security-skills

Create, list, download, update, and delete CrowdStrike Falcon Next-Gen SIEM lookup files. Upload CSV or JSON files for use with the match() function in CrowdStrike Query Language (CQL) queries. Use this skill when asked to manage lookup files, upload CSV data to CrowdStrike, create reference tables for SIEM queries, or work with Falcon Next-Gen SIEM lookup file operations.

Create, validate, import, execute, and export CrowdStrike Falcon Fusion SOAR workflows. CRITICAL: You MUST run action_search.py to get real 32-char hex action IDs BEFORE writing any YAML. NEVER write PLACEHOLDER values for action IDs — resolve every ID via the live API first. Templates and example files in this repo contain PLACEHOLDER markers that are structural guides only — do NOT copy them into output YAML. For plugin config_id values, ask the user. Use this skill when asked to create a CrowdStrike workflow, Fusion workflow, Falcon Fusion automation, SOAR playbook, build a workflow for CrowdStrike, automate CrowdStrike actions, or anything involving CrowdStrike Fusion SOAR.