CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ179

VerifiedWorkflows

To strengthen the organization’s security posture, you are designing a Fusion SOAR workflow that generates an alert when Falcon detects critical vulnerabilities.

When building a new workflow from scratch, which workflow component must be configured first?

Explanation

A trigger establishes how and when a Fusion SOAR workflow starts, including event-driven execution for Falcon security events. Actions perform the subsequent automation, while conditions branch logic after the workflow has been triggered. CrowdStrike’s workflow-template guidance directs builders to configure the trigger before adding actions and conditions.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!