CrowdStrike Charlotte AI

CrowdStrike Charlotte AI has expanded from a conversational security-analyst assistant into the reasoning core of CrowdStrike's "agentic SOC" — unifying AI reasoning with human analyst judgment across the Falcon platform, and now orchestrating autonomous agents rather than just answering questions.

What Charlotte AI Does

Charlotte AI acts as an AI analyst that can answer questions like: "What happened in this alert? What did the attacker do?" or "Are there other machines affected by this threat?" It understands the full context of your CrowdStrike environment — active threats, device inventory, vulnerability status — and returns answers in plain English with supporting evidence.

Charlotte Agentic SOAR

Charlotte Agentic SOAR coordinates multiple autonomous agents and human-AI teams through collaborative workflows, moving beyond single-question triage into multi-step investigation and response orchestration. CrowdStrike reports customers seeing roughly 3x faster response times, a 70% reduction in manual investigation effort, and 98% triage accuracy matching expert analyst decisions.

AgentWorks (Custom Agent Building)

AgentWorks lets security teams build specialized agents using natural-language instructions, without coding — configuring an agent's scope, tools, and escalation rules to handle a specific recurring workflow (e.g., phishing-report triage or CVE prioritization) autonomously.

Guided Triage and Investigation

Security analysts spend the majority of their time triaging alerts — most of which turn out to be false positives. Charlotte AI accelerates triage by auto-summarizing alert context, explaining why an indicator triggered, and recommending immediate response actions.

Threat Intelligence Integration

Charlotte AI connects to CrowdStrike's threat intelligence database (covering 230+ adversary groups), explaining who is behind a specific attack pattern, what industries they typically target, and their known TTPs (tactics, techniques, and procedures).

Vulnerability Prioritization

Charlotte AI helps security teams prioritize which CVEs to patch first based on active exploitation in the wild, asset criticality, and attack surface, rather than patching strictly by CVSS score.

Workflow Automation

Charlotte AI can initiate response actions — quarantine an endpoint, block a hash, run a real-time query across the fleet — directly from the conversational interface, or via an AgentWorks-built agent running autonomously.

Pricing

Charlotte AI and Agentic SOAR use flexible, credit-based pricing tied to agentic actions rather than a published rate card. Both the Essentials and full Agentic SOAR tiers are quote-only (CrowdStrike's pricing page shows "Contact us" for both) — available to Falcon customers as an add-on module, typically bundled via Falcon Flex licensing.