CrowdStrike Expands Managed Hunts to AI Agents and Google Cloud

CrowdStrike has added managed OverWatch hunting for AI applications and agents monitored by Falcon Guardian and deeper Google Cloud telemetry. CrowdStrike illustrates a hypothetical path from a phished identity through AI tools to an endpoint. Use your own logs to decide whether an intrusion occurred. Falcon Complete for Falcon Guardian is a separate managed-response service for monitored AI coding assistants and agents.

Inventory the Guardian-monitored AI apps and agents and the Google Cloud projects your OverWatch service covers. Ask the hunting team which logs it receives and who handles agent-to-endpoint escalation. In Google Cloud Logs Explorer, use protoPayload.serviceName="iam.googleapis.com" to inspect service-account key creation and IAM changes against approved owners; review the principal, resource, method and timestamp. Google writes Admin Activity logs for configuration changes, while Data Access logs for most services require explicit enablement and appropriate reader permissions. Make an approved IAM policy change in a test project and confirm its Admin Activity event and the projects covered by your hunters. If you find an unauthorized service-account key, revoke it and rotate affected credentials through incident response.