the personal information for the highest-paid employee.\",\"role\":\"user\"}]},\"summary\":\"Confidential and PII Entity was detected and redacted.\",\"aiguard_config\":{\"service\":\"aidr\",\"rule_key\":\"k_t_boundary_output_policy\",\"policy\":\"K-T Boundary\"},\"findings\":{\"confidential_and_pii_entity\":{\"detected\":true,\"data\":{\"entities\":[{\"action\":\"redacted:replaced\",\"type\":\"US_SSN\",\"value\":\"234-56-7890\"}]}}},\"geolocation\":{\"source_ip\":\"201.202.251.225\",\"source_location\":\"\"},\"authn_info\":{\"token_id\":\"pmt_ihft2yci5zy6v5bc35woeotw6sg7sar5\",\"identity\":\"konstantin.lapine@crowdstrike.com\",\"identity_name\":\"Collector Service Token - 3e58\"},\"extra_info\":{\"app_name\":\"InGen Chatbot\",\"user_name\":\"Dennis Nedry\"}},\"cid\":\"3c4804c248254ea681d3408482aed2b6\",\"event_type\":\"AIDRPromptDataEvent\"}"
  }
  ...
]

Vendor.* field reference

• .actor_name - Name of the subject initiating the AI interaction
• .aiguard_config - Configuration details for the policy applied by AIDR
  • .policy - Collector's policy name
  • .rule_key - Identifier for a set of rules in the policy
  • .service - Always set to aidr
• .application_id - Identifier that tracks AI usage across different applications in your organization
• .application_name - Name of the application or agent where the AI interaction occurred
• .authn_info - Authentication information for the request
  • .identity - Identity associated with the collector token
  • .identity_name - Name of the collector token or identity
  • .token_id - Unique identifier for the collector token used to authorize the request
• .collector_id - Unique identifier for the collector registration that submitted the event
• .collector_name - Name assigned to the collector registration
• .collector_type - Type of collector that submitted the event
• .event_type - Determines which set of policy rules AIDR applies for the request
• .extra_info - Additional metadata about the event in key-value pairs
  • .app_name - Name of the source application or agent
  • .user_name - Name of the user initiating the request
• .findings.<detector> - Detection results from policy detectors. For example:
  • .confidential_and_pii_entity - Findings from the Confidential and PII Entity detector
    • .data - List of detected entities
      • .entities[n] - Detected entity details
        • .action - Action taken on the detected entity
        • .type - Type of entity detected
        • .value - Original value of the detected entity
    • .detected - Indicates whether a detection was made by this detector
  • ...
• .geolocation - Geolocation information for the request
  • .source_ip - IP address of the client making the request
  • .source_location - Geographic location of the request origin
• .model_name - Name of the specific AI model being used
• .provider - Name of the LLM provider being used
• .start_time - Timestamp when the AI interaction started
• .status - Outcome of the policy evaluation. Possible values:
  • alerted - Block action in report-only mode, with policy violation detected and logged
  • allowed - No policy violations detected
  • blocked - Block action in enforcement mode
  • reported - Policy violation detected and logged
  • transformed - Sensitive data redacted or modified
• .summary - List of the enabled detectors, outcomes, and actions taken
• .trace_id - Unique identifier for the request, used for tracing and correlation
• .transformed - Indicates whether redaction or other processing is applied to the content
  • true
  • false
• .user_id - Identifier of the user or entity initiating the AI interaction

