CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ49

VerifiedCorrelation Rules and Falcon Fusion SOAR

You need to import a prebuilt workflow into Fusion SOAR to automate part of your incident-response process.

Which file format should you use?

Explanation

Falcon Fusion SOAR workflows are exported and imported as YAML files. In the Falcon console, importing a workflow prompts you to upload a .yaml workflow file, and CrowdStrike's tooling (PSFalcon Import-FalconWorkflow, the Terraform crowdstrike_fusion_soar_workflow resource) likewise takes a YAML definition. .CPP and .PY are source-code formats and .JSON is not the Fusion import format.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!