Charlotte AI: Agentic AI for Cloud Detection and Response

crowdstrike · Tech · 2025 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.5 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Cloud detection and response for security operations

CrowdStrike needed Charlotte AI to help cloud defenders investigate fast-moving, malware-free, cloud-aware attacks by correlating fragmented workload and control-plane telemetry and automating tier-one SOC triage.

Constraints:

Architecture

Charlotte AI sits inside Falcon Cloud Security and Fusion SOAR workflows. Falcon detections and cloud telemetry feed Charlotte triage; Fusion triggers on alerts, enriches the alert with Kubernetes, cloud-control-plane, indicator, and sensor context through NGSIM queries, passes that context to a cloud-focused LLM prompt, and emits a triage verdict, confidence, explanation, email report, and response recommendations for SOC analysts.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  falcon-detection["Falcon detection"] --> charlotte-ai-triage["Charlotte AI triage"]
  falcon-detection --> fusion-soar-workflow["Fusion SOAR workflow"]
  falcon-detection --> ngsim-event-query["NGSIM event query"]
  cloud-runtime-protection["Cloud Runtime Protection"] --> falcon-detection
  cloud-runtime-protection --> workload-telemetry["workload telemetry"]
  cloud-runtime-protection --> cloud-control-plane-telemetry["cloud control plane telemetry"]
  workload-telemetry --> ngsim-event-query
  cloud-control-plane-telemetry --> ngsim-event-query
  fusion-soar-workflow --> charlotte-ai-triage
  fusion-soar-workflow --> ngsim-event-query
  charlotte-ai-triage --> cloud-latest-model["cloud latest model"]
  ngsim-event-query --> cloud-latest-model
  cloud-latest-model --> incident-report-email["incident report email"]
  fusion-soar-workflow --> incident-report-email
  incident-report-email --> soc-analyst["SOC analyst"]
  incident-report-email --> incident-response-actions["incident response actions"]
  soc-analyst --> incident-response-actions
Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component Role Interacts with
Falcon detection Security alert over workload, cloud, adversary, and runtime signals. Charlotte AI triage, Fusion SOAR workflow, NGSIM event query
Cloud Runtime Protection CrowdStrike cloud workload protection and cloud detection/response capability. Falcon detection, workload telemetry, cloud control plane telemetry
workload telemetry Kubernetes, runtime, container, node, namespace, image, and sensor context. Cloud Runtime Protection, NGSIM event query
cloud control plane telemetry Cloud API, account, region, misconfiguration, and control-plane detection context. Cloud Runtime Protection, NGSIM event query
Charlotte AI triage Analyzes detections, commands, and incident context to produce triage verdicts and explanations. Falcon detection, Fusion SOAR workflow, cloud latest model
Fusion SOAR workflow Security orchestration workflow that triggers Charlotte, passes alert IDs, runs enrichment, and sends reports. Falcon detection, Charlotte AI triage, NGSIM event query, incident report email
NGSIM event query Enriches alert IDs with Kubernetes, API, indicator, and sensor context. Falcon detection, Fusion SOAR workflow, workload telemetry, cloud control plane telemetry, cloud latest model
cloud latest model LLM used with a tier-one SOC analyst prompt over enriched Falcon data. Charlotte AI triage, NGSIM event query, incident report email
incident report email Generated report containing triage verdict, confidence, explanation, resources, and recommendations. Fusion SOAR workflow, SOC analyst, incident response actions
SOC analyst Reviews Charlotte's report, follows links to detections, and carries out investigation or containment. incident report email, incident response actions
incident response actions Containment and follow-up steps such as terminating containers, revoking keys, auditing roles, and reviewing logs. SOC analyst, incident report email

Data flow

A Falcon detection arrives from a Kubernetes or cloud workload event; a Fusion SOAR trigger sends the alert to Charlotte for triage; NGSIM queries enrich the alert with Kubernetes, cloud, API, indicator, and sensor fields; Charlotte uses the cloud latest model with a tier-one SOC analyst prompt; the completion becomes an email/report containing verdict, confidence, explanation, affected resources, and incident-response recommendations.