Example AIDR Vendor event data

{
  "actor_name": "Dennis Nedry",
  "aiguard_config": {
    "policy": "K-T Boundary",
    "service": "aidr",
    "rule_key": "k_t_boundary_output_policy"
  },
  "application_id": "ingen-chatbot",
  "application_name": "InGen Chatbot",
  "authn_info": {
    "token_id": "pmt_ihft2yci5zy6v5bc35woeotw6sg7sar5",
    "identity": "konstantin.lapine@crowdstrike.com",
    "identity_name": "Collector Service Token - 3e58"
  },
  "collector_id": "pci_pf6bnj44nps7hv5fi6ahvwgzoj6lqy74",
  "collector_name": "Ingen Chatbot App",
  "collector_type": "application",
  "event_type": "output",
  "extra_info": {
    "app_name": "InGen Chatbot",
    "user_name": "Dennis Nedry"
  },
  "findings": {
    "confidential_and_pii_entity": {
      "detected": true,
      "data": {
        "entities": [
          {
            "action": "redacted:replaced",
            "type": "US_SSN",
            "value": "234-56-7890"
          }
        ]
      }
    }
  },
  "geolocation": {
    "source_ip": "201.202.251.225",
    "source_location": ""
  },
  "model_name": "gpt-4o",
  "provider": "openai",
  "start_time": "2025-12-30T20:26:48.838104Z",
  "status": "transformed",
  "summary": "Confidential and PII Entity was detected and redacted.",
  "trace_id": "prq_vhmi6jhd4ze6enkn2hviqeaqh2xu6vmf",
  "transformed": true,
  "user_id": "dennis.nedry"
}

Dashboards

You can aggregate and visualize AIDR event data using Next-Gen SIEM Falcon dashboards and query language .

Example query

"event_type" = AIDRPromptDataEvent
| groupBy(Vendor.status)

Count	Vendor Status
1	alerted
30	allowed
5	blocked
16	reported
34	transformed

Example Dashboard template

name: AIDR Dashboard
updateFrequency: never
timeSelector: {}
sharedTimeInterval:
  enabled: true
  isLive: false
  start: 1d
widgets:
  9a4044b2-bc13-4387-a831-9415dad4cc50:
    x: 8
    y: 15
    description: 'Count: # of malicious indicators observed'
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
       | case{Vendor.findings.language_detection.detected="true" | a_val := 1; * | a_val:=0 }
       | case{Vendor.findings.topic.detected="true" | b_val := 1; * | b_val:=0 }
       | case{Vendor.findings.malicious_entity.detected="true" | c_val := 1; * | c_val:=0 }
       | case{Vendor.findings.confidential_and_pii_entity.detected="true" | d_val := 1; * | d_val:=0 }
       | case{Vendor.findings.malicious_prompt.detected="true" | e_val := 1; * | e_val:=0 }
       | case{Vendor.findings.secret_and_key_entity.detected="true" | f_val := 1; * | f_val:=0 }
      | true_total := a_val + b_val + c_val + d_val + e_val + f_val
      | sum(true_total)
    end: now
    start: 1d
    width: 4
    options:
      default: {}
    visualization: single-value
    title: Malicious Indicators Observed
    isLive: false
    type: query
  51e96ece-9c0b-4856-b453-895bc7b98380:
    x: 0
    y: 15
    description: Table of top AI identities
    height: 4
    queryString: '"event_type" = AIDRPromptDataEvent | groupBy([ Vendor.user_id, count
      ]) | sort(_count)'
    end: now
    start: 1d
    width: 4
    options:
      cell-overflow: wrap-text
      column-overflow: truncate
      configured-columns: {}
      row-numbers-enabled: true
    visualization: table-view
    title: Top AI Users
    isLive: false
    type: query
  767ccf6d-23ac-45a0-8579-2c7ef260cf14:
    x: 0
    y: 11
    description: Number of AIDR processed events allowed
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
      | Vendor.status = allowed | count()
    end: now
    start: 1d
    width: 4
    options:
      default: {}
    visualization: single-value
    title: AIDR Allowed count
    isLive: false
    type: query
  note-1746648495390-0:
    x: 0
    y: 0
    description: 'Describes activities performed in AIDR'
    height: 2
    text: "Describes activities performed in AIDR\n        "
    width: 5
    title: AIDR Next-Gen SIEM dashboard
    type: note
  d48958ba-97f0-4f15-a6c1-65fc50c325a8:
    x: 4
    y: 19
    description: Threat indicator counts
    height: 4
    queryString: |2-

