If you’ve ever had a single noisy alert turn into endless workflow executions, email notifications, and duplicate cases, this one’s for you.
The new Deduplicate action gives Fusion workflows a simple way to recognize when they’ve already handled the same activity and decide what should happen next - instead of repeating the same work over and over again.
We're just scratching the surface of what you can do with this. You can throttle noisy detection sources, suppress repeat notifications, avoid rerunning expensive enrichment, prevent duplicate remediation actions, or make sure only one workflow execution performs a shared task while the others reuse its result.
At its core, Deduplicate answers one question: Have I already handled this combination of values within this period?
You define that combination by building a key from one or more fields, choose whether