Skip to content

v1.1.0

Latest
Latest

Choose a tag to compare

View all tags
@mraible mraible released this 19 Aug 17:27
· 12 commits to main since this release
v1.1.0
8df28a7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

These skills now run across every major AI coding assistant! 🎉 Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI are supported. Now, you can build Falcon Fusion workflows from a prompt in whichever tool you already use. This release also adds validate.py checks for several workflow problems that used to pass local validation and only failed when you released the workflow.

Added

  • Multi-assistant support ✨ — the skills and their scripts now run on Codex, Copilot CLI, Cursor, and Antigravity CLI as well as Claude Code. Each assistant has documented install steps, and Agent Plugins manifests (a root plugin.json and a Codex .codex-plugin/plugin.json) let the non-Claude assistants discover the plugin
  • Throttling reference in the execution skill — how to tell a throttled workflow (stuck "in progress", auto-retrying for up to 6 hours) apart from a failed one, and when throttling points to a design problem
  • Deduplicate and Rate Limit action reference plus a worked tutorial example that folds duplicate third-party NG-SIEM detections into a single case
  • US-3 cloud region in credential setup, alongside a [us-gov-1] profile example
  • foundry-redirect skill — declines Falcon Foundry app requests (UI pages, serverless functions, collections, manifest.yml, custom third-party API integrations) and points to the sibling crowdstrike-falcon-foundry plugin. It works on every assistant and steps aside for the Foundry plugin's own skill when that plugin is installed

Fixed

  • version_constraint output-path shape documented — pinning an action at ~1 collapses its ${data['...']} references. Pin it without shortening them and the workflow imports fine, then fails at release with property "..." contains unknown variable
  • Authoring-doc corrections — event and system variables now use the ${data['...']} form like any other field, and the action name: is a display label you can rename without breaking references
  • validate.py now catches four release-only failures — workflows that import cleanly and pass server-side validation, then fail when you release them: a pinned action referenced by its long, unpinned output path; MITRE ATT&CK trigger fields (Trigger.Detection.MitreAttack.*) on the NG-SIEM trigger; a default: true gateway node with no expression or else:; and a missing, empty, or fake-domain to recipient on the Send email and Request human input actions

Known limitations

Verification depth is uneven across assistants. In a live-tenant run, Claude Code, Codex, Copilot CLI, and Cursor each authored a valid workflow from the canonical prompt and imported it to the tenant. Antigravity CLI loads the skills, but its weekly quota was exhausted before a full author-and-import run could complete, so its end-to-end path is not yet verified.

Getting started

Install:

/plugin install crowdstrike-falcon-fusion

Already installed? Update to 1.1.0:

/plugin update crowdstrike-falcon-fusion

Full Changelog

v1.0.1...v1.1.0

Assets 2
Loading