---
title: "How to automate NordLayer logouts with CrowdStrike"
slug: "automate-nordlayer-logouts-crowdstrike"
updated: 2026-09-29T08:37:43Z
published: 2026-09-29T08:37:43Z
canonical: "help.nordlayer.com/automate-nordlayer-logouts-crowdstrike"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to automate NordLayer logouts with CrowdStrike

This guide walks you through integrating NordLayer with CrowdStrike Falcon so that when CrowdStrike detects a security event, the affected NordLayer member is automatically logged out and disconnected from all gateways. The member must then re-authenticate before regaining access to private gateways and sensitive company resources.

The integration uses NordLayer's Custom Integration API, triggered by a CrowdStrike Falcon Next-Gen SIEM workflow that sends an HTTP POST request containing the affected member's email address or device name.

**Prerequisites**

- NordLayer account with administrator access to the Control Panel.
- CrowdStrike Falcon platform with access to Next-Gen SIEM.
- CrowdStrike must be capable of sending webhooks and sending the correctly formatted JSON payload as described below.
- Knowledge of the member email addresses or device names managed in NordLayer.

## Obtain custom integration API credentials from NordLayer

1. Log into the **NordLayer Control Panel**, and click on **Integrations** from the left sidebar menu.

![NordLayer integrations page showing SentinelOne and Jamf Cloud options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/1-Integrations%20-%20Custom(1).png)

1. Under the **Custom integrations** section, click **Add custom integration** button.
2. A configuration window will appear. Enter a descriptive name for the integration (e.g., "CrowdStrike Falcon Log Out"), then click **Next**.

![NordLayer custom integration setup modal showing webhook URL and secret token](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/2-Integrations%20-%20Custom%20-%20Enable%20-%20Step%202%20-%20Modal%20view(1).png)

1. You will now see your integration details: **URL** and a **Secret token**. You will need both of these credentials in the next steps:
  1. **URL** — the endpoint that CrowdStrike will send requests to.
  2. **Secret token** — used as a Bearer token for authentication.

Note

Copy these credentials and store them in a secure location. You can only access these credentials once. If you close this window or attempt to reopen it later, new credentials will be generated, invalidating the previous ones.

## Configure CrowdStrike Falcon workflow

In this part, you will create a workflow in CrowdStrike Falcon's Next-Gen SIEM that checks for detection events and sends an HTTP request to NordLayer to log out the affected member.

1. Log in the **CrowdStrike Falcon console** and navigate to **Next-Gen SIEM**, then select **Workflows**.

![CrowdStrike Next-Gen SIEM workflows menu with navigation options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-03-20%20at%2016.05.27%201(1).png)

1. Click **Create workflow**.

![CrowdStrike workflows dashboard with filters and create workflow button](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/asset-9(1).png)

1. Select the Customer IDs (CIDs) that this workflow should apply to, then click **Next**.

![CrowdStrike workflow CID selection dialog with parent and child options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/asset-1(1).png)

1. Choose the option to create the workflow from scratch (rather than using a template).

![CrowdStrike create workflow dialog with scratch, import, and playbook options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/asset-4(1).png)

1. Select a trigger that will start the workflow and confirm your selection by choosing the appropriate trigger type.

![CrowdStrike add trigger dialog with workflow automation options and categories](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/asset-10%20(1)(1).png)

1. After adding the trigger, you need to ensure the webhook only activates for relevant severity levels. Click **Condition** to add a filtering rule.

![CrowdStrike endpoint security audit events grid with multiple trigger options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-03-20%20at%2016.35.38%201(1).png)

1. Configure the condition so that the workflow only proceeds for medium or higher severity detections. Confirm the condition by clicking **Next**.

![CrowdStrike detection severity trigger configuration with type dropdown](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/asset(1).png)

1. Once the condition is in place, add an action by selecting **Create HTTP request**, then choose **Create cloud HTTP request**.

![CrowdStrike HTTP request creation dialog with cloud, on-premises, and API options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/asset-3(1).png)

1. Select the option to create new authentication and configure it as follows:

| Setting | Value |
| --- | --- |
| Authentication type | API key |
| API secret prefix | Bearer |
| API secret key | Paste the Secret token copied from NordLayer |
| API key location | Header |
| Header name | Authorization |
| Method | POST |
| Endpoint URL | Paste the URL copied from NordLayer |

![CrowdStrike HTTP request configuration with API authentication and JSON payload](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-03-20%20at%2016.44.29%201(1).png)

Note

The request body must be a JSON payload that NordLayer can parse. The JSON must include the member's email address (*userEmailAddress*) or the Device ID field called *agentComputerName*.

![CrowdStrike workflow data structure showing detection, trigger, and execution fields](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202026-03-20%20at%2017.23.59%201(1).png)

1. Use CrowdStrike's trigger payload placeholders (visible on the right-side panel in the workflow editor) to dynamically populate these fields from the detection event data.

Example JSON payload with CrowdStrike placeholders:

```
{
  "userDetails": {
    "userEmailAddress":
      "${data['Trigger.FalconAudit.Detection.XDR.EntityValues.EmailAddresses'][0]}"
  },
  "agentRealtimeInfo": {
    "agentComputerName":
      "${data['Trigger.FalconAudit.Detection.XDR.EntityValues.HostNames'][0]}"
  }
}
```

Note

Some CrowdStrike trigger fields return an array rather than a single string. In those cases, you must append [*0*] to the end of the placeholder path to extract the first element. The example above already includes this notation.

The resulting payload received by NordLayer will look like this:

```
{
  "userDetails": {
    "userEmailAddress": "member@example.com"
  },
  "agentRealtimeInfo": {
    "agentComputerName": "DEVICE-NAME"
  }
}
```

*agentComputerName* corresponds to the device's hostname, automatically detected by the NordLayer App on the machine.

Note

- If a member email address is provided, NordLayer will log out the member from all devices.
- If a device name is provided, NordLayer will log out all members from all devices with the specified device name.

To successfully trigger the integration, the *agentComputerName* field must exactly match the device name (hostname) detected by NordLayer.

## Testing & verification

NordLayer does not display integration or webhook statuses within the Control Panel. It is essential that you perform your own tests to confirm that your integration works:

1. Generate or simulate a detection event in CrowdStrike Falcon that meets the severity condition you configured (medium or higher). This will cause the workflow to activate.
2. Verify that the specified NordLayer member's application logs out and disconnects immediately.
3. Go to the NordLayer Control Panel, click on the **Activity** tab in the main left menu, and select the **Actions** subpage. Check if it contains a confirmation record about the logged-out member.

---

**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.