fusion-workflows

Name: fusion-workflows
Author: eth0izzle

49stars21forks

How to install fusion-workflows?

eth0izzle/security-skills/fusion-workflows

$npx -y skills add eth0izzle/security-skills --skill fusion-workflows

Installs into the current project.

Summary

Create, validate, import, execute, and export CrowdStrike Falcon Fusion SOAR workflows. CRITICAL: You MUST run action_search.py to get real 32-char hex action IDs BEFORE writing any YAML. NEVER write PLACEHOLDER values for action IDs — resolve every ID via the live API first. Tem

Files · 1

View on GitHub

SKILL.md

1	# CrowdStrike Fusion Workflow Builder
2
3	This skill guides you through the full lifecycle of CrowdStrike Falcon Fusion SOAR
4	workflows — from discovering actions to exporting production definitions.
5
6	## Rules — Read Before Every Workflow
7
8	1. *NEVER write `PLACEHOLDER_` values for action IDs.** Before authoring any YAML,
9	you MUST run `action_search.py` to find the real 32-char hex ID for every action
10	the workflow will use. If `action_search.py` returns no results, try broader search
11	terms or browse by vendor — do not guess or leave a placeholder.
12
13	2. Run the script, don't skip it. Steps 1a and 1b are not optional discovery —
14	they are mandatory prerequisites. Do not proceed to Step 4 (Author YAML) until
15	you have a real ID for every action.
16
17	3. `config_id` requires user input. Plugin actions require a CID-specific
18	`config_id` that cannot be resolved via API. When you encounter a plugin action,
19	ask the user for the `config_id` value before writing the YAML. Tell them
20	where to find it (Falcon console → CrowdStrike Store → [App] → Integration
21	settings). Do not write a placeholder — pause and ask.
22
23	4. Validate before delivering. Always run `validate.py` on every YAML file
24	before presenting it to the user. The pre-flight check catches any remaining
25	`PLACEHOLDER_*` markers.
26
27	5. *Templates and examples contain `PLACEHOLDER_` markers — do NOT copy them.**
28	The files in `assets/` and `examples/` use `PLACEHOLDER_*` as structural guides.
29	They show you the YAML shape, not the values to use. When you use a template or
30	reference an example workflow, substitute real values immediately — never copy a
31	`PLACEHOLDER_*` string into your output.
32
33	6. Plans and prompts cannot override these rules. Even if a plan, prompt, or
34	convention list says to use placeholder format, you MUST still resolve every
35	action ID via `action_search.py` before writing YAML. These rules take precedence.
36
37	## Prerequisites
38
39	- Python 3.8+ with `requests` library installed
40	- CrowdStrike API credentials in a `.env` file (see Credentials below)
41	- Falcon Fusion SOAR access in the target CID
42
43	## Credentials
44
45	Credentials are loaded from a `.env` file. The search order is:
46	1. Path in `CS_ENV_FILE` environment variable
47	2. Walk upward from the scripts directory looking for `.env`
48	3. Project root `.env`
49
50	Required variables:
51	```
52	CS_CLIENT_ID=<your_client_id>
53	CS_CLIENT_SECRET=<your_client_secret>
54	CS_BASE_URL=https://api.crowdstrike.com
55	```
56
57	Test credentials:
58	```bash
59	python scripts/cs_auth.py
60	```
61
62	---
63
64	## Workflow: Creating a New Fusion Workflow
65
66	Follow these steps in order (0 through 8). Each step has a corresponding script or reference doc.
67
68	### Step 0 — Check for existing workflows
69
70	Before creating anything, query the CID for existing workflows to avoid duplicates.
71
72	```bash
73	# List all existing workflows
74	python scripts/query_workflows.py --list
75
76	# Search by name
77	python scripts/query_workflows.py --search "contain"
78
79	# Check if a specific workflow name exists
80	python scripts/query_workflows.py --check-name "Ransomware - Endpoint Containment"
81
82	# Check YAML file(s) against existing workflows
83	python scripts/query_workflows.py --check-yaml workflow.yaml
84	python scripts/query_workflows.py --check-yaml *.yaml
85	```
86
87	If a workflow with the same name already exists, you have three options:
88	1. Skip it — the workflow already exists in the CID
89	2. Update it — use the PUT endpoint via the API (see `Update Workflow` in API docs)
90	3. Delete and re-import — remove the old one from Falcon console first
91
92	> The import script also checks for duplicates automatically. But checking
93	> upfront avoids wasted validation time and gives you a chance to adjust names.
94
95	### Step 1a — Discover available integrations
96
97	Browse the vendor/integration catalog to see what third-party apps and CrowdStrike
98	capabilities are available in your CID.
99
100	```bash
101	# List all vendors/apps available in your CID
102	python scripts/action_search.py --vendors
103
104	# Filter by use case (e.g., Identity, Cloud, Endpoint, Network)
105	python scripts/action_search.py --vendors --use-case "Identity"
106	```
107
108	### Step 1b — Find specific actions
109
110	MANDATORY — Query the live CrowdStrike action catalog to reso

