Commvault integrates its cyber recovery activities into CrowdStrike’s Charlotte Agentic SOAR workflows. Joint customers can thereby automate recovery actions, accelerate forensic investigations, and minimize the handoff between security and recovery teams.
Commvault and CrowdStrike are building on their existing partnership with this integration. The new connector incorporates cyber recovery activities directly into automated security processes, so organizations need fewer separate tools and manual steps during an incident.
Recovery in security workflows
The integration makes it possible to restrict access in Commvault when an incident occurs. This allows organizations to prevent unauthorized changes during the investigation. Charlotte Agentic SOAR orchestrates the actions within the security workflow and can automatically start Commvault recovery activities.
Additionally, customers can temporarily suspend policies for automatically cleaning up old backup data. As a result, usable recovery points remain available as long as the incident is ongoing. This is important when security teams first need to determine which systems or data have been affected before performing a recovery action.
Forensic investigation
Investigators can recover potentially compromised assets in Commvault Cleanroom. This environment is designed to allow analysis to begin immediately without disrupting production systems. According to Commvault, this accelerates both the forensic investigation and the incident response.
The connector represents the latest step in a series of integrations. Falcon Insight XDR brought threat intelligence from CrowdStrike to Commvault Cloud. Falcon Next-Gen SIEM added more visibility. Charlotte Agentic SOAR now links automated cyber recovery actions to this, allowing security and recovery teams to collaborate more closely.
Availability and outlook
The integration is generally available for joint Commvault and CrowdStrike customers. It is also available through the CrowdStrike Marketplace. Commvault positions the link as a way for organizations to respond faster to incidents and maintain recovery readiness during the investigation.
The approach relies on AI-driven automation to detect, investigate, and respond to threats at machine speed. However, the quality of the underlying recovery points remains decisive. Without usable and protected backups, an automated workflow cannot resolve the impact of an incident on its own.