# Chron → CrowdStrike LogScale

Stream AI session telemetry directly from developer machines into your CrowdStrike LogScale repository. No relay service, no data routed through Chron infrastructure — events go from the developer's machine straight to your own LogScale instance.

## Prerequisites

- CrowdStrike Falcon with **LogScale / Next-Gen SIEM** access
- Admin access to create a LogScale repository and ingest token

## Step 1 — Create a LogScale repository

1. Open Falcon console → **Log Management** → **Repositories**
2. Click **New repository** → name it `ChronAIEvents` (or any name)
3. Go to **Settings** → **API Tokens** → **Add token**
4. Select **Ingest** permission, name it `chron-ingest`, copy the token

## Step 2 — Get your cluster URL

Your LogScale ingest URL follows this pattern:

```
https://<your-cluster>.humio.com/api/v1/ingest/humio-structured
```

Common cluster URLs:
- US: `https://cloud.us.humio.com/api/v1/ingest/humio-structured`
- EU: `https://cloud.humio.com/api/v1/ingest/humio-structured`

Your exact URL is visible in Falcon under **Log Management → Repositories → <your repo> → Ingest API**.

## Step 3 — Connect from the developer machine

Run the onboarding command:

```bash
chron connect crowdstrike
```

Paste the ingest URL and token when prompted. The command sends a test event and confirms the connection before saving.

## Step 4 — Add env vars to your MCP client

The `connect` command prints the exact block to paste. For Claude Code, add to the `chron` entry in `~/.claude.json`:

```json
{
  "mcpServers": {
    "chron": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/dist/index.js"],
      "env": {
        "CHRON_LOGSCALE_URL": "https://<your-cluster>.humio.com/api/v1/ingest/humio-structured",
        "CHRON_LOGSCALE_TOKEN": "<your-ingest-token>"
      }
    }
  }
}
```

For org-wide rollout, push these env vars via MDM (Jamf, Intune, etc.) instead of configuring each machine individually.

## Step 5 — Import the dashboard

In Falcon console → **Log Management** → **Dashboards** → **Import**:

```
node_modules/chron-mcp/dashboards/logscale/chron-ai-activity.yaml
```

The dashboard includes five widgets:
- **Daily Active Developers** — distinct machines with AI sessions per day
- **AI Tool Usage** — breakdown by tool (Claude, Cursor, Windsurf, etc.)
- **Secrets Detected by Type** — credential exposures over time
- **Sessions by Developer** — per-machine session count with AI tool
- **Credential Exposures** — full table of api_key, jwt, aws_key detections for SOC review

## Step 6 — Set up the API key alert (optional)

In LogScale, create a **Scheduled Search** using `api-key-alert.lql`:

```
event_type = "secret_detected"
| detection_type in ["api_key", "aws_key", "gcp_key", "azure_key", "private_key", "jwt"]
| table([#host, ai_tool, detection_type, masked_value, session_id_prefix, @timestamp])
```

Set the alert to trigger when results > 0 and route to your SOC notification channel.

## Event schema

All events arrive in LogScale with:

| Tag | Value |
|---|---|
| `#host` | Developer's machine hostname |
| `#source` | `chron-mcp` |

| Attribute | Present on |
|---|---|
| `event_type` | All events: `session_started`, `message_logged`, `secret_detected` |
| `session_id_prefix` | All events |
| `ai_tool` | All events: `claude`, `cursor`, `windsurf`, etc. |
| `os` | All events: `darwin`, `linux`, `win32` |
| `chron_version` | All events |
| `role` | `message_logged` only: `user` or `assistant` |
| `detection_type` | `secret_detected` only: `api_key`, `aws_key`, `jwt`, etc. |
| `masked_value` | `secret_detected` only: e.g. `AKIA****F3K2` |

**What is never transmitted:** message content, actual secret values, file paths, or any user-typed text.

## Individual LQL queries

| File | Use |
|---|---|
| `secrets-by-type.lql` | Time-series widget — secret detections by type |
| `sessions-by-developer.lql` | Table — sessions per host and AI tool |
| `api-key-alert.lql` | Scheduled alert — credential exposures |
| `ai-tool-usage.lql` | Pie chart — tool adoption breakdown |
| `daily-active-developers.lql` | Time-series — distinct active machines per day |
| `chron-ai-activity.yaml` | Full importable dashboard (all five) |
