authoring
Discover Falcon Fusion actions via live API, author workflow YAML with correct schema, validate against Charlotte JSON schema, and use templates/examples. TRIGGER when user asks to write workflow YAML, find actions, validate a workflow, use CEL expressions, or needs action discovery. DO NOT TRIGGER for deploying, importing, executing, or monitoring workflows — use deployment or execution skills. DO NOT TRIGGER when the request is for a Falcon Foundry app, a UI extension/page, an API integration, custom actions from a third-party API, or a manifest.yml — those are foundry-skills territory; advise foundry-skills instead of authoring a workflow.
- License
- MIT
- Compatibility
- Claude Code >=1.0
Pinned to revision 4e8964e24a5a, so it is the text this page describes rather than whatever the author pushed since.
Pre-approved tools experimental
Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.
- Bash(cd *)
- Bash(scripts/python.sh:*)
Files
- skills/authoring/SKILL.md
- skills/authoring/LICENSE
- skills/authoring/assets/conditional.yaml
- skills/authoring/assets/loop-conditional.yaml
- skills/authoring/assets/loop.yaml
- skills/authoring/assets/single-action.yaml
- skills/authoring/common/scripts/auth.py
- skills/authoring/examples/README.md
- skills/authoring/examples/identity-response/email-phishing-playbook-itp.yaml
- skills/authoring/examples/identity-response/identity-detection-auto-resolution.yaml
- skills/authoring/examples/ngsiem/close-duplicate-detections.yaml
- skills/authoring/examples/notifications/network-contain-endpoint-on-detection.yaml
- skills/authoring/examples/notifications/slack-send-message-to-channel.yaml
- skills/authoring/examples/response-actions/pan-ngfw-allowlist-edl-exception.yaml
- skills/authoring/examples/response-actions/pan-ngfw-blocklist-edl-force-refresh.yaml
- skills/authoring/examples/response-actions/pan-ngfw-get-all-edls.yaml
- skills/authoring/examples/response-actions/pan-ngfw-monitor-dag-members.yaml
- skills/authoring/examples/response-actions/pan-ngfw-register-ip-tag-dag.yaml
- skills/authoring/examples/response-actions/pan-ngfw-unregister-ip-from-tag-dag.yaml
- skills/authoring/examples/threat-intel/analyze-enrich-epp-detection-llm.yaml
- skills/authoring/examples/threat-intel/domain-enrichment-pulsedive.yaml
- skills/authoring/examples/threat-intel/domain-enrichment-virustotal.yaml
- skills/authoring/examples/threat-intel/enrich-ip-virustotal-llm-email.yaml
- skills/authoring/examples/threat-intel/enrich-url-virustotal-zscaler-blocklist.yaml
- skills/authoring/examples/threat-intel/ip-address-enrichment-abuseipdb.yaml
- skills/authoring/examples/tutorials/crowdstrike-http-request-falcon-api.yaml
- skills/authoring/examples/tutorials/intro-cases-add-event.yaml
- skills/authoring/examples/tutorials/intro-data-transforms-ternary.yaml
- skills/authoring/examples/tutorials/intro-deduplicate-third-party-detections.yaml
- skills/authoring/examples/tutorials/intro-error-handling.yaml
- skills/authoring/examples/tutorials/intro-lookup-file-actions.yaml
- skills/authoring/examples/tutorials/intro-python-sslbl-lookup.yaml
- skills/authoring/examples/tutorials/intro-receive-email-trigger.yaml
- skills/authoring/examples/tutorials/intro-variables-append-array.yaml
- skills/authoring/references/best-practices.md
- skills/authoring/references/cel-expressions.md
- skills/authoring/references/charlotte-ai-action.md
- skills/authoring/references/deduplicate-ratelimit.md
- skills/authoring/references/event-query-action.md
- skills/authoring/references/event-query-vs-api.md
- skills/authoring/references/http-actions.md
- skills/authoring/references/inline-python-action.md
- skills/authoring/references/json-structure.md
- skills/authoring/references/trigger-types.md
- skills/authoring/references/yaml-schema.md
- skills/authoring/scripts/action_search.py
- skills/authoring/scripts/python.sh
- skills/authoring/scripts/trigger_search.py
- skills/authoring/scripts/validate.py
- skills/authoring/use-cases/event-queries.md
- skills/authoring/workflows/ngsiem-detection-ti-enrichment-copilot.yaml
Every link opens the file at its source, pinned to the revision this page describes.