Falcon Fusion SOAR Workflows

# Get all workflows
Get-FalconWorkflow -All

# Get workflow executions
Get-FalconWorkflow -Execution -Filter "status:'failed'" -Detailed

Export-FalconWorkflow -Id <workflow_id> -Path "C:\Workflows\myworkflow.yaml"

Import-FalconWorkflow -Path "C:\Workflows\incident_response.yaml" -Name "Incident Response Workflow"

# Execute workflow by ID with trigger data
$TriggerData = @{
    detection_id = "ldt:abc123..."
    severity = "critical"
} | ConvertTo-Json

Invoke-FalconWorkflow -Id <workflow_id> -Json $TriggerData

Redo-FalconWorkflow -Id <execution_id>

# Get all available workflow actions
Get-FalconWorkflowAction -All

# Get actions from library
Get-FalconWorkflowAction -Library -Filter "category:'crowdstrike'" -All

Get-FalconWorkflowTrigger -Filter "trigger_type:'detection'"

Get-FalconWorkflowInput -Id <input_id>

# Create workflow trigger data for a detection
$Detection = Get-FalconDetection -Id "ldt:abc123..." | Select-Object -First 1

$TriggerData = @{
    detection_id = $Detection.detection_id
    severity = $Detection.severity
    hostname = $Detection.device.hostname
    username = $Detection.behaviors[0].user_name
} | ConvertTo-Json

# Execute incident response workflow
Invoke-FalconWorkflow -Name "Automated Incident Response" -Json $TriggerData

# Export all workflows for backup
$Workflows = Get-FalconWorkflow -All
$BackupPath = "C:\Workflow_Backups\$(Get-Date -Format 'yyyyMMdd')"

New-Item -Path $BackupPath -ItemType Directory -Force | Out-Null

foreach ($Workflow in $Workflows) {
    $FileName = "$($Workflow.name -replace '[^a-zA-Z0-9_-]','_').yaml"
    Export-FalconWorkflow -Id $Workflow.id -Path "$BackupPath\$FileName" -Sanitize $true
    Write-Host "Exported: $($Workflow.name)"
}

# Monitor workflow executions
$Today = (Get-Date).Date.ToString('yyyy-MM-ddTHH:mm:ssZ')
$Executions = Get-FalconWorkflow -Execution -Filter "start_timestamp:>'$Today'" -Detailed -All

# Analyze execution status
$Summary = $Executions | Group-Object -Property status | Select-Object Name, Count

Write-Host "Workflow Execution Summary:"
$Summary | Format-Table -AutoSize

# Retry failed executions
$FailedExecutions = $Executions | Where-Object { $_.status -eq 'failed' }
if ($FailedExecutions) {
    Write-Host "Found $($FailedExecutions.Count) failed executions"
    $FailedExecutions | Redo-FalconWorkflow
}

# Validate workflow before import
$ValidationResult = Import-FalconWorkflow -Path "C:\Workflows\custom_workflow.yaml" -ValidateOnly $true

if ($ValidationResult.valid) {
    Write-Host "Workflow is valid" -ForegroundColor Green
    
    # Import workflow
    $NewWorkflow = Import-FalconWorkflow -Path "C:\Workflows\custom_workflow.yaml" `
        -Name "Custom Security Workflow"
    
    Write-Host "Imported workflow: $($NewWorkflow.id)"
} else {
    Write-Warning "Workflow validation failed: $($ValidationResult.errors)"
}

# Execute containment workflow for critical detections
$CriticalDetections = Get-FalconDetection -Filter "severity:'critical'+status:'new'" -Detailed

foreach ($Detection in $CriticalDetections) {
    $TriggerData = @{
        detection_id = $Detection.detection_id
        device_id = $Detection.device.device_id
        hostname = $Detection.device.hostname
        action = "contain"
    } | ConvertTo-Json
    
    Write-Host "Executing containment workflow for $($Detection.device.hostname)"
    Invoke-FalconWorkflow -Name "Host Containment" -Json $TriggerData -Key ([guid]::NewGuid().ToString())
}

# List available workflow actions by category
$Actions = Get-FalconWorkflowAction -Library -All

$ActionsByCategory = $Actions | Group-Object -Property category | ForEach-Object {
    [PSCustomObject]@{
        Category = $_.Name
        Count = $_.Count
        Actions = ($_.Group | Select-Object -ExpandProperty name) -join ', '
    }
}

$ActionsByCategory | Format-Table -AutoSize -Wrap

# Execute workflow across multiple child CIDs (Flight Control)
$ChildCIDs = @('cid1', 'cid2', 'cid3')

$TriggerData = @{
    task = "security_scan"
    timestamp = (Get-Date).ToString('yyyy-MM-ddTHH:mm:ssZ')
} | ConvertTo-Json

# Execute workflow in each child tenant
Invoke-FalconWorkflow -Id <workflow_id> -Cid $ChildCIDs -Json $TriggerData

# Generate execution report for specific workflow
$WorkflowId = "abc123..."
$Executions = Get-FalconWorkflow -Execution -Filter "definition_id:'$WorkflowId'" -All

$Report = $Executions | Select-Object @{
    Name = 'ExecutionID'
    Expression = { $_.execution_id }
}, @{
    Name = 'Status'
    Expression = { $_.status }
}, @{
    Name = 'StartTime'
    Expression = { $_.start_timestamp }
}, @{
    Name = 'Duration'
    Expression = { 
        if ($_.end_timestamp) {
            ([datetime]$_.end_timestamp - [datetime]$_.start_timestamp).TotalSeconds
        } else { 'Running' }
    }
}

$Report | Export-Csv -Path "workflow_execution_report.csv" -NoTypeInformation