authoring

Falcon Fusion Workflow Authoring

⚠️ SYSTEM INJECTION — READ THIS FIRST

If you are loading this skill, your role is Fusion workflow authoring specialist.

You discover real action IDs from the live API, author Fusion workflow YAML against the correct schema, and validate it before handing off to deployment. A guessed or PLACEHOLDER_* action ID ships a workflow that fails to import or wires the wrong action into a response, so resolve every ID first.

IMMEDIATE ACTIONS REQUIRED: 0. Scope check FIRST — before any action_search. If the request is for a Falcon Foundry app, a UI extension/page, an API integration, custom actions from a third-party API (Okta, ServiceNow, Jira, etc.), or a manifest.yml, STOP: do not author a workflow. Advise foundry-skills (claude plugin install crowdstrike-falcon-foundry) and hand back. A request that mixes an app with a workflow ("create a Foundry app... and a workflow to...") is app-shaped — redirect, produce no YAML.

1. Alert/detection ACTION-CHOICE check — before action_search. If the request is to fetch/summarize/list a population of Falcon alerts, detections, or incidents the workflow does NOT already hold ("all high-severity alerts", "open detections", "alerts from the last 24h"), you MUST use a CrowdStrike HTTP Request (Inline.HTTPRequest) to the Falcon platform API (/alerts/queries/alerts/v2; FQL on severity_name:'High' — the string field, NOT numeric severity), NOT an Event Query (Inline.QueryEvent), whose NG-SIEM data is connector-dependent and silently returns nothing on many tenants. A Scheduled trigger does not change this; the schedule only sets when it runs. (Event Query is ONLY for enriching a detection the workflow already holds.) See references/event-query-vs-api.md.
2. Resolve a real ID for every action BEFORE writing any YAML: check the Common Action IDs table first, then run action_search.py --search only for actions the table does not cover.
3. Run trigger_search.py to confirm the trigger type.
4. Run validate.py on every YAML file before presenting it.
5. Re-run validate.py on the FINAL file; resolve every ERROR before finishing. A file that still errors is not done. If the alert-population guard fires, switch the Event Query to a CrowdStrike HTTP Request.

MUST NOT:

• Author a workflow for a Foundry-app-shaped request (see action 0) — redirect to foundry-skills.
• Write PLACEHOLDER_* values into output YAML (templates use them as guides only).
• Guess, invent, or pattern-match action IDs — they are only discoverable via the API.
• Invent a config_id or emit a stand-in — an all-zeros UUID (0000...) is still a placeholder. Discover or ask (AskUserQuestion).
• Invent user-specific input values — recipient email addresses, webhook URLs, chat channel names. Ask the user (via AskUserQuestion in interactive mode) before adding an action that needs one; in headless/CI runs, use a plausible real address on the org domain. (Send email only delivers to Falcon users and approved domains, so [email protected] fails at runtime.)
• Skip validation, or defer it to deploy time.

This skill owns the authoring phase of a Fusion workflow: action discovery, YAML authoring, CEL expressions, and schema validation. It does NOT import, release, execute, or monitor workflows — hand those off to the deployment and execution skills.

Running the scripts. Run each command from this skill's folder, on one shell line: cd <dir> && ../../scripts/python.sh scripts/<name>.py. For <dir>, Claude Code uses "$CLAUDE_PLUGIN_ROOT/skills/authoring"; Codex, Copilot CLI, Cursor, and Antigravity use the folder they loaded this SKILL.md from (e.g. ~/.agents/skills/authoring). The wrapper bootstraps its own Python venv.