The true innovation in Crowdstrike's agent security platform is that the top two levels of Enterprise Graph “act as an abstraction layer that hides all this complexity from both human and agent AI users,” Zaitsev said. “The semantic data model is essentially one common language, all these different security domains, all these different vendors, the Rosetta stones that can be used to abstract the differences in their own schemas, and we do it in essentially simple English.”
The example shows how this innovation works. “One vendor, like CrowdStrike, might call something IPv4 in a log event, and another vendor might call IP four underscores,” says Zaitsev. “As a human, I know intuitively whether there is a background in cybersecurity. They're talking about IP address version 4.”
But “protocol machines usually don't work that way, but mapping needs to be done. So, not only did they do the mapping without disturbing the underlying data, but they also use concepts that the agent system understands from the box without specialized training or tweaking,” he said.
