Cyera Endpoint Analyzer via CrowdStrike Falcon Deployment

This guide walks you through installing and configuring the Cyera Endpoint Analyzer app in your CrowdStrike Falcon tenant. The app runs Cyera's ephemeral endpoint scanner on your Windows and Mac hosts on a daily schedule via Falcon Real Time Response (RTR).

The deployment is agentless. There is no new software to install and no Cyera service account in your tenant. Cyera operates entirely within your existing CrowdStrike trust boundary: a Fusion SOAR workflow runs a pre-approved, signed script through RTR, which downloads and runs an ephemeral Cyera agent. The agent collects AI-tool signatures (Claude Code, Cursor, Copilot - configs, install paths, versions, and running processes), uploads its findings to Cyera, and tears itself down. No persistent service remains on the host.

Prerequisites

Required CrowdStrike capabilities

The following Falcon capabilities must be enabled in your tenant:

• Real Time Response (RTR) - runs the initial script on endpoints.
• Falcon Foundry - hosts the Cyera app.
• Fusion SOAR - schedules and orchestrates the deployment workflow.

If you're unsure whether these are included in your current subscription, check with your CrowdStrike account team.

Roles

• Falcon Administrator - to import, deploy, release, and approve the app's scopes.
• Active Responder with Custom Scripts - to allow the initial script to run on endpoints.

A host group

Create (or choose) a host group containing the machines you want to deploy to. The workflow targets a group - to add a new host later, just add it to the group and it is onboarded on the next run.

The workflow automatically detects each host's platform (Windows or Mac) and runs the appropriate scanner. Hosts on other platforms are skipped.

Information to provide to Cyera

Your CrowdStrike Customer ID (CID) - Cyera needs this to securely bind the deployment workflow to your tenant, ensuring only requests from your Falcon environment can provision the scanner.

Where to find it: In the Falcon console, go to Host setup and management > Sensor downloads. Your CID is shown in step 2 (the hex string before the dash).

Step 1 - Enable Real Time Response on your target hosts

1. Go to Host setup and management > Response policies.
2. Select (or create) the policy that applies to the host group you prepared.
3. Enable Real Time Response and Custom Scripts so the deployment workflow can execute the Cyera agent loader on each endpoint.

Step 2 - Import and install the app

1. Go to Foundry > App builder > Import app.
2. Upload the .zip bundle provided by Cyera.
3. Click Deploy.
4. Once deployment succeeds, click Release.
5. Go to App catalog > Custom apps, find Cyera Endpoint Protection, and click Install.
6. Review and approve the requested permissions (RTR, devices, host-group, workflow).

Step 3 - Configure and enable the workflow

1. After install, go to Content management > Custom apps > Cyera Endpoint Protection.
2. Open the Cyera Agent Rollout workflow.
3. Configure:
   • Host group - select the host group you prepared.
   • Schedule - choose the daily run time.
4. Click Save to provision the workflow.

Verification

1. Wait for the first scheduled run, or trigger it manually from Fusion > Workflows.
2. Check Fusion > Executions. You should see:
   • get_download_url - Completed.
   • Device Query - returns your target hosts.
   • Per-host loop - cyera-agent-loader exits with status "success" on hosts.
3. Confirm with your Cyera contact that deployment results are arriving.

What you get

Once findings start arriving, Cyera classifies them and surfaces:

• AI Asset Inventory - the AI tools installed across your endpoint fleet, with configs, install paths, and versions.
• Shadow AI Discovery - AI tools in use that were never sanctioned.
• Agent Activity Analysis & Alerts - risk analysis and alerting on local agent activity.