Does Falcon Guardian decide on AI agent actions before they run?

Matches. Checks and blocks Claude Code prompts and tool activity as they happen, and returns allow or block before a Copilot Studio agent runs a tool. Warn or ask: Not in our sources.

How does Falcon Guardian reach employee devices?

Through the Falcon sensor on supported Windows, macOS and Linux endpoints; Claude Code coverage is a JSON block in the Claude Code settings file with no agent to install, assigned through Falcon host groups.

PRODUCT NOTES · CROWDSTRIKE

CrowdStrike Falcon Guardian: AI endpoint control facts (2026)

Short answer

CrowdStrike Falcon Guardian, described on 1 September 2026 as the evolution of Falcon AIDR, discovers AI agents on endpoints running the Falcon sensor, checks and blocks Claude Code prompts and tool activity as they happen, returns allow or block before a Copilot Studio agent runs a tool, and records Claude Code events by session and user in Falcon Next-Gen SIEM. It needs Falcon for the device path, Claude Code is the only coding agent named, the AI gateway is listed as coming soon, and no price is published.

By The Device Desk · Endpoint AI Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

Vendor pages read September and October 2026 · updated 2026-10-13

Visit Falcon Guardian's site

Where do Falcon Guardian's controls sit?

DEV Filled marker: described on the product pages we read
DEV Hatched marker: partly described (another component, a narrower scope, or method not detailed)
DEV Dashed marker: not in our sources (it may exist; we did not find it)

The map shows where each product's own pages describe a control, or where your answers point. It is not a measure of how well a product works.

The four product control types, plus policy only.
Type	Status	What the pages say	Source
On-device control	Described	Discovers AI agents on supported endpoints and ties prompts, skills, tool calls, MCP servers and identity to what runs next; defines which agent types may run.	Source: CrowdStrike blog: Falcon Guardian, 1 September 2026 · Read 13 Oct 2026
Browser extension	Partly described	(secondary: SACR) delivered also through browser extensions.	Source: SACR (secondary): CISO guide to endpoint control and prevention, July 2026 · Read 13 Oct 2026 · secondary source
Network or SSE proxy	Not in our sources	Not described on the pages we read.	None
AI or MCP gateway	Partly described	The AI gateway is listed as coming soon; SACR (secondary) also lists an MCP proxy.	Source: CrowdStrike: Falcon Guardian (formerly AIDR) · Read 13 Oct 2026
Policy only	No product needed	Policy is your own work whichever product you choose.	None

How does Falcon Guardian decide on an AI action?

Falcon Guardian: decisions
Decides on a tool call before it runs	MatchesChecks and blocks Claude Code prompts and tool activity as they happen, and returns allow or block before a Copilot Studio agent runs a tool. Source: CrowdStrike blog: Copilot Studio agents and Claude Code, 30 July 2026 · Read 13 Oct 2026
Can warn or ask instead of only blocking	Not in our sources
Can block an agent, tool or action	MatchesAutomatic containment by blocking malicious agent behaviors. Source: CrowdStrike blog: Falcon Guardian, 1 September 2026 · Read 13 Oct 2026
Has a watch-only or simulation mode	Not in our sources

How does Falcon Guardian reach devices, and which AI tools does it name?

Falcon Guardian: rollout and named tools
How it reaches devices	Through the Falcon sensor on supported Windows, macOS and Linux endpoints; Claude Code coverage is a JSON block in the Claude Code settings file with no agent to install, assigned through Falcon host groups. Source: CrowdStrike blog: Copilot Studio agents and Claude Code, 30 July 2026 · Read 13 Oct 2026
Rolls out through EDR or device management you run	MatchesThrough the Falcon sensor, if you run CrowdStrike Falcon. Source: CrowdStrike blog: Falcon Guardian, 1 September 2026 · Read 13 Oct 2026
Names the coding agents it covers	PartlyNames Claude Code and Copilot Studio agents; Cursor, Codex and GitHub Copilot are not named on the pages we read. Source: CrowdStrike blog: Copilot Studio agents and Claude Code, 30 July 2026 · Read 13 Oct 2026
AI tools and surfaces named	AI agents on endpoints, prompts, skills, tool calls and MCP servers for supported agents, Claude Code and Copilot Studio agents. Source: CrowdStrike blog: Falcon Guardian, 1 September 2026 · Read 13 Oct 2026
Built into	Part of the CrowdStrike Falcon platform. Source: CrowdStrike: Falcon Guardian (formerly AIDR) · Read 13 Oct 2026
Works with	None in our sources

What else does Falcon Guardian cover?

Falcon Guardian: other coverage
Controls what goes into browser AI	Not in our sources
Records who or what took each action	MatchesClaude Code events tied to a session and user in Falcon Next-Gen SIEM. Source: CrowdStrike blog: Copilot Studio agents and Claude Code, 30 July 2026 · Read 13 Oct 2026
Also covers SaaS, cloud or homegrown AI	MatchesCovers agents from endpoint to cloud and SaaS, including Copilot Studio. Source: CrowdStrike: Falcon Guardian (formerly AIDR) · Read 13 Oct 2026

What does Falcon Guardian cost?

Not published

Not published. CrowdStrike's pricing page lists Falcon Go, Pro and Enterprise bundles, none of which include Falcon Guardian.

Source: CrowdStrike: pricing · Read 13 Oct 2026

Where is Falcon Guardian strong, and where are its limits?

Strengths and limits come from the product's own pages and our sources; a limit can be something we did not find.

Strengths

Decides on a Claude Code tool call inside the Falcon stack.
Reaches from the endpoint to cloud and SaaS agents.
Keeps a session and user record in Falcon Next-Gen SIEM.

Limits

Needs CrowdStrike Falcon for the device path.
Claude Code is the only coding agent named on the pages we read.
The AI gateway is listed as coming soon, and no price is published.

What does Falcon Guardian say about itself?

What has Falcon Guardian announced recently?

1 Sep 2026
Introduced Falcon Guardian as the evolution of Falcon AIDR; MDR for Guardian was announced for later in the quarter.
Source: CrowdStrike blog: Falcon Guardian, 1 September 2026 · Read 13 Oct 2026
30 Jul 2026
Described Claude Code and Copilot Studio agent coverage.
Source: CrowdStrike blog: Copilot Studio agents and Claude Code, 30 July 2026 · Read 13 Oct 2026

Who should shortlist Falcon Guardian?

Consider Falcon Guardian if you already run CrowdStrike Falcon and want AI agent controls in the same console, or if your agents include Copilot Studio as well as Claude Code.

In our example finder profiles, Falcon Guardian is not in the first group; your own answers may differ.

Run the finder with your answers