v1.0.0

First public release of Falcon Fusion Skills — AI coding assistant skills for building CrowdStrike Falcon Fusion workflows. Tell your assistant what you want to automate in plain language, and it finds the real action IDs in your tenant, writes the workflow YAML, checks it against the platform schema, imports it to your CID, and runs it.

What's included

Six skills behind one entry point. The workflows orchestrator reads what you asked for and hands off to the right one: authoring for action discovery and YAML with schema validation, deployment for import and release, execution for triggering and monitoring runs, lookup-files for the Next-Gen SIEM lookups behind CQL match(), and setup for credentials (you type the secret into your own editor, not the chat).

The local validator is the part that saves you the most time. It catches the mistakes that usually fail at release or, worse, quietly return nothing: a bad action ID, a malformed reference, the wrong trigger shape, an Event Query reading data that isn't there. You hear about it in seconds instead of after a failed deploy.

There are also 25 working examples from the CrowdStrike Content Library and 15 use cases that map common asks — "enrich a detection," "close duplicate detections" — to the workflow that handles them. The examples import cleanly and open in the Falcon visual editor, so they double as references.

Editor and CLI support

Built and tested with Claude Code. There are setup notes for Codex, Copilot CLI, Cursor, and Antigravity CLI, but treat those as experimental — written from each tool's docs, not yet run end to end. The skills are plain markdown, so anything that reads local files can use them.

Getting started

/plugin marketplace add CrowdStrike/fusion-skills
/plugin install crowdstrike-falcon-fusion@fusion-marketplace

Then describe the workflow you want. The README covers credential setup and has a full example prompt.