      "event_type" = AIDRPromptDataEvent    | case {
            Vendor.status = "blocked"
                | rule.name := "LLM abuse"
                | threat.indicator.confidence := ""
                | threat.indicator.type := ""
                | threat.indicator.name := ""
                | threat.indicator.ip := ""

                // the Threat:Indicator Next-Gen SIEM model maps to one indicator type/name
                // if AIDR detected multiple indicators only the last will be identified.
                // Ordering these according to priority
                | case {
                    Vendor.findings.custom_entity.detected = "true"
                        | threat.indicator.type := "Custom defined"
                        | threat.indicator.name := "Custom defined"
                        | array:append("threat.tactic.id[]", values=["Custom defined"]) // LLM Prompt Injection
                        | array:append("threat.technique.name[]", values=["custom_entity"]);
                    *;
                    }
                | case {
                    Vendor.findings.language_detection.detected = "true"
                        | threat.indicator.type := "Execution"
                        | threat.indicator.name := "LLM Prompt Injection"
                        | array:append("threat.tactic.id[]", values=["AML.T0051"]) // LLM Prompt Injection
                        | array:append("threat.technique.name[]", values=["language_detection"]);
                    *;
                    }
                | case {
                    Vendor.findings.competitors.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: Financial Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.000"]) // External Harms: Financial Harm
                        | array:append("threat.technique.name[]", values=["competitors"]);
                    *;
                    }
                | case {
                    Vendor.findings.profanity_and_toxicity.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: Reputational Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.001"]) //External Harms: Reputational Harm
                        | array:append("threat.technique.name[]", values=["profanity_and_toxicity"])
                        | threat.indicator.confidence := Vendor.profanity_and_toxicity.data.classifications[0].confidence;
                    *;
                    }
                | case {
                    Vendor.findings.sentiment.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: Reputational Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.001"]) // External Harms: Reputational Harm
                        | array:append("threat.technique.name[]", values=["sentiment"]);
                    *;
                    }
                | case {
                    Vendor.findings.selfharm.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: User Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.003"]) // External Harms: User Harm
                        | array:append("threat.technique.name[]", values=["selfharm"])
                        | threat.indicator.confidence := Vendor.selfharm.data.classifications[0].confidence;
                    *;
                }
                | case {
                    Vendor.findings.confidential_and_pii_entity.detected = "true"
                        | threat.indicator.type := "Exfiltration"
                        | threat.indicator.name := "LLM Data Leakage"
                        | array:append("threat.tactic.id[]", values=["AML.T0057"]) //LLM Data Leakage
                        | array:append("threat.technique.name[]", values=["pii_entity"]);
                    *;
                    }
                | case {
                    Vendor.findings.malicious_prompt.detected = "true"
                        | threat.indicator.type := "Execution"
                        | threat.indicator.name := "LLM Prompt Injection"
                        | array:append("threat.tactic.id[]", values=["AML.T0051"]) // LLM Prompt Injection
                        | array:append("threat.technique.name[]", values=["prompt_injection"]);
                    *;
                    }
                | case {
                    Vendor.findings.secret_and_key_entity.detected = "true"
                        | threat.indicator.type := "Credential Access"
                        | threat.indicator.name := "Unsecured Credentials"
                        | array:append("threat.tactic.id[]", values=["AML.T0055","AML.T0057"])
                        | array:append("threat.technique.name[]", values=["secrets_detection"]);
                    *;
                    }

