CrowdStrike has extended Falcon Adversary OverWatch managed threat hunting to AI applications and autonomous agents monitored by Falcon Guardian, and to Google Cloud. Teams using those environments now have a specific coverage question: which agents and cloud projects are sending the activity their hunters need? The new hunting areas address abuse of trusted AI access and cloud service accounts, where a suspicious operation can look like ordinary administration.
CrowdStrike’s own service announcement illustrates a hypothetical path from a phished identity-provider session through an MFA device registration and Claude activity to an endpoint backdoor. Use activity in your own identity, agent, and endpoint logs to decide whether your organization has an intrusion.
AI agents join managed hunts
OverWatch Cross-Domain now includes continuous proactive hunting for AI application and agent activity monitored by Falcon Guardian. CrowdStrike says its hunters combine Guardian runtime context with Falcon platform telemetry and adversary intelligence to connect suspicious AI activity with identity, SaaS, cloud, and endpoint events. An agent with access to connected applications and local files can carry a compromised identity into more places than a browser session alone; what an agent did and what ran on the endpoint belong in the same investigation.
CrowdStrike also describes a separate response service. Falcon Complete for Falcon Guardian extends managed detection and response to monitored AI coding assistants and agents; its analysts investigate malicious prompts and agent behavior and use Agent Graph to connect agent activity with downstream endpoint execution. Confirm which hunting and response services your contract and deployed modules provide before assigning a response playbook to the vendor.
Google Cloud hunting needs usable logs
For Google Cloud, CrowdStrike says OverWatch hunts underlying cloud telemetry, “rather than relying solely on product-generated detections,” including indications of service-account misuse, privilege escalation, and lateral movement. The company says this brings its managed hunting approach across AWS, Azure, and Google Cloud. Verify the projects and log streams actually monitored in your tenant.
Google Cloud’s audit-log overview puts a useful boundary around that promise. Admin Activity logs record configuration changes such as IAM permission updates and are always written. Data Access logs record resource reads and other access, but are disabled by default for most services other than BigQuery; enable the relevant services where the investigation needs them, accounting for log volume and cost. A reader with roles/logging.viewer sees Admin Activity but needs roles/logging.privateLogViewer to read Data Access logs in the _Default bucket.
Google’s IAM audit-logging reference lists google.iam.admin.v1.CreateServiceAccountKey as an Admin Activity method and gives protoPayload.serviceName="iam.googleapis.com" as an IAM filter for Logs Explorer. Review key creation and IAM policy changes against approved service-account owners and changes. A new key for an unrecognized workflow warrants credential containment and investigation; compare the event with approved service-account activity before escalating it as compromise.
Match coverage to real projects
Inventory the Guardian-monitored agents and AI apps alongside the Google Cloud projects in the managed-hunting scope. Ask the OverWatch team which Google Cloud audit streams it ingests and who handles an agent-to-endpoint escalation under your subscription. In Logs Explorer, filter for protoPayload.serviceName="iam.googleapis.com" and inspect protoPayload.methodName, principal, resource, and timestamp for the projects in scope. Enable needed Data Access categories on the services you investigate, then confirm your hunters can read the retained events.
For a safe verification, make an approved IAM policy change in a test project and confirm its Admin Activity event appears in Logs Explorer with the expected principal, resource, and method; have the hunting team confirm that the same project is in its coverage. Revoke an unauthorized service-account key and rotate affected credentials under your incident process when a review finds one. Keep the Guardian inventory and cloud project list current as new agents and projects join: a hunter can connect their events only after those systems are visible.