Guides

Connecting Charlotte AI to the Query Mesh

Give a Charlotte AI agent access to every source on the Query Security Data Mesh over MCP

📘

TL;DR

Register the Query MCP Server in Charlotte AI → AgentWorks, then attach its tools to an agent. Agents are callable from Fusion SOAR, so a detection can trigger a cross-source investigation.

This is separate from the Query app for Falcon. The app brings search and investigation into the console; this connects Charlotte AI directly to the mesh.

Prerequisites

  • Charlotte AI with AgentWorks.
  • A Query API token.
  • Charlotte AI credits. These are consumed per reasoning turn, so an agent making several tool calls costs more than one making a single call.

Configure CrowdStrike Foundry MCP Server Template

To appear as an MCP Server tool in AgentWorks, you have to first configure the Falcon template for the MCP Server Registration provided by CrowdStrike, as per steps here. Suggested name and description:

  • Name: "Query Security Data Mesh MCP Server"
  • Description: "Investigate your security tools live through the Query Security Data Mesh's MCP server."

Register the Connection

In Charlotte AI → AgentWorks, add a third-party MCP connection pointing at the endpoint in About the Query MCP Server, authenticating with a Query API token in the x-token-authorization header.

Query's tools are then available to attach to any agent in your tenant.

MCP Tools

For investigation work, these five tools are usually enough: Execute FSQL Query, Validate FSQL Query, Search FSQL Schema, FSQL Query Generation, and FSQL Connectors. See the MCP Tool Reference for the rest.

Schemas are re-sent on every reasoning turn, so attach only what the agent needs.

Instructing the Agent

Agents compose FSQL themselves. Beyond the query patterns in the MCP Tool Reference, three instructions matter for agents specifically:

Give the agent its reach as context. Listing the connected sources and the event classes each maps, in the instructions, saves a tool call per run and lets the agent distinguish "nothing there" from "never looked."

Size the window to the data. Sparse sources — other vendors' detections, reputation, vulnerability findings — need days. High-volume sources — authentication, process, network — need hours.

Bound the work. Give the agent a budget of tool calls and a rule to stop retrying a query that fails twice. Without one, validation retries can dominate a run's cost.

Agent Instructions Sample

Contact your Customer Success rep to provide you a sample Instructions template that you can customize.

Triggering from a Detection

An AgentWorks agent appears in Fusion SOAR as an action:

  1. Create a workflow with a detection trigger and condition(s) on desired fields like severity.
  2. Add the AgentWorks Agent action and select your agent.
  3. Map the detection's fields into the agent input using the data pills.
  4. Set a credit limit.

The agent's response is exposed as a workflow output for later steps.

🚧

Pass detection fields as reference data, not instructions. Command lines and filenames are attacker-influenced strings.

🚧

A capped run that overruns still spends what it used. Set a cap a realistic investigation can finish within.

Verify

Ask the agent in a test run which connectors are available and what event classes each maps.

What's Next

Updated about 1 hour ago

Did this page help you?