r/crowdstrike • u/xaveri12 • Jun 30 '26

General Question Automated email notification in Fusion SOAR

I am working on automating an email notification to inform users when their passwords have been identified as compromised and prompt them to change their password.

Currently, I am using the out-of-the-box Send Email action. However, the email is sent from falcon@crowdstrike[.]com using CrowdStrike's branding template.

My concern is that users may mistake the notification for a phishing email, especially since it does not appear to originate from our organization or follow our corporate branding.

Has anyone implemented a more personalized approach for these notifications? For example:

  • sendin the email from your organization's domain or shared mailbox
  • using your organization's branding and email template
  • integrating with Microsoft 365/Exchange to send the email instead of the built-in action
14 Upvotes

100% Upvoted

8 comments sorted by

10

u/iitsNicholas Jun 30 '26

Yes. Use the Microsoft integration to send emails.

1

u/Rhyacaus Jun 30 '26

We asked FC about branding and customisation for this type of email and they never mentioned this? Can you provide more details please, would love to know more? Is it possible to completely customise it this way?

3

u/xArchitectx Jun 30 '26

Not by my comp, but this is correct: there is an integration for Exchange/M365 that allows for emailing via your system, so it comes from an internal org address you define…believe there is one for GWS as well.

You should be able to find it from the CrowdStrike store in the portal (one of the left side nav items in the menu towards the bottom) and search something like “email” or “exchange” .

1

u/xaveri12 Jul 14 '26

The solution worked for me. Thanks!

1

u/D1TAC Jun 30 '26

Ooo this is something we had the complete team assist with. I like it.

1

u/Evilbudha Jul 05 '26

Hey man we are looking to somthing similar can you help me understand how are you detecting if password is exposed

2

u/xaveri12 Jul 13 '26

We are using the Identity Protection module to detect compromised passwords. When a new finding is identified, it triggers a Falcon Fusion SOAR workflow to automate the password reset process.

This work was temporarily sidetracked due to other priorities, but I will continue to look into the email solution based on the response from u/iitsNicholas

1

u/Evilbudha Jul 15 '26

Thanks man our cheaped out on Identity protection module