4 supporting quotes
“one, excuse me. This is the one. Okay, so what we've done here is set a trigger to say, "Hey, any alert that comes in, let's go ahead and trigger this action." So any alert that comes in, we're gonna have a Charlotte go ahead and triage that. The next thing that we're gonna do is”transcript, stated
“alert that comes in, let's go ahead and trigger this action." So any alert that comes in, we're gonna have a Charlotte go ahead and triage that. The next thing that we're gonna do is actually take the alert ID from that triage and we're gonna pass it to the next step.”transcript, stated
“We're gonna enrich that information with the Kubernetes context. So all of the container ID information, all of the namespace, the nodes”transcript, stated
“take the completion of that LLM call, and then pass that as a variable for the email. And this is what it looks like. So when this detection ran on June 9th, at about what time is it? Yeah, about three, I think 40 is when it ran. About four minutes later, we”transcript, stated

Why this architecture

CrowdStrike pairs Falcon telemetry with Charlotte/Fusion automation because cloud investigations require workload-plus-control-plane correlation, adversary context, and tier-one triage speed that does not scale linearly with analyst headcount.

3 supporting quotes
“ingest those cloud logs, look at those misconfigurations. But ultimately, a lot of times, this information is displayed in different areas, it's hard to correlate, and it, you know, oftentimes locks that correlated timeline based investigation. Tools don't speak the same languages.”transcript, stated
“there's this gap in correlation, right? And understanding the cloud context to activities that you might be seeing on the workload level.”transcript, stated
“you don't necessarily have that increase in SOC team headcount or manual effort that's scaling linearly with that”transcript, stated

Models used: Charlotte AI · cloud latest model

Scale

Alternatives considered (roads not taken)

Manual investigation across Falcon screens

Rejected because: The demo first manually traverses detection, asset graph, and application context, then shows Charlotte automating much of that tier-one work.

“we manually went through, looked at the asset graph, looked at information of the application context itself, and now what we're gonna do is kind of shift gears and kind of take a look at what it would look like leveraging Charlotte. So one of the things”transcript, stated
“have fully contained this threat. So as you can see, we can use Charlotte AI and fusion workflows to automate a lot of that tier one work. So that was my demo. Hope you guys enjoyed it. If you guys have any questions, I know Christian's about to go through a couple slides. I do just wanna go back to”transcript, stated

Separate workload protection and CSPM tools

Rejected because: The speakers say fragmented cloud tooling creates incomplete pictures, limited context, and no correlated timeline.

“The two main buckets where you see these capabilities fall into is cloud workload protection and CSPM. Workload protection is gonna be looking at those Kubernetes logs, runtime events, as well as anything that's been running on, you know, any container or”transcript, stated
“Tools don't speak the same languages. There's limited context on cloud behaviors and ultimately too much noise and not enough signal.”transcript, stated

Use Charlotte only as a one-off generative assistant

Rejected because: CrowdStrike distinguishes generative prompting from agentic goal completion over time and positions Charlotte as capable of both.

“speak a little bit on the difference between generative and agentic AI, especially because Charlotte AI can be both. She can do both if you need her to. So generative AI is when you have a very specific question or prompt that you want her to analyze and that can come in handy,”transcript, stated
“kind of pull the cloud control plane context and maybe query action send for specific things. But an AI agent is something that can complete a goal over time and that is something that becomes increasingly important as it becomes harder to understand. You know, if you get an alert,”transcript, stated

Patterns

tool-use-orchestration (security-automation)

Charlotte is embedded in Fusion SOAR so alert triage, event queries, context enrichment, and report generation run as a workflow rather than a single chat prompt.

“if we go into Fusion SOAR, which is our native security orchestration, I can show you guys a Charlotte workflow.”transcript, stated
“The next thing that we're gonna do is actually take the alert ID from that triage and we're gonna pass it to the next step.”transcript, stated

observability-tracing (security-context)

The workflow enriches detections with Kubernetes, cloud control-plane, API, indicator, and sensor context so the report can trace its reasoning to Falcon data.

“This data consists of information about the cluster, as well as detections from the cloud control plane”transcript, stated
“What pod was compromised, what was the image? Where is that image committed to?”transcript, stated

human-in-the-loop-gate (security-operations)

Charlotte automates triage and recommendations but still sends analysts a report, links, and follow-up steps for investigation and containment.

“However, this incident requires further investigation. Please revoke the access keys, delete any user accounts, audit the EKS node group roll permissions, investigate the source image, review the network logs, implement network policies, and consider implementing runtime security controls.”transcript, stated
“I recommend scheduling an incident review meeting to discuss with additional security measures from our Kubernetes environment to ensure we have fully contained this threat.”transcript, stated

safety-policy-enforcement (security-response)

Charlotte's recommendations include containment, credential revocation, role audits, network review, and runtime security controls rather than merely explaining the alert.

