CrowdStrike AI Footnotes
What CrowdStrike's AI features do with your data, as CrowdStrike publishes it. Checked October 31, 2026. CrowdStrike in the Directory.
Agent access
No official MCP server or agent API published as of October 31, 2026.
Charlotte AI (conversations and embedded features)
CrowdStrike Falcon platform, Charlotte AI Module or Charlotte Agentic SOAR
| On by default? | Off until a Falcon Administrator opts in from the Falcon console, for the free monthly credits and for Charlotte Agentic SOAR Essentials. CrowdStrike does not state the initial state for the paid Charlotte AI Module. source, source 2 · checked October 31, 2026 |
|---|---|
| How an admin turns it off | Falcon administrators assign Charlotte AI roles, which decide who can view or use Charlotte AI. CrowdStrike's public pages do not give the console path. source · checked October 31, 2026 |
| Trains on customer data? | Not published as of October 31, 2026 |
| Retention | Not published as of October 31, 2026 |
| Where data is processed | Not published as of October 31, 2026 |
| Model providers | Models fine-tuned by CrowdStrike plus third-party technologies; CrowdStrike names AWS Bedrock as a partner that sensitive data is routed through (blog, December 20, 2023). The AgentWorks page names AWS Bedrock as infrastructure and OpenAI GPT, Anthropic Claude and NVIDIA Nemotron among supported models. source, source 2, source 3 · checked October 31, 2026 |
| Price | Consumption: Charlotte AI is licensed by monthly credits shared across the customer's account. Since June 2026 customers pick a tier from 250 to 1,000,000 credits per month; unused credits do not carry over. Qualifying customers can opt in to 50 free credits per month. No price per credit is published. source, source 2, source 3 · checked October 31, 2026 |
Charlotte AI AgentWorks
CrowdStrike Falcon platform, with Charlotte AI credits
| On by default? | Prebuilt agents only generate information, summaries and recommendations by default. Actions that change the environment need configuration and approval by an authorized team member. source, source 2 · checked October 31, 2026 |
|---|---|
| How an admin turns it off | Role-based permissions, per-agent credit caps, execution traces, audit logs and configurable approvals. source · checked October 31, 2026 |
| Trains on customer data? | Not published as of October 31, 2026 |
| Retention | Not published as of October 31, 2026 |
| Where data is processed | Not published as of October 31, 2026 |
| Model providers | Runs on AWS Bedrock; the customer picks the model, including OpenAI GPT, Anthropic Claude and NVIDIA Nemotron. source · checked October 31, 2026 |
| Price | Consumption: draws on the same monthly Charlotte AI credits; an AgentWorks agent action likely consumes more credits than a chat interaction. Charlotte Agentic SOAR Essentials includes unlimited AgentWorks access. source, source 2 · checked October 31, 2026 |
Charlotte Agentic SOAR (Detection Triage Agent and Response Agent)
Charlotte Agentic SOAR, standalone or included in Falcon Next-Gen SIEM
| On by default? | Automated response actions are off by default. Teams choose which actions run on their own and which need human approval. source · checked October 31, 2026 |
|---|---|
| How an admin turns it off | Configured per workflow in Charlotte Agentic SOAR and per agent in AgentWorks: actions run autonomously or wait for human approval. source · checked October 31, 2026 |
| Trains on customer data? | Not published as of October 31, 2026 |
| Retention | Not published as of October 31, 2026 |
| Where data is processed | Not published as of October 31, 2026 |
| Model providers | Not published as of October 31, 2026 |
| Price | Consumption: paid tiers of 250 to 1,000,000 credits per month, shared across Charlotte AI features, SOAR workflows and Falcon Foundry apps. The free Essentials tier excludes the Detection Triage Agent and Response Agent. Next-Gen SIEM customers get credits based on paid ingestion. No list price is published. source, source 2, source 3 · checked October 31, 2026 |
Connections to outside MCP servers
Charlotte Agentic SOAR (the paid tier, not Essentials) includes bi-directional MCP access to connect Charlotte AI to other tools and third-party agents. CrowdStrike does not publish the release stage or the admin controls for it. source, source 2 · checked October 31, 2026
Compliance
- FedRAMP: CrowdStrike says FedRAMP High Certification applies, as of March 2026, to select Charlotte AI features: natural language conversations, Detection Triage Agent, Response Agent and LLM-Completion actions in Falcon Fusion SOAR. CrowdStrike states FedRAMP High authorization for the Falcon platform and links its FedRAMP Marketplace listing. source, source 2, source 3 · checked October 31, 2026
Not published by CrowdStrike as of October 31, 2026
- Whether customer prompts or Falcon data train CrowdStrike's models (public pages say Charlotte AI is trained on analyst decisions, product documentation and APIs)
- Retention period for Charlotte AI prompts and responses
- Region where Charlotte AI inference runs, outside the FedRAMP High environment
- Price per Charlotte AI credit
- The console path for turning Charlotte AI off (Falcon documentation requires a customer login)
- An official MCP server or an agent API. CrowdStrike's falcon-mcp README says it "is not an official CrowdStrike product", is "community-driven" and "actively maintained by CrowdStrike", and is a "Pre-1.0 release"
- A release stage for Charlotte AI's bi-directional MCP access
- An EU AI Act statement; CrowdStrike is not on the European Commission's AI Pact or GPAI Code of Practice signatory lists
Changes
No changes recorded since the first check on October 31, 2026.
How this page is made, and how to send a correction: method.