Prompt best practices for conversations, promptbooks, and Fusion LLM Completion actions, drawn from the CrowdStrike Knowledge Base.
Charlotte AI returns what the prompt asks for, not what the author meant. Two prompts on the same subject can produce different data, different formats, and different credit costs. This post sets out the rules CrowdStrike documents for writing prompts, the patterns that follow from them, and the practices that apply when prompts run inside Fusion workflows.
It applies to three places: chatting in Charlotte AI > Conversations, building promptbooks, and writing prompts inside Fusion LLM Completion actions.
Executive Summary
Purpose
Give Falcon administrators and SOC analysts a single reference for writing Charlotte AI prompts that return usable results and predictable credit spend.
Overview
Prompt quality comes down to four things: clear English, Falcon console terminology, specific entities, and explicit sort and limit instructions. In Fusion workflows, two more apply: pass the data in explicitly, and control how often the action runs.
Key outcomes
- Wording determines which data points a response emphasizes.
- Sorting and “top N” language make large result sets manageable.
- Show response details exposes the raw data and credit usage behind an answer.
- Every Fusion LLM Completion call consumes a credit, so conditions matter.
Foundation Rules
1. Use clear, concise English
“Supported languages for conversations: English”
Charlotte AI > Understand Charlotte > Charlotte AI Requirements
CrowdStrike advises clear, concise English. Short, direct sentences work better than long paragraphs. State what you want, what data scope matters, and how results should be presented.
2. Recognize that wording changes the data you get back
“The way you word your prompt can affect the results you see.”
Charlotte AI > Charlotte AI Conversations > Start a prompt from the Conversations page
CrowdStrike’s own example compares two prompts about critical vulnerabilities. The first returns a more general summary. The second focuses on host information.
Vague
What is my exposure to critical vulnerabilities?
General vulnerability summary
Actionable
Which hosts are affected by critical vulnerabilities? Sort by hostname.
Host-centric table that can be acted on
3. Match Falcon console terminology
“terminology that’s consistent with what is used in the Falcon console”
Charlotte AI > Charlotte AI Conversations > Troubleshoot prompts
When a prompt fails to return what you expect, check that your terms match the console and be as specific as possible. Naming the entity type helps.
Too vague
When was 192.168.100.1 last seen?
Recommended
When was the host with the IP address of 192.168.100.1 last seen?
4. Apply human judgment
CrowdStrike notes that generative AI lacks common sense and critical thinking, and that human judgment should be applied. Charlotte accelerates investigation. It does not replace analyst decisions, particularly for containment and credential resets.
5. Expect roles to limit responses
“depends on the roles assigned to your Falcon console user account”
Charlotte AI > Charlotte AI Conversations > Responses to prompts and promptbooks
A user without access to detections cannot retrieve adversary information through Charlotte. When a question depends on data the user cannot access, Charlotte returns an informative error message.
Sorting and Limiting Results
Some responses contain hundreds or thousands of results. Prompts can include language to sort or limit what comes back.
“As a best practice, sort and specify a top number of results.”
Charlotte AI > Charlotte AI Conversations > Sort and limit results
Sort
Append the sort criteria to the end of the prompt, for example: Show me hosts that haven't been seen in 30 days. Sort by local IP address.
Limit
Word the prompt to ask for top results, for example: What are the top 5 hosts with medium severity detections? The word “limit” also works, as in “Limit 10 hosts,” but the results that appear are arbitrary.
| GOAL | EXAMPLE PROMPT |
|---|---|
| Critical detections by recency | Which hosts have critical severity detections? Sort by last seen. |
| Stale hosts | Show me hosts that haven't been seen in 30 days. Sort by local IP address. |
| Noisiest hosts | What are the top 5 hosts with medium severity detections? |
| Vulnerability exposure by host | What is my exposure to critical vulnerabilities? Sort by hostname. |
Troubleshooting a Prompt That Fails
- Use Falcon-consistent terms: detections, hosts, cases.
- Be specific. Include the entity type, whether host, user, IP, detection ID, or CVE.
- Turn on Show response details to view the raw data and credit usage behind the response.
- Check your role, since you may lack access to the underlying data.
- Rephrase more narrowly, and continue in the same conversation for follow-up questions.