                | threat.technique.reference[0] := "https://atlas.mitre.org/matrices/ATLAS"
                | threat.indicator.provider := event.provider
                | threat.indicator.description := event.reason
                | threat.framework := "MITRE ATLAS";
            *;
            }
      | groupBy([threat.indicator.name, count])
    end: now
    start: 1d
    width: 4
    options:
      cell-overflow: wrap-text
      column-overflow: truncate
      configured-columns: {}
      row-numbers-enabled: false
    visualization: table-view
    title: AI Threats detected
    isLive: false
    type: query
  80271673-47e9-46b8-a74e-2cf49b10dbaa:
    x: 0
    y: 2
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
      | timechart(series=Vendor.status, span=5m, function=[callFunction(function="count", field="Vendor.status")])
    end: '2025-12-12T00:45:25.912Z'
    start: '2025-12-12T00:44:59.485Z'
    width: 5
    options:
      connect-points: false
      imputation: none
    visualization: time-chart
    title: AIDR blocks over time
    isLive: false
    type: query
  9ef7f24f-8a8a-4164-823f-6104900213fa:
    x: 8
    y: 0
    description: Events recorded by AIDR
    height: 11
    queryString: "\"event_type\" = AIDRPromptDataEvent\n\n| table([Vendor.status,\
      \ Vendor.model_name, Vendor.summary]) "
    end: now
    start: 1d
    width: 4
    options:
      cell-overflow: wrap-text
      column-overflow: truncate
      configured-columns: {}
      row-numbers-enabled: false
    visualization: table-view
    title: AIDR Events
    isLive: false
    type: query
  858b0399-ed2f-493b-99f4-0f713bdf208d:
    x: 4
    y: 15
    description: 'Count: # of Detections for each Collector'
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
      | groupby([ Vendor.collector_name, Vendor.status, count]) | sort(_count)
    end: now
    start: 1d
    width: 4
    options:
      cell-overflow: wrap-text
      column-overflow: truncate
      configured-columns: {}
      row-numbers-enabled: false
    visualization: table-view
    title: Detections Counts per Collector
    isLive: false
    type: query
  e81f4137-59ca-41bf-90e2-b35f8e25d3a0:
    x: 0
    y: 6
    description: User detected attack indicator
    height: 5
    queryString: |-
      "event_type" = AIDRPromptDataEvent
        | case {
            Vendor.status = "blocked" or Vendor.findings.malicious_prompt.data.action = "report"
                | rule.name := "LLM abuse"
                | threat.indicator.confidence := ""
                | threat.indicator.type := ""
                | threat.indicator.name := ""
                | threat.indicator.ip := ""

