Artificial intelligence is taking center stage in the evolution of cybersecurity, as CrowdStrike Inc. revealed new innovations designed to unify, automate and streamline end-to-end protection. These AI in cybersecurity enhancements span multiple Falcon platform modules, aiming to boost the efficiency of security analysts and strengthen defenses across the board.
CrowdStrike’s Elia Zaitsev talks with theCUBE about AI in cybersecurity.
“One of the things we like to focus on is the overall analyst workflow, the end-to-end experience,” said Elia Zaitsev (pictured), chief technology officer of CrowdStrike. “We’re looking at how we could accelerate every stage of the analyst’s lifecycle to clear all that work through and really pay big dividends into how efficiently our users can operate. It’s everything from how we use artificial intelligence to make it easier to get data into the platform, to how we make sense of the data once we have it and turn it into actionable detections and incidents.”
Zaitsev spoke with theCUBE Research’s Dave Vellante and Rebecca Knight at Fal.Con, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how the latest announcements from CrowdStrike addressed critical needs in the security world. (* Disclosure below.)
Integration of AI in cybersecurity takes center stage
One of the ways that CrowdStrike aims to accelerate the work of security analysts is through the integration of AI into a number of its offerings. One new feature for its Falcon Next-Gen SIEM, security information and event management, involves AI-generated parsers to simplify the collection and processing of data.
“You can give the AI documentation to learn about the source format and build it for you,” Zaitsev said. “As it creates the parser, it checks it against your test data. If it sees a mistake and error, it’ll try to fix it and keep going until it gets something that works. And then when you’re all done, it can explain and answer questions about what it did. If everything looks good, you load it right into Next-Gen SIEM and you just start sucking all that information in.”
CrowdStrike’s adoption of generative AI has extended to Project Kestrel, a new tool for unifying data and removing silos from across the Falcon platform. With Project Kestrel, CrowdStrike is seeking to eliminate complexity through accelerated collaboration to enable rapid threat response.
“Some of the other improvements we’ve announced this week, like Project Kestrel, lets us bring all the data visually to the analyst in one place,” Zaitsev said. “It works because we’re semantically modeling all these different data sets on our platform, but also external data that’s coming in. It doesn’t matter what it’s called from all these different systems, intuitively it understands that you’re talking about an IP address.”
The security firm also added new features as part of the Charlotte AI offering introduced at Fal.Con last year. Billed by CrowdStrike as the “Generative AI Security Analyst,” Charlotte has been enhanced with detection triage capability to rapidly discern between true and false positives and report assessments.
“The system tells you, ‘This is most likely a true positive, here’s the summarization of all the key points of what’s going on,’” Zaitsev explained. “It will actually generate a response script for you and say, ‘Hey, these are the things we saw, here’s the actions to take, and would you like me to take it, yes or no?’ Boom, hit go.”
Here’s the complete video interview, part of SiliconANGLE’s and theCUBE Research’s coverage of Fal.Con:
(* Disclosure: CrowdStrike Inc. sponsored this segment of theCUBE.)