Falcon Fusion AI Skills
Build Falcon Fusion SOAR workflows from a natural language prompt. AI coding assistant skills that handle the full workflow lifecycle: discover actions, author and validate YAML, deploy to your CID, and trigger executions.
Supported tools
Section titled “Supported tools”| Tool | Install |
|---|---|
| Claude Code | /plugin install crowdstrike-falcon-fusion |
| Codex | codex plugin add crowdstrike-falcon-fusion@openai-api-curated |
| Copilot CLI | copilot plugin install CrowdStrike/fusion-skills |
| Cursor | /plugins (CLI) or /add-plugin crowdstrike-falcon-fusion (IDE) |
| Antigravity CLI | agy plugin install https://github.com/CrowdStrike/fusion-skills |
In a live-tenant run, all five assistants authored a valid workflow from the example prompt below and imported it to the tenant.
You need a CrowdStrike API client with the Workflow scope (plus NGSIEM Lookup Files for the lookup-files skill). Run /crowdstrike-falcon-fusion:setup to configure credentials.
Example prompt
Section titled “Example prompt”This prompt exercises the full lifecycle: action discovery, event queries, parallel HTTP Action enrichment, an LLM completion action, and validation:
Generate a Falcon Fusion workflow that will trigger from a Falcon Next-Gen SIEM detection. The workflow should hydrate the detection using an event query to get the full details of the detection. If a user, host, domain, url, file indicator, or ip indicator is found, enrich each in parallel using HTTP calls to VirusTotal or DomainTools. Summarize the enrichment across all the threat intelligence providers using an LLM completion action and then send an email formatted in HTML.
Watch the full build from prompt to deployed workflow:
Create and deploy a Falcon Fusion workflow using AI coding assistant skills from your terminal.
What happens
Section titled “What happens”The skills:
- Discover available actions via the Falcon Fusion API
- Author workflow YAML with correct schema and variable references
- Validate the workflow against the Charlotte JSON schema
- Deploy and release the workflow to your CID
- Configure authentication for HTTP actions
- Publish and test the workflow
Skills included
Section titled “Skills included”| Skill | Purpose |
|---|---|
| workflows | Orchestrates the full workflow lifecycle |
| authoring | Discover actions, author and validate YAML |
| deployment | Import, release, and manage workflow definitions |
| execution | Trigger workflows, monitor status, debug failures |
| lookup-files | Manage Falcon Next-Gen SIEM lookup files for CQL match() queries |
| foundry-redirect | Points Falcon Foundry app requests to the Falcon Foundry AI Skills plugin |
- Anthropic Plugin Marketplace:
/plugin install crowdstrike-falcon-fusion - Blog: Build Falcon Fusion Workflows with Claude Code
- GitHub: fusion-skills