Fusion SOAR

Falcon Fusion SOAR provides workflow automation for security orchestration, automation, and response (SOAR). Create workflows that trigger on security events, run on schedules, or execute on demand to automate investigation, enrichment, and response actions.

Getting started

Fusion SOAR workflows can be built in two ways:

Directly in the Falcon console — Use the visual workflow builder at Fusion SOAR > Workflows to create workflows with drag-and-drop actions, conditions, and loops.
Through Falcon Foundry — Build reusable workflow templates as part of a Foundry app, with API integrations, functions, and custom SOAR actions. See the Foundry Workflow Templates documentation.

Key capabilities

Capability	Description
Triggers	Start workflows on demand, on a schedule, or in response to platform events (detections, incidents).
Actions	Call CrowdStrike APIs, execute Foundry functions, run event queries, send notifications, write to LogScale.
HTTP Actions	Call external REST APIs directly from workflows without building a full Foundry integration. Supports Cloud, CrowdStrike, and On-Premises modes.
Conditions	Branch workflow logic based on data values using CEL expressions.
Loops	Iterate over lists of data (sensor IDs, query results, etc.) with concurrent or sequential execution.

Developer resources

For developers building Fusion SOAR integrations and automation:

Foundry Workflow Templates — Build workflow templates in Foundry apps
Workflow Debugging & Testing — Debug and test workflow execution
Foundry Functions — Write serverless functions callable from workflows
API Integrations — Connect external APIs as SOAR actions
HTTP Actions — Call REST APIs directly from workflows

Limits

Limit	Default Value
Max size of Action results	10 MB
Max data per Fusion ingestion action into Next-Gen SIEM	950 KB
Max Fusion execution log retention	90 days
Max Loop iterations within a workflow	100,000
Max rows per search result from Next-Gen SIEM integration	10,000
Minimum granularity for scheduled workflows	1 hour