Skip to content
Threat Feed
medium advisory

CrowdStrike Charlotte AI AgentWorks and Agentic SOAR for Automated Security Operations

CrowdStrike's Charlotte AI AgentWorks and Agentic SOAR enable agentic security operations by providing a hub for building and orchestrating AI-powered security agents, reducing manual workloads and accelerating AI adoption with free AI credits.

Triage facts

Revision 2
Evidence
Unknown
Severity
Medium
Sources
1 public source
Freshness
Revision 2Mar 28, 21:52 UTC
Detection
2 rules
Revision history 1 entry · Revision 2
  1. Revision 2

    Repaired a legacy canonical identity collision

    Changed: slug

CrowdStrike has introduced Charlotte AI AgentWorks and Charlotte Agentic SOAR to revolutionize security operations through AI-powered automation. Charlotte AI AgentWorks acts as a central hub for building and scaling security agents across diverse teams and environments. It integrates with AI models from Anthropic, NVIDIA, and OpenAI, leveraging services like Amazon Bedrock and Amazon SageMaker. Charlotte Agentic SOAR orchestrates these agents, automating time-intensive tasks and streamlining investigations. This new model aims to amplify human expertise with machine speed, shifting analysts from manual firefighting to strategic oversight. CrowdStrike is offering 50 free AI credits per month to encourage customer adoption and facilitate the transition to agentic operations.

Attack Chain

This brief describes a product, not a threat actor or attack campaign. Therefore, there is no attack chain.

Impact

The intended impact of Charlotte AI AgentWorks and Agentic SOAR is to reduce manual investigation workloads by 70%, restore more than 40 hours of team capacity per week, and achieve greater than 98% decision accuracy. Successful implementation should reshape the analyst experience by eliminating toil, accelerating outcomes, and helping teams seize an operating advantage in the AI era. Failure to adopt such systems could leave organizations vulnerable to AI-accelerated adversaries and eCrime breakout times that can be as fast as 27 seconds.

Recommendation

  • Evaluate Charlotte AI AgentWorks and Agentic SOAR within your security operations to assess their potential impact on automation and efficiency (refer to the overview).
  • Utilize the offered 50 free AI credits per month to experiment with and deploy mission-ready agents across Falcon platform modules (refer to the "Activate Charlotte AI with Free Credits Today" section).
  • Design and implement automated workflows using the natural language processing capabilities of Charlotte AI, as described in the "Activate Charlotte AI with Free Credits Today" section.

Detection coverage 2

Detect Amazon SageMaker Usage

info

Detects usage of Amazon SageMaker which is integrated with Charlotte AI AgentWorks

sigma tactics: defense_evasion sources: cloudtrail, aws

Detect Amazon Bedrock Usage

info

Detects usage of Amazon Bedrock which is integrated with Charlotte AI AgentWorks

sigma tactics: defense_evasion sources: cloudtrail, aws

Detection queries are available on the platform. Get full rules →