CrowdStrike announced general availability of coordinated multi-agent investigations on November 4. The system uses agents working across endpoint, identity, SaaS, cloud and network evidence, with shared context and visible reasoning supporting a combined assessment.
Investigations share cross-domain context
The available workflow includes a governed automation workspace and customer-selected autonomy levels. Sensitive tool calls can pause for an Action Request so an analyst can approve, reject or inspect the trace. Analysts can also interrupt a running Charlotte AI or AgentWorks agent.
Approval controls govern sensitive tools
The same release introduces Agent Insider Threat Detection, but lists it for Q4 availability. Expanded agent and workflow approvals are also scheduled for Q4, while policy-drift guardrails are listed for fiscal 2028’s first quarter. Those roadmap items have different availability from the investigation capability.
New detection features have later dates
Coordinated analysis could reduce the work of assembling evidence across security domains. Its value depends on accurate conclusions and useful escalation. Organisations can assess false positives, missed incidents, analyst review time and the consequences of automated actions using representative cases.
Image: CrowdStrike / source announcement. Used for source-attributed editorial reporting; rights remain with the owner.
Sources & evidence
Sources describe the announcements and evidence available when this analysis was published. Company claims are attributed; plans and trials are not treated as sustained operation.
