How to Use CrowdStrike Charlotte AI in 2026: Step-by-Step Guide
CrowdStrike Charlotte AI is the reasoning core of CrowdStrike's agentic SOC — security teams ask questions in plain English and get contextual threat intelligence, incident summaries, and remediation guidance, while Charlotte Agentic SOAR and the no-code AgentWorks builder let teams orchestrate autonomous investigation/response agents across the Falcon platform.
CrowdStrike Charlotte AI has expanded from a conversational security-analyst assistant into the reasoning core of CrowdStrike's "agentic SOC" — unifying AI reasoning with human analyst judgment across the Falcon platform, and now orchestrating autonomous agents rather than just answering questions.
What Charlotte AI Does
Charlotte AI acts as an AI analyst that can answer questions like: "What happened in this alert? What did the attacker do?" or "Are there other machines affected by this threat?" It understands the full context of your CrowdStrike environment — active threats, device inventory, vulnerability status — and returns answers in plain English with supporting evidence.
Charlotte Agentic SOAR
Charlotte Agentic SOAR coordinates multiple autonomous agents and human-AI teams through collaborative workflows, moving beyond single-question triage into multi-step investigation and response orchestration. CrowdStrike reports customers seeing roughly 3x faster response times, a 70% reduction in manual investigation effort, and 98% triage accuracy matching expert analyst decisions.
AgentWorks (Custom Agent Building)
AgentWorks lets security teams build specialized agents using natural-language instructions, without coding — configuring an agent's scope, tools, and escalation rules to handle a specific recurring workflow (e.g., phishing-report triage or CVE prioritization) autonomously.
Guided Triage and Investigation
Security analysts spend the majority of their time triaging alerts — most of which turn out to be false positives. Charlotte AI accelerates triage by auto-summarizing alert context, explaining why an indicator triggered, and recommending immediate response actions.
Threat Intelligence Integration
Charlotte AI connects to CrowdStrike's threat intelligence database (covering 230+ adversary groups), explaining who is behind a specific attack pattern, what industries they typically target, and their known TTPs (tactics, techniques, and procedures).
Vulnerability Prioritization
Charlotte AI helps security teams prioritize which CVEs to patch first based on active exploitation in the wild, asset criticality, and attack surface, rather than patching strictly by CVSS score.
Workflow Automation
Charlotte AI can initiate response actions — quarantine an endpoint, block a hash, run a real-time query across the fleet — directly from the conversational interface, or via an AgentWorks-built agent running autonomously.
Pricing
Charlotte AI and Agentic SOAR use flexible, credit-based pricing tied to agentic actions rather than a published rate card. Both the Essentials and full Agentic SOAR tiers are quote-only (CrowdStrike's pricing page shows "Contact us" for both) — available to Falcon customers as an add-on module, typically bundled via Falcon Flex licensing.
What You'll Need
- A CrowdStrike Charlotte AI account (starting from Contact for pricing (credit-based, agentic-action metered))
- A modern web browser or the CrowdStrike Charlotte AI app
- Payment method for paid features
Getting Started
Create Your Account
Visit https://www.crowdstrike.com/charlotte-ai/ and sign up for a enterprise account. You'll need an email address to register.
Start Your First Conversation
Once logged in, you'll see the main chat interface. Type a question or task in the input box and press Enter. CrowdStrike Charlotte AI supports threat-investigation, alert-triage, threat-intelligence, vulnerability-prioritization, incident-response, natural-language-security, agent-orchestration, custom-agent-building — start with a simple text prompt to get familiar.
Pro Tips
- Be specific: The more context you provide, the better the response. Instead of "write an email," try "write a professional follow-up email to a client who hasn't responded in two weeks."
- Iterate: If you don't get what you need, ask for clarification or refinement: "Make it shorter" or "Use a more formal tone."
- Use examples: Show CrowdStrike Charlotte AI what format you want by including an example in your prompt.
- Save useful conversations: Most platforms let you name and revisit conversations — organize by project or topic.
Common Use Cases
Research & Analysis
Chatbots that help with data analysis, literature review, and in-depth research tasks.
Browse Research & Analysis chatbots →Productivity
AI tools for task management, scheduling, summarization, and workflow optimization.
Browse Productivity chatbots →Troubleshooting
- Responses seem generic or unhelpful
- Add more context to your prompt. Specify the audience, tone, length, and format you need. Try starting over with a clearer description of your goal.
- The tool isn't responding or is slow
- AI chatbots can experience high traffic. Refresh the page and try again. Check the service's status page if issues persist.
- Output is too long or too short
- Explicitly specify the length: "in 100 words," "as a brief summary," or "in detail with examples."
Get Weekly Chatbot Tips
Not sure which AI tool is right for you? Our newsletter covers reviews, tutorials, and comparisons weekly.
Frequently Asked Questions
- Is CrowdStrike Charlotte AI free to use?
- CrowdStrike Charlotte AI requires a paid subscription, starting from Contact for pricing (credit-based, agentic-action metered).
- Do I need an account to use CrowdStrike Charlotte AI?
- Yes, you need to create an account to use CrowdStrike Charlotte AI.
- What can I use CrowdStrike Charlotte AI for?
- CrowdStrike Charlotte AI is the reasoning core of CrowdStrike's agentic SOC — security teams ask questions in plain English and get contextual threat intelligence, incident summaries, and remediation guidance, while Charlotte Agentic SOAR and the no-code AgentWorks builder let teams orchestrate autonomous investigation/response agents across the Falcon platform.
Related Guides
Know a tool we're missing? Submit it free →