Investigation Prompt Patterns
CrowdStrike documents example prompts under Charlotte AI > Understand Charlotte > Example prompts and promptbooks. They can be adapted for conversations or used as promptbook steps.
| INVESTIGATION TASK | EXAMPLE PROMPT |
|---|---|
| Vulnerability exposure | What is my exposure to vulnerabilities used by adversaries that target the technology industry? |
| Adversary hunt | Can you search my environment for signs of Cozy Bear? |
| Malware family intelligence | Describe STEELHOOK and find indicators I should look for. |
| Attack paths | Show me attack paths leading to critical hosts |
| Attack paths by CVE | Show me attack paths leveraging CVE-2015-2590 |
| Command line analysis | Analyze the command for detection with ID 12345 |
| Hunting queries | Can you make a LogScale query that shows IPv4 connections to 198.51.100.10? |
| Obfuscated PowerShell | Generate a query for base64-encoded PowerShell executions. Provide a table with ComputerName, CommandLine, and the decoded command. |
| Falcon for IT | Write an osquery to show open sockets |
Credits
Each prompt carries a default budget of one credit, and the actual charge is often lower. CrowdStrike gives the example of an answer that is easily drawn from documentation costing 0.31 credits.
“Charlotte AI never charges you more credits for an answer than you budgeted.”
Charlotte AI > Understand Charlotte > Credits budgeted versus credits consumed
| CONSIDERATION | DETAIL |
|---|---|
| Default budget | 1 credit per invocation, including chat |
| Fractional billing | Easily answered questions may cost less than the budget |
| Incomplete answers | Complex requests, such as a LogScale query, can return a partial answer if the budget runs out |
| Verification | Show response details reports credits used against credits allotted |
| No-cost activity | Detection triage and viewing an agentic response do not consume credits |
| Agentic investigation | Credits are consumed when an investigation is requested, with the budget chosen per round |
| Falcon for IT | 25 queries a month with Charlotte AI, even without a Charlotte AI subscription (not available in US-GOV-1 and US-GOV-2) |
Prompts Inside Fusion Workflows
Charlotte AI “can only analyse data that is explicitly shared with it” in the workflow.
Fusion SOAR > Use Charlotte AI actions > LLM Completion
Three practices follow from that, and from the credit model above:
- Pass trigger fields into the prompt explicitly, for example the detection command line or the triage verdict JSON.
- Use a JSON schema on LLM Completion when the next step needs structured fields. Schema and stop sequence are mutually exclusive.
- Gate LLM calls behind conditions. Each call consumes a credit, so an unconditioned action running against 1,000 detections spends 1,000 credits.
Pre-Send Checklist
□ Falcon terminology: host, detection, case, CVE, adversary name
□ Entity type specified, for example “the host with the IP address of X” instead of the IP alone
□ Sort criteria appended
□ Top N used instead of an arbitrary limit
□ Follow-up questions asked in the same conversation
□ Show response details turned on for a credit audit
□ Analyst judgment applied before any destructive response action
Let’s Talk!
Consortium’s CrowdStrike Center of Excellence helps clients get more from the Falcon platform through health assessments, optimization, Next-Gen SIEM services, and staff augmentation. If your team is rolling out Charlotte AI or building promptbooks and Fusion workflows, contact your Consortium account team to engage, or email us at crwd-coe@consortium.net. Validate prompts, promptbooks, and workflows in a test environment before production use.
Sources
CrowdStrike Knowledge Base. Charlotte AI > Charlotte AI Conversations > Start a prompt from the Conversations page.
CrowdStrike Knowledge Base. Charlotte AI > Charlotte AI Conversations > Troubleshoot prompts.
CrowdStrike Knowledge Base. Charlotte AI > Charlotte AI Conversations > Sort and limit results.
CrowdStrike Knowledge Base. Charlotte AI > Charlotte AI Conversations > Responses to prompts and promptbooks.
CrowdStrike Knowledge Base. Charlotte AI > Charlotte AI Conversations > See all response details.
CrowdStrike Knowledge Base. Charlotte AI > Understand Charlotte > Charlotte AI Requirements.
CrowdStrike Knowledge Base. Charlotte AI > Understand Charlotte > Example prompts and promptbooks.
CrowdStrike Knowledge Base. Charlotte AI > Understand Charlotte > Credits budgeted versus credits consumed.
CrowdStrike Knowledge Base. Fusion SOAR > Use Charlotte AI actions > LLM Completion.
CrowdStrike Knowledge Base. AI Generated Query > Create a new query with Charlotte AI.
About Consortium
Consortium is a cybersecurity specialist firm combining strategic advisory, vendor-agnostic procurement, and concierge-level support into a single, client-centric model. Consortium unifies holistic security strategy, proactive risk management, and simplified vendor oversight to deliver measurable business outcomes for enterprise organizations. Leveraging its proprietary Metrics that Matter® (MTM®) platform, Consortium translates technical security data into business-ready insights—empowering executives and boards to make informed, financially grounded decisions while continuously improving security posture. Consortium’s Artificial Intelligence Risk Navigator (AIRN) extends that capability into AI security, providing organizations with an architecture-aware framework to assess GenAI risk, navigate NIST, OWASP, and MITRE guidance, and identify the right vendor mix—maximizing existing platform investments before recommending new ones. Together, these capabilities reset the standard for how organizations protect and enable their business. For more information, visit consortium.net.
