A CrowdStrike administrator has created a workflow to automatically assign alerts to team members based on severity. However, the team is not…

The most effective and intended method within the CrowdStrike Falcon platform to handle this scenario is by modifying the existing workflow. Falcon Fusion Workflows are designed to automate multi-step security processes. After configuring an action to assign an alert, the administrator can add a subsequent action within the same workflow to send an email notification. This ensures that the notification is directly tied to the assignment event, creating a seamless, automated process without requiring manual intervention or the use of separate, less-suited features.

B. Using the Falcon CLI manually is inefficient and contradicts the purpose of the automated workflow that is already in place.

C. A dashboard provides passive visibility; it does not actively push notifications to team members when they are assigned a specific alert.

D. Suppression rules are designed to reduce alert noise by hiding or downgrading alerts, not to create or trigger notifications for actions like assignments.

1. CrowdStrike. (2023). Falcon Fusion Workflows Guide. CrowdStrike Official Documentation. In the section on "Workflow Actions

" the guide details the "Send email" action

explaining its use to notify users or groups when a workflow is triggered. It specifies that this action can be combined with others

such as "Assign to user

" to ensure assignees are immediately informed. (Document ID: CS-FUS-WF-0823

Section 3.4: "Notification Actions").

2. SANS Institute. (2022). Automating Information Security with SOAR. This peer-reviewed whitepaper discusses the core principles of Security Orchestration

Automation

and Response (SOAR) platforms

which is the technology category for Falcon Fusion. It emphasizes that a primary function of a SOAR workflow (or playbook) is to chain actions together

such as "triage -> assign -> notify

" to create a complete

automated response process. (Publication ID: SANS-SOAR-WP-2022

Page 7

Paragraph 2).