How to Use CrowdStrike Charlotte AI in 2026: Step-by-Step Guide
CrowdStrike Charlotte AI is an AI-powered security analyst built into the Falcon platform. Security teams can ask questions about threats, investigations, and vulnerabilities in plain English, and Charlotte AI generates contextual threat intelligence, incident summaries, and remediation guidance.
CrowdStrike Charlotte AI brings conversational AI to enterprise cybersecurity operations, letting security analysts interact with the Falcon platform using natural language rather than complex query languages.
What Charlotte AI Does
Charlotte AI acts as an AI analyst that can answer questions like: "What happened in this alert? What did the attacker do?" or "Are there other machines affected by this threat?" It understands the full context of your CrowdStrike environment — active threats, device inventory, vulnerability status — and returns answers in plain English with supporting evidence.
Guided Triage and Investigation
Security analysts spend the majority of their time triaging alerts — most of which turn out to be false positives. Charlotte AI dramatically accelerates triage by auto-summarizing alert context, explaining why an indicator triggered, and recommending immediate response actions. Analysts can investigate complex incidents in minutes rather than hours.
Threat Intelligence Integration
Charlotte AI connects to CrowdStrike's threat intelligence database (one of the most comprehensive in the industry, covering 230+ adversary groups). It can explain who is behind a specific attack pattern, what industries they typically target, and what their known TTPs (tactics, techniques, and procedures) are — giving analysts adversary-specific context during investigation.
Vulnerability Prioritization
Charlotte AI helps security teams prioritize which CVEs to patch first based on active exploitation in the wild, asset criticality, and attack surface. Instead of patching 1,000 CVEs in order of CVSS score, teams can ask "What are the most urgent vulnerabilities for our environment right now?" and get a prioritized, justified answer.
Workflow Automation
Charlotte AI can initiate response actions — quarantine an endpoint, block a hash, run a real-time query across the fleet — directly from the conversational interface. Investigation and response happen in one flow rather than switching between tools.
Availability
Charlotte AI is available to CrowdStrike Falcon customers as an add-on module. Pricing is enterprise (custom quote based on seats and modules).
What You'll Need
- A CrowdStrike Charlotte AI account (starting from Contact for pricing)
- A modern web browser or the CrowdStrike Charlotte AI app
- Payment method for paid features
Getting Started
Create Your Account
Visit https://www.crowdstrike.com/charlotte-ai/ and sign up for a enterprise account. You'll need an email address to register.
Start Your First Conversation
Once logged in, you'll see the main chat interface. Type a question or task in the input box and press Enter. CrowdStrike Charlotte AI supports threat-investigation, alert-triage, threat-intelligence, vulnerability-prioritization, incident-response, natural-language-security — start with a simple text prompt to get familiar.
Pro Tips
- Be specific: The more context you provide, the better the response. Instead of "write an email," try "write a professional follow-up email to a client who hasn't responded in two weeks."
- Iterate: If you don't get what you need, ask for clarification or refinement: "Make it shorter" or "Use a more formal tone."
- Use examples: Show CrowdStrike Charlotte AI what format you want by including an example in your prompt.
- Save useful conversations: Most platforms let you name and revisit conversations — organize by project or topic.
Common Use Cases
Research & Analysis
Chatbots that help with data analysis, literature review, and in-depth research tasks.
Browse Research & Analysis chatbots →Productivity
AI tools for task management, scheduling, summarization, and workflow optimization.
Browse Productivity chatbots →Troubleshooting
- Responses seem generic or unhelpful
- Add more context to your prompt. Specify the audience, tone, length, and format you need. Try starting over with a clearer description of your goal.
- The tool isn't responding or is slow
- AI chatbots can experience high traffic. Refresh the page and try again. Check the service's status page if issues persist.
- Output is too long or too short
- Explicitly specify the length: "in 100 words," "as a brief summary," or "in detail with examples."
Get Weekly Chatbot Tips
Not sure which AI tool is right for you? Our newsletter covers reviews, tutorials, and comparisons weekly.
Frequently Asked Questions
- Is CrowdStrike Charlotte AI free to use?
- CrowdStrike Charlotte AI requires a paid subscription, starting from Contact for pricing.
- Do I need an account to use CrowdStrike Charlotte AI?
- Yes, you need to create an account to use CrowdStrike Charlotte AI.
- What can I use CrowdStrike Charlotte AI for?
- CrowdStrike Charlotte AI is an AI-powered security analyst built into the Falcon platform. Security teams can ask questions about threats, investigations, and vulnerabilities in plain English, and Charlotte AI generates contextual threat intelligence, incident summaries, and remediation guidance.
Related Guides
Know a tool we're missing? Submit it free →