When using Falcon Fusion, how can administrators ensure they are notified immediately about critical threats detected in their cloud infrastructure? 87/192

Falcon Fusion is CrowdStrike's Security Orchestration, Automation, and Response (SOAR) framework. It utilizes a Workflow Builder to create automated playbooks. To receive immediate notifications for critical threats, an administrator must configure a workflow. This workflow is set up with a trigger, such as a new detection, and can be filtered for specific criteria like 'critical' severity and cloud-related sources. An action, such as sending an email, a Slack message, or a webhook, is then added to the workflow to ensure immediate notification to the relevant teams or individuals. This is the designated method for creating real-time, customized alerting based on security events within the Falcon platform.

B. Falcon Fusion inherently uses data from the Threat Graph for its triggers; this is not a separate integration step that an administrator configures for alerts.
C. Recurring reports are scheduled summaries and do not provide the immediate, real-time notification required for a critical threat as it is detected.
D. "Immediate Alert Policy in Falcon Central" does not correspond to a specific feature or terminology within the CrowdStrike Falcon platform for configuring custom, real-time notifications.

1. CrowdStrike, Inc. (2023). Falcon Fusion: SOAR for Everyone, Getting Started Guide. CrowdStrike Official Documentation. This guide details the process of using the Workflow Builder, stating, "Workflows are composed of a trigger, optional conditions, and a series of action steps... A common use case is to create a workflow that triggers on a new detection and sends a notification to a response team." (Section: "Building a Workflow," p. 5).

2. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Workflows. CrowdStrike Tech Center. The documentation provides examples of creating workflows, including a template for "Notify on New Critical Detections," which explicitly outlines using a falcon.NewDetection trigger, filtering for severityname='Critical', and using an action like Send email. (Section: "Workflow Templates").