CrowdStrike Charlotte AI

CrowdStrike Charlotte AI is an enterprise generative artificial intelligence security analyst assistant built natively into the CrowdStrike Falcon cybersecurity platform. Engineered to act as a force multiplier for security operations centers (SOCs) and incident responders of all experience levels, Charlotte AI allows security professionals to interact with the full depth of the CrowdStrike Falcon platform using natural language prompts, drastically accelerating investigation speeds, query authoring, and threat remediation.

Unlike generic public large language models that suffer from hallucinations and lack domain-specific cybersecurity context, Charlotte AI is trained exclusively on CrowdStrike proprietary cybersecurity data, including trillions of high-fidelity security events in the CrowdStrike Threat Graph, thousands of hours of elite OverWatch threat hunting telemetry, and world-class Falcon Intelligence research. Key technical capabilities include automated threat hunting query generation (translating natural language into optimized Falcon LogScale syntax), rapid incident summarization with MITRE ATT&CK attribution, automated root-cause explanations, and one-click remediation guidance. A tier-1 analyst can ask Charlotte AI complex questions—such as Which hosts in our fleet have communicated with newly discovered malicious domains?—and receive authoritative, context-rich answers in seconds.

Charlotte AI operates securely within the enterprise Falcon tenant, upholding strict data boundaries to ensure customer telemetry is never used to train public foundation models. Primary enterprise use cases include eliminating SOC alert fatigue, accelerating mean time to respond (MTTR) from hours to minutes, closing the cybersecurity skills gap, and automating repetitive security hygiene workflows. Charlotte AI adheres to stringent enterprise data privacy and security benchmarks, including SOC 2 Type II, ISO/IEC 27001, and GDPR.