What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?

The CrowdStrike Falcon platform uses Falcon Fusion, its Security Orchestration, Automation, and Response (SOAR) framework, to create custom workflows. The fundamental model for building these workflows is based on three core components: a Trigger, which is an event that initiates the workflow (e.g., a new detection); one or more Conditions, which act as logical filters to determine the workflow's path (e.g., if severity is 'Critical'); and one or more Actions, which are the tasks executed by the workflow (e.g., send a custom notification, isolate a host). This Trigger-Condition-Action model is the standard for creating event-driven automation within the platform.

A. For - While statement(s): These are programming loop constructs and do not represent the high-level, event-driven model used to build workflows in the Falcon Fusion user interface.
C. Event trigger(s): A trigger is only the initial component that starts a workflow; it does not encompass the entire model, which also requires conditions and actions to be functional.
D. Predefined workflow template(s): Templates are pre-built examples of workflows, not the underlying architectural model or components used to create a new, custom workflow from scratch.

1. CrowdStrike, Inc. (2023). Falcon Fusion Workflows Documentation. CrowdStrike Support Portal. In the section "Building a Workflow," the process is explicitly defined by the sequence of selecting a Trigger, adding Conditions, and defining Actions. It states, "Every workflow starts with a single trigger... You can add conditions to your workflow to create branches... Actions are the final step in a workflow."

2. Chapple, M., & Seidl, D. (2022). The Official (ISC)2 CISSP CBK Reference (6th ed.). Wiley. Chapter 15, "Security Operations," discusses SOAR platforms, describing their operation as a sequence of event triggers, conditional logic, and automated response actions, which aligns with the Trigger-Condition-Action model.

3. Purdue University. (n.d.). Introduction to SOAR. Courseware for "Introduction to Systems Security." The curriculum describes the core functionality of SOAR platforms, emphasizing the Event-Condition-Action (ECA) rule paradigm as the basis for creating automated playbooks and workflows to respond to security incidents.