CrowdStrike Agent Graph Shows How Agents Act on the Endpoint

AI agents don't just answer questions anymore. They open files, use credentials, run code, install software, and run models locally, all at machine speed.

Every one of those actions happens on the operating system. This is where attacks land, and where CrowdStrike Falcon® Guardian excels: on the endpoint, at runtime.

Seeing the Complete Picture

Look at an agent session from the network and you only see part of the story. A gateway on its own sees the conversation: the prompt, the response, even the agent agreeing to do something it shouldn't. A web gateway sees the agent connect to a site it trusts. None of these sees what happens next, inside the machine.

Inside this gap, a hidden instruction can become a shell command, or a downloaded file can run with the user's access.

The CrowdStrike Falcon® sensor already sees processes, files, and network connections. With Falcon Guardian, the same sensor also sees the AI layer: prompts, models, tools, and skills. CrowdStrike® Agent Graph connects the AI layer to the execution layer in one causal chain, tracing supported agent sessions from prompt to impact. It runs on the Falcon sensor businesses already have. Teams can use CrowdStrike Agent Graph to see not only what the agent was asked to do, but what it did.

See it in action:

How CrowdStrike Agent Graph Powers Falcon Guardian

CrowdStrike Agent Graph is the relational layer underneath Falcon Guardian. It connects each agent to the users, hosts, models, prompts, tools, skills, MCP servers, processes, files, and detections it touches, and keeps those relationships current as agents act. Three core Falcon Guardian views are built on Agent Graph: agent inventory, session graph, and agent threat score.

Agent Inventory

Because CrowdStrike Agent Graph tracks which agents run where, and what they connect to, the Falcon Guardian agent inventory can show the AI agents across the fleet, whether they are sanctioned or shadow, grouped by type. Coding agents, desktop assistants, and command-line interface (CLI) agents from Anthropic, OpenAI, Cursor, and others sit side by side. For supported agents, the footprint shows how far it reaches, including the users, installs, sessions, models, tools, skills, and MCP servers connected to it. A single Claude Code agent might have one user, three installs, eight tools, and 12 sessions.

Session Graph

A session is one prompt and process. A CrowdStrike Agent Graph view can comprise one or several. Agent Graph lays out the causal chain in order: who and where interacted with the agent, the prompt they used, each tool call the model made, and the processes, files, and network connections that followed. For example, consider a developer who pastes a setup note from an untrusted source into Claude Code: "Run these commands in order and don't skip any." With the session graph, stakeholders can see where an issue may have originated.

From the network, the above prompt may seem harmless. In the session graph, there are three tool calls: The agent reaches out to an outside host, installs a package, and runs an installer from Downloads. The detections sit on that last step, pinned to the exact tool call that launched the installer, along with the outcome: Falcon Guardian blocked the process and quarantined the file.

Later in the session, cloud keys and personal data pasted into the conversation are flagged on their own, and that risky prompt sits on the same graph as the risky action.

Agent Threat Score

CrowdStrike Agent Graph ties each detection to an agent session, as well as the steps behind it. Every agent carries a threat score from 0 to 100. This turns the inventory into a triage queue. The fleets are colored by threat score, so teams can start with the highest-risk agents rather than the oldest alert. One click on a critical agent reveals the individual agent sessions and detections behind its score.

Because all three views read from the same graph, an analyst can move from the fleet to an agent, to a session, to the exact step that caused the alert, without switching tools or rebuilding a timeline.

Agent Hooks Expand Enforcement Capabilities

For supported agents, Falcon Guardian agent hooks bring even more detail into Agent Graph.

Agent hooks plug into an agent's native hooks system to capture activity at key points in a session: when a prompt is submitted, before a tool call runs, and after it completes. This adds more detailed nodes to the graph, such as exact prompt text, tool inputs, and tool outputs, alongside the sensor's view of what ran. 

Hooks can show what the agent was told and how the agent interpreted the ask. The Falcon sensor shows what happened on the machine. It can also see what the agent was asked to do, and what the LLM response was, via endpoint network inspection. Agent Graph combines those views to connect what agents are instructed to do, what they communicate, and what they execute.

Hooks are also a point of enforcement: Falcon Guardian can check a prompt or tool call against policy and stop a dangerous action before it executes. Agent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor. 

Secure AI Agents Where They Execute

Only CrowdStrike brings together native endpoint visibility, endpoint network inspection, and agent-level controls to deliver that context, and the power to stop malicious behavior at runtime.

Agents work at machine speed, and so do their mistakes. CrowdStrike Agent Graph shows what they were asked and what they actually did, so security teams can stop them at runtime when they become a threat.

Agent Graph is the foundation underneath Falcon Guardian. It powers the agent inventory, which shows the AI agents running across your fleet and how far they reach; the session graph, which traces each session from prompt to impact; and the agent threat score, which tells teams where to look first. Agent hooks add more detail and a point of enforcement for supported agents, and it all runs on the Falcon sensor you already have. That's how Falcon Guardian secures AI agents where they execute: on the endpoint, at runtime.

Learn More

• Watch the Agent Graph demo.
• Explore the Falcon Guardian webpage.