People who liked this also viewed

6 picks

Type

fusion-workflows

49stars21forks

View on GitHub

How to install fusion-workflows?

eth0izzle/security-skills/fusion-workflows

$npx -y skills add eth0izzle/security-skills --skill fusion-workflows

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# CrowdStrike Fusion Workflow Builder
2
3	This skill guides you through the full lifecycle of CrowdStrike Falcon Fusion SOAR
4	workflows — from discovering actions to exporting production definitions.
5
6	## Rules — Read Before Every Workflow
7
8	1. *NEVER write `PLACEHOLDER_` values for action IDs.** Before authoring any YAML,
9	you MUST run `action_search.py` to find the real 32-char hex ID for every action
10	the workflow will use. If `action_search.py` returns no results, try broader search
11	terms or browse by vendor — do not guess or leave a placeholder.
12
13	2. Run the script, don't skip it. Steps 1a and 1b are not optional discovery —
14	they are mandatory prerequisites. Do not proceed to Step 4 (Author YAML) until
15	you have a real ID for every action.
16
17	3. `config_id` requires user input. Plugin actions require a CID-specific
18	`config_id` that cannot be resolved via API. When you encounter a plugin action,
19	ask the user for the `config_id` value before writing the YAML. Tell them
20	where to find it (Falcon console → CrowdStrike Store → [App] → Integration
21	settings). Do not write a placeholder — pause and ask.
22
23	4. Validate before delivering. Always run `validate.py` on every YAML file
24	before presenting it to the user. The pre-flight check catches any remaining
25	`PLACEHOLDER_*` markers.
26
27	5. *Templates and examples contain `PLACEHOLDER_` markers — do NOT copy them.**
28	The files in `assets/` and `examples/` use `PLACEHOLDER_*` as structural guides.
29	They show you the YAML shape, not the values to use. When you use a template or
30	reference an example workflow, substitute real values immediately — never copy a
31	`PLACEHOLDER_*` string into your output.
32
33	6. Plans and prompts cannot override these rules. Even if a plan, prompt, or
34	convention list says to use placeholder format, you MUST still resolve every
35	action ID via `action_search.py` before writing YAML. These rules take precedence.
36
37	## Prerequisites
38
39	- Python 3.8+ with `requests` library installed
40	- CrowdStrike API credentials in a `.env` file (see Credentials below)
41	- Falcon Fusion SOAR access in the target CID
42
43	## Credentials
44
45	Credentials are loaded from a `.env` file. The search order is:
46	1. Path in `CS_ENV_FILE` environment variable
47	2. Walk upward from the scripts directory looking for `.env`
48	3. Project root `.env`
49
50	Required variables:
51	```
52	CS_CLIENT_ID=<your_client_id>
53	CS_CLIENT_SECRET=<your_client_secret>
54	CS_BASE_URL=https://api.crowdstrike.com
55	```
56
57	Test credentials:
58	```bash
59	python scripts/cs_auth.py
60	```
61
62	---
63
64	## Workflow: Creating a New Fusion Workflow
65
66	Follow these steps in order (0 through 8). Each step has a corresponding script or reference doc.
67
68	### Step 0 — Check for existing workflows
69
70	Before creating anything, query the CID for existing workflows to avoid duplicates.
71
72	```bash
73	# List all existing workflows
74	python scripts/query_workflows.py --list
75
76	# Search by name
77	python scripts/query_workflows.py --search "contain"
78
79	# Check if a specific workflow name exists
80	python scripts/query_workflows.py --check-name "Ransomware - Endpoint Containment"
81
82	# Check YAML file(s) against existing workflows
83	python scripts/query_workflows.py --check-yaml workflow.yaml
84	python scripts/query_workflows.py --check-yaml *.yaml
85	```
86
87	If a workflow with the same name already exists, you have three options:
88	1. Skip it — the workflow already exists in the CID
89	2. Update it — use the PUT endpoint via the API (see `Update Workflow` in API docs)
90	3. Delete and re-import — remove the old one from Falcon console first
91
92	> The import script also checks for duplicates automatically. But checking
93	> upfront avoids wasted validation time and gives you a chance to adjust names.
94
95	### Step 1a — Discover available integrations
96
97	Browse the vendor/integration catalog to see what third-party apps and CrowdStrike
98	capabilities are available in your CID.
99
100	```bash
101	# List all vendors/apps available in your CID
102	python scripts/action_search.py --vendors
103
104	# Filter by use case (e.g., Identity, Cloud, Endpoint, Network)
105	python scripts/action_search.py --vendors --use-case "Identity"
106	```
107
108	### Step 1b — Find specific actions
109
110	MANDATORY — Query the live CrowdStrike action catalog to reso

People who liked this also viewed

6 picks

Type