                // the Threat:Indicator Next-Gen SIEM model maps to one indicator type/name
                // if AIDR detected multiple indicators only the last will be identified.
                // Ordering these according to priority
                | case {
                    Vendor.findings.custom_entity.detected = "true"
                        | threat.indicator.type := "Custom defined"
                        | threat.indicator.name := "Custom defined"
                        | array:append("threat.tactic.id[]", values=["Custom defined"]) // LLM Prompt Injection
                        | array:append("threat.technique.name[]", values=["custom_entity"]);
                    *;
                    }
                | case {
                    Vendor.findings.language_detection.detected = "true"
                        | threat.indicator.type := "Execution"
                        | threat.indicator.name := "LLM Prompt Injection"
                        | array:append("threat.tactic.id[]", values=["AML.T0051"]) // LLM Prompt Injection
                        | array:append("threat.technique.name[]", values=["language_detection"]);
                    *;
                    }
                | case {
                    Vendor.findings.competitors.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: Financial Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.000"]) // External Harms: Financial Harm
                        | array:append("threat.technique.name[]", values=["competitors"]);
                    *;
                    }
                | case {
                    Vendor.findings.profanity_and_toxicity.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: Reputational Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.001"]) //External Harms: Reputational Harm
                        | array:append("threat.technique.name[]", values=["profanity_and_toxicity"])
                        | threat.indicator.confidence := Vendor.profanity_and_toxicity.data.classifications[0].confidence;
                    *;
                    }
                | case {
                    Vendor.findings.sentiment.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: Reputational Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.001"]) // External Harms: Reputational Harm
                        | array:append("threat.technique.name[]", values=["sentiment"]);
                    *;
                    }
                | case {
                    Vendor.findings.selfharm.detected = "true"
                        | threat.indicator.type := "Impact"
                        | threat.indicator.name := "External Harms: User Harm"
                        | array:append("threat.tactic.id[]", values=["AML.T0048.003"]) // External Harms: User Harm
                        | array:append("threat.technique.name[]", values=["selfharm"])
                        | threat.indicator.confidence := Vendor.selfharm.data.classifications[0].confidence;
                    *;
                }
                | case {
                    Vendor.findings.confidential_and_pii_entity.detected = "true"
                        | threat.indicator.type := "Exfiltration"
                        | threat.indicator.name := "LLM Data Leakage"
                        | array:append("threat.tactic.id[]", values=["AML.T0057"]) //LLM Data Leakage
                        | array:append("threat.technique.name[]", values=["pii_entity"]);
                    *;
                    }
                | case {
                    Vendor.findings.malicious_prompt.detected = "true"
                        | threat.indicator.type := "Execution"
                        | threat.indicator.name := "LLM Prompt Injection"
                        | array:append("threat.tactic.id[]", values=["AML.T0051"]) // LLM Prompt Injection
                        | array:append("threat.technique.name[]", values=["prompt_injection"]);
                    *;
                    }
                | case {
                    Vendor.findings.secret_and_key_entity.detected = "true"
                        | threat.indicator.type := "Credential Access"
                        | threat.indicator.name := "Unsecured Credentials"
                        | array:append("threat.tactic.id[]", values=["AML.T0055","AML.T0057"])
                        | array:append("threat.technique.name[]", values=["secrets_detection"]);
                    *;
                    }

                | threat.technique.reference[0] := "https://atlas.mitre.org/matrices/ATLAS"
                | threat.indicator.provider := event.provider
                | threat.indicator.description := event.reason
                | threat.framework := "MITRE ATLAS";
            *;
            }
      | sankey(source="Vendor.user_id", target="threat.indicator.name", weight=count("Vendor.user_id"))
    visualization: sankey
    end: now
    start: 1d
    width: 8
    title: User Sankey
    isLive: false
    type: query
  ea6de09f-be1b-426e-aeab-46f38938f82e:
    x: 8
    y: 11
    description: Number of AIDR events blocked
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
      | Vendor.status = blocked | count()
    end: now
    start: 1d
    width: 4
    options:
      default: {}
    visualization: single-value
    title: AIDR Blocked count
    isLive: false
    type: query
  9a555ada-e757-4e0f-b4ad-294276844053:
    x: 0
    y: 19
    description: 'Total number of identities (users, token names)'
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
      | count(field=Vendor.user_id, distinct=true)
    end: now
    start: 1d
    width: 4
    options:
      default: {}
    visualization: single-value
    title: Users - Total
    isLive: false
    type: query
  d5593247-8b3d-44da-ace0-3c9a048313e4:
    x: 5
    y: 0
    description: 'Events allowed/denied'
    height: 6
    queryString: "\"event_type\" = AIDRPromptDataEvent\n| groupBy(Vendor.status) "
    end: '2025-12-12T00:46:00Z'
    start: '2025-12-12T00:45:00Z'
    width: 3
    options:
      cell-overflow: wrap-text
      column-overflow: truncate
      configured-columns: {}
      row-numbers-enabled: false
    visualization: table-view
    title: AIDR Allowed
    isLive: false
    type: query
  012d2794-4149-49dd-9ce9-679ed27c5e2f:
    x: 4
    y: 11
    description: Total number of AIDR events processed
    height: 4
    queryString: |-
      "event_type" = AIDRPromptDataEvent
      | count()
    end: now
    start: 1d
    width: 4
    options:
      default: {}
    visualization: single-value
    title: Total AI Interactions
    isLive: false
    type: query
$schema: https://schemas.humio.com/dashboard/v0.23.0