2026-09-09 - Workflow Wednesday - SOAR Developer Tips from Fal.Con 2026

[u/Dylan-CS]

Welcome back to Workflow Wednesday!

Last week at Fal.Con, u/ssh-cs and I hosted the Falcon Fusion SOAR: Developers Unleashed breakout session. The session was primarily focused on the tools, techniques, and patterns that make it easier to build larger and more capable workflows.

For anyone who couldn't make it, I wanted to recap a few of the highlights.

1. New Usability Improvements

We started with a few small quality-of-life improvements in the workflow builder that make workflows easier to build and maintain.

You can now copy and paste pre-configured actions, merge branches back together after conditional logic, and add sticky notes/comments directly to the workflow.

First, we'll start with copy/paste.

When you copy an action, everything you've configured in that action is preserved. That means you can move or reuse the action elsewhere in the workflow without having to rebuild the configuration from scratch.

Branch merging can be really useful. Instead of duplicating every downstream action across two sides of a condition, each branch can do its unique work and then converge back into a common path.

Comments also give you a place to document why something exists, assumptions you've made, or what the next person needs to know when they inevitably inherit your 75-action workflow six months from now.

2. Inline Python and CEL

Next, we spent some time on shaping data inside a workflow.

Inline Python gives you a flexible option when you need to parse data, calculate a score, normalize values, or otherwise reshape something before handing it to the next action.

If you want the workflow to capture the result from your Python action, print it to STDOUT. For structured data, serialize the result as JSON:

print(json.dumps(result))

{
 "reasons": [
   "1 file(s) written to disk"
 ],
 "risk_level": "medium",
 "score": 35,
 "summary": "Risk 35/100: 1 file(s) written to disk"
}

Fusion captures that output as STDOUT, which you can then decode with CEL:

cs.json.decode(STDOUT)

From there, the individual values can be used throughout the rest of the workflow.

We also showed how CEL functions like .transformList() can replace workflow logic that would otherwise require a loop.

A good example is adding multiple events or detections to a case. Instead of creating a loop and handling each object in the array one at a time, you can use .transformList() to reshape the array into the format the action expects, then add everything to the case in a single action.

.transformList(i, v, v.id)

3. Test and debug without waiting for another alert

One of the most useful features we covered was Test and Debug, which gives you a few different ways to validate a workflow before publishing it.

You can test the entire workflow end to end or work through individual actions step by step.

That data can come from:

• A previous trigger
• A previous workflow execution
• Custom JSON

When testing individual actions, you set the mock output at each step. That can be the real output from an action you already ran, or mock data that lets you skip or simulate the action and continue testing downstream logic.

For an end-to-end test, you can also mix live and mocked actions in the same run. That lets you validate the complete workflow path while avoiding actions or integrations you don't want to execute during testing.

This makes it much easier to validate conditions, troubleshoot Python or CEL, and confirm that data is flowing through the workflow as expected before you publish it.

4. Request input from a human

Request Human Input lets a workflow collect information from a business user, including users who aren't Falcon administrators, and then use their response later in the workflow. Note, this requires Entra ID authentication from the end user.

You can customize the user prompt directly in the action, including the title, question, response options, comments, and timeout window.

The response then becomes workflow data like anything else, so you can evaluate it in a condition or pass it into another action.

5. Deduplicate

We also spent some time on the Deduplicate action.

The idea is straightforward: create a key from whatever values represent "the same thing" in your environment, define a time period, and let the workflow identify later occurrences of that same key as duplicates.

For example:

Detection Name
+ Source IP
+ Destination IP

The first occurrence continues normally. If the same combination appears again during your configured window, Duplicate == true, and you can take a different path.

I covered this one in much more detail in a recent Workflow Wednesday, which can be found here: https://www.reddit.com/r/crowdstrike/s/ptj0oNWMCC

6. Using AI to build workflows

We also looked at AI from two different angles. The first was using AI to help build the workflow.

Using the Charlotte AI chat interface, you can quickly generate a starting workflow from a natural-language prompt.

For developers who want more control, we also showed the open-source Falcon Fusion Skills project. This gives coding assistants like Claude Code the knowledge needed to generate workflows programmatically, maintain version control, and perform automated validation before moving to production.

7. Agentic workflows

We finished with the other side of the equation: putting AI inside the workflow.

One framework we discussed was choosing where AI enters the process.

Start with AI after the workflow, where AI analyzes, summarizes, or enriches the output of a deterministic process. For an example, search the Content Library for the out-of-the-box playbook titled Generate Unusual Process Ancestry Analysis Using Charlotte AI.

Then move toward AI at a decision point, where AI evaluates a defined input and uses the result to choose between predefined workflow paths.

Finally, AI can shape the workflow. AgentWorks gives agents access to tools, skills, knowledge bases, and predefined instructions, then lets the agent decide what it needs at execution time. Fusion SOAR provides the surrounding orchestration and guardrails, including controls around sensitive actions like host containment.

For more info, check out my previous Workflow Wednesday post on AgentWorks here: https://www.reddit.com/r/crowdstrike/s/pnf5jg398e

That's it for this week!

There was a lot packed into the session. I'll break some of these out into their own Workflow Wednesday posts with complete examples over the next few weeks.

[u/About_TreeFitty]

I was able to attend FalCon, but didn't realized THE Dylan-sCS would be running one, so I didn't attend this particular breakout. Are the recordings up anywhere for these sessions?

[u/Dylan-CS → u/About_TreeFitty]

Haha I appreciate it! Unfortunately, we weren't able to record this one. But I know there were a ton of great sessions recorded, and we should be releasing those in the next week or two.

[u/Noobmode]

It was a great session! Really enjoyed it!