“Please revoke the access keys, delete any user accounts, audit the EKS node group roll permissions”transcript, stated
“implement network policies, and consider implementing runtime security controls.”transcript, stated

Tradeoffs

Automate tier-one work while preserving human investigation.

Chose Charlotte-generated triage reports, confidence, recommendations, and links over Fully autonomous incident closure.

Rationale: The workflow speeds triage and containment suggestions but still calls for investigation, review, and analyst action on sensitive security incidents.

“give us your triage verdict, your triage recommendation, your triage confidence, and your triage explanation.”transcript, stated
“However, this incident requires further investigation. Please revoke the access keys, delete any user accounts, audit the EKS node group roll permissions, investigate the source image, review the network logs, implement network policies, and consider implementing runtime security controls.”transcript, stated

Correlate cloud telemetry inside Falcon instead of leaving separate tools.

Chose Unified cloud detection and response over workload/control-plane silos over Fragmented CSPM and workload protection views.

Rationale: Cloud incidents cross layers, and analysts need a correlated timeline and context to understand scope.

“limited context on cloud behaviors and ultimately too much noise and not enough signal.”transcript, stated
“understanding the cloud context to activities that you might be seeing on the workload level.”transcript, stated

Use agentic workflows for goals over time.

Chose Charlotte as an agent that can guide investigation workflow over Only one-off generative prompts.

Rationale: Cloud alerts require understanding what happened, scope, and next actions, which maps better to a goal-completion workflow than a single explanation.

“But an AI agent is something that can complete a goal over time and that is something that becomes increasingly important as it becomes harder to understand.”transcript, stated
“what exactly is happening, what is the scope and what do you do next?”transcript, stated

Gotchas (what bit them)

Cloud investigations fail when workload and control-plane context are split.

Root cause: Traditional cloud tooling separates workload protection and CSPM, leaving analysts to correlate different views manually.

Resolution: Use Falcon Cloud Runtime Protection and Charlotte to correlate workload, control-plane, and cloud context.

“where you have visibility at the workload level, and then you also have visibility at the cloud control plane level, but there's this gap in correlation”transcript, stated
“that has really given rise to this new sort of category of solution, which is cloud detection and response”transcript, stated

Alert volume grows faster than analyst capacity.

Root cause: Cloud footprints expand, threat volume rises, and alert/log variety increases without a matching linear increase in SOC headcount.

Resolution: Automate tier-one triage and reporting to bend the labor curve.

“So as I spoke about earlier, right, as organizations continue to expand their cloud footprints, threat volumes rise and so do alert volumes, right? Because the cloud has a very dynamic nature to it, so you're looking at a much larger volume and variety of logs and alerts to have to sift through.”transcript, stated
“help bend that labor curve so that you can continue to move with that same efficiency and speed”transcript, stated

Malware-free attacks reduce the usefulness of malware-centric detection alone.

Root cause: Adversaries use legitimate credentials and hands-on-keyboard techniques that blend into normal activity.

Resolution: Use adversary-focused context, cloud behavior correlation, and incident-level reasoning.

“Malware free essentially means that an adversary is engaging in a hands-on keyboard attack”transcript, stated
“or an attack which is meant to blend in with legitimate user activity.”transcript, stated

Evaluation

The transcript demonstrates evaluation through live incident triage outputs: Charlotte analyzes a reverse shell, labels a detection true positive, reports confidence and explanation, and generates response recommendations from enriched Falcon data.

Metrics: breakout time · malware-free detection share · cloud intrusion growth · time from detection to report email · triage verdict · triage recommendation · triage confidence · incident-response recommendation completeness

3 supporting quotes
“So she will automatically triage any detection that comes in. So she has said that we should escalate this and that it is a true positive and provides a nice verdict.”transcript, stated
“she has said that we should escalate this and that it is a true positive and provides a nice verdict.”transcript, stated
“The verdict is a true positive, what's the recommendation, what's the confidence, and what's the explanation?”transcript, stated

Outcomes

Threat-scale context includes 51-second breakout time, almost eight in ten malware-free detections, 45% cloud-intrusion growth, and SOC alert volume rising faster than headcount.

3 supporting quotes
“So you can click here and go right to that detection, and then she provides incident response recommendations. She's already taken immediate action by terminating the compromised container to evict the adversary.”transcript, stated
“She's already taken immediate action by terminating the compromised container to evict the adversary.”transcript, stated
“So as you can see, we can use Charlotte AI and fusion workflows to automate a lot of that tier one work.”transcript, stated