Why does this skill require running action_search.py?

CrowdStrike requires specific 32-character hex IDs for actions. This script fetches live IDs from your specific environment to ensure the workflow is valid and deployable.

What is a CrowdStrike Fusion Workflow?

It is an automation playbook within the CrowdStrike Falcon platform used to orchestrate security actions and responses across internal capabilities and third-party tools.

Can I use this for third-party integrations like Okta or Microsoft?

Yes, it supports plugin actions for external vendors, though you will need to provide the specific config_id from your Falcon console to complete the YAML.

How does workflow validation work?

The skill utilizes a validation script to perform pre-flight syntax checks and an API dry-run to ensure all action IDs, data references, and logic structures are correct before importing.

CrowdStrike Fusion Workflow Builder

Name: CrowdStrike Fusion Workflow Builder
Author: eth0izzle

byeth0izzle

•

Security & Testing

Automates the end-to-end lifecycle of CrowdStrike Falcon Fusion SOAR workflows, from real-time action discovery to production-ready YAML deployment.

This skill provides a comprehensive framework for security operations teams to build and manage CrowdStrike Falcon Fusion SOAR workflows directly within Claude. It streamlines the development process by mandating real-time API lookups for 32-character hex action IDs, ensuring schema validation, and providing structural templates for complex automation patterns like loops and conditional branching. By integrating directly with the CrowdStrike API and enforcing strict pre-flight checks, it eliminates placeholder errors and accelerates the deployment of robust security orchestration and response playbooks.

Key Features

01Mandatory schema validation and pre-flight error checking for workflow YAML

02Real-time CrowdStrike action and trigger discovery via live API search

0331 GitHub stars

04Guided configuration for third-party plugin integrations and CID-specific settings

05Automated workflow importing with built-in duplicate detection and naming checks

06Support for complex SOAR logic including loops, variables, and conditional branches

Use Cases

01Automating endpoint containment and rapid incident response tasks across a fleet

02Standardizing security playbooks by converting manual SOC processes into validated SOAR workflows

03Orchestrating multi-vendor security actions using Falcon Fusion integration plugins

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add eth0izzle/security-skills fusion-workflows

For use in Claude.ai and ChatGPT

Download Skill