CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ154

VerifiedWorkflows

An existing workflow is triggered by a critical detection and sends an email to the escalation team. Your CISO has requested an additional email notification with a customized message. What is the best way to update the workflow?

Explanation

Independent notifications from the same critical-detection trigger should be configured as parallel actions. This retains the escalation-team email and sends the CISO a separate email that can use its own customized message, without waiting for the existing notification action to finish.

Community Discussion

No comments yet. Be the first to start the discussion!