CrowdStrike Falcon Fusion
Writes and validates Falcon Fusion workflow YAML using action IDs resolved from the live tenant.
Install
OfficialShips scriptsClaude Code: /plugin marketplace add anthropics/claude-plugins-official → /plugin install crowdstrike-falcon-fusion@claude-plugins-official
Falcon Fusion iş akışı yazarken, doğrularken ya da tenant'a dağıtıp çalıştırmasını izlerken
- Author
- CrowdStrike
- License
- MIT
Seven skills split the lifecycle: action discovery and authoring, schema validation, import and release, execution monitoring, and Next-Gen SIEM lookup files. The rule the authoring skill enforces hardest is that every action ID must be a real 32-character hex value resolved from the tenant before any YAML is written — a placeholder either fails on import or silently wires the wrong response action into a live playbook. It also settles a choice people get wrong: pulling a population of alerts the workflow does not already hold belongs in an HTTP request to the platform API, not in an event query, whose SIEM data is connector-dependent and returns nothing on many tenants. Python helpers do the searching and validation so IDs are looked up, never guessed.
Similar skills
CrowdStrike Falcon Foundry Skills
SkillBuilds and deploys Falcon Foundry apps through the Foundry CLI.
GitHub Actions Hardening
SkillReviews workflow YAML for the ways CI specifically gets compromised.
Pydantic AI Skills
SkillCurrent Pydantic AI patterns for tools, structured output, streaming and multi-agent code.
Comments(0)
Sign in to comment