u/JustReboot_Winning

I am in desperate need to surface all the activity from a recent engagement we had. I thought the fastest way, without agentworks, is to stand up a CrowdStrike MCP server, create a Copilot agent and (the unknown) give it access to the MCP to hunt based on my NLPs. I am hoping others in this forum have done this or similar setups and can give me some insights, gotchas, or other advise on how to make this work.

thanks in advance

Looking for ideas or queries to help identify AI usage via Falcon Insights. I need to build a case for AIDR but I am not confident that I have a full understanding of its usage across all my organizations business units. There used to be a dashboard that showed dns and process activity but I do not see that in my specific tenant (only running Insights). Anyone already come up with a query (maybe even with cool dashboard displays) that show the full picture of AI usage from the edr vantage points?