CrowdStrike Falcon Fusion

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

• Imports, releases and triggers production Fusion workflows: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
• Deletes workflows and NGSIEM lookup files: Can delete records, files, projects, messages, or resources that may be difficult to recover.
• Cloud HTTP actions can call user-selected external APIs: Can send prompts, files, queries, or connected-service data to an external service.
• Stores Falcon API client credentials in a local profile: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
• Runs inline Python, local helpers and arbitrary workflow actions: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
• Workflows can send email and chat notifications: Can send messages, comments, invitations, posts, or published content attributed to the connected user.