Charlotte Agentic SOAR

CrowdStrike's governed workspace that unites agentic reasoning and deterministic workflows for security operations. CrowdStrike states that automated Charlotte AI response actions are configured through Charlotte Agentic SOAR (in workflows), with autonomy set per workflow from human-in-the-loop approval to fully autonomous execution.

AI capabilities recorded

• AI-directed endpoint containment

  Active · verified 2026-10-02

  Charlotte AI, within a configured agentic workflow, can determine whether network containment of a Falcon-managed endpoint is justified and, depending on workflow configuration, either submit the containment for human approval or execute it automatically. The documented action places the endpoint into network containment/isolation; the precise network communications that remain available during containment are not established by the attached public evidence. CrowdStrike's specific containment example is a dated (August 2025) simulation; the attribution of this mechanism to Charlotte Agentic SOAR by name is supported in substance but not explicitly stated by CrowdStrike.