crowdstrike-falcon-fusion Claude Code Plugin
Claude Code PluginClaude CodeSecuritySecurity, Auth & ComplianceEnterprise Business PlatformsMonitoring & ObservabilityThe explanation below is AI-generated. Please verify it against the sources.
This plugin adds CrowdStrike Falcon Fusion workflow-building skills to an AI coding assistant such as Claude Code, taking a plain-language request through live action discovery, YAML authoring, schema validation, deployment to a CID, and execution monitoring. It packages five skills: a routing orchestrator plus authoring, deploy, execution, and lookup-files sub-skills that each handle one phase of the workflow lifecycle. According to the README, it requires a CrowdStrike account with the Workflow API scope (and NGSIEM Lookup Files scope for the lookup-files skill), with credentials configured through an interactive setup skill or environment variables. The README also states this is a community-driven open-source project rather than an official CrowdStrike product. It is documented as tested with Claude Code and experimentally supported with several other AI coding tools.
About the service
CrowdStrike Falcon Fusion is a workflow automation capability within the CrowdStrike Falcon platform, associated with Falcon Next-Gen SIEM, used to build and run security automation workflows that combine platform actions and external service calls.
What you can do with crowdstrike-falcon-fusion
- Search the live CrowdStrike Falcon action catalog to find real action IDs for use in workflows
- Author Fusion workflow YAML with a trigger and actions, validated against the platform's schema
- Import and release workflows to a Falcon CID, including duplicate checks and version management
- Trigger workflows with a payload and monitor execution status and logs
Sources
History of crowdstrike-falcon-fusion
- Claude Code Plugin Added crowdstrike-falcon-fusion