CrowdStrike Agent Graph Shows How Agents Act on the Endpoint

Because all three views read from the same graph, an analyst can move from the fleet to an agent, to a session, to the exact step that caused the alert, without switching tools or rebuilding a timeline.

Agent Hooks Expand Enforcement Capabilities

For supported agents, Falcon Guardian agent hooks bring even more detail into Agent Graph.

Agent hooks plug into an agent’s native hooks system to capture activity at key points in a session: when a prompt is submitted, before a tool call runs, and after it completes. This adds more detailed nodes to the graph, such as exact prompt text, tool inputs, and tool outputs, alongside the sensor’s view of what ran.

Hooks can show what the agent was told and how the agent interpreted the ask. The Falcon sensor shows what happened on the machine. It can also see what the agent was asked to do, and what the LLM response was, via endpoint network inspection. Agent Graph combines those views to connect what agents are instructed to do, what they communicate, and what they execute.

Hooks are also a point of enforcement: Falcon Guardian can check a prompt or tool call against policy and stop a dangerous action before it executes. Agent hooks are available today for Claude Code, OpenAI Codex, GitHub Copilot, OpenCode, and Cursor.

Secure AI Agents Where They Execute

Only CrowdStrike brings together native endpoint visibility, endpoint network inspection, and agent-level controls to deliver that context, and the power to stop malicious behavior at runtime.

Agents work at machine speed, and so do their mistakes. CrowdStrike Agent Graph shows what they were asked and what they actually did, so security teams can stop them at runtime when they become a threat.

Agent Graph is the foundation underneath Falcon Guardian. It powers the agent inventory, which shows the AI agents running across your fleet and how far they reach; the session graph, which traces each session from prompt to impact; and the agent threat score, which tells teams where to look first. Agent hooks add more detail and a point of enforcement for supported agents, and it all runs on the Falcon sensor you already have. That’s how Falcon Guardian secures AI agents where they execute: on the endpoint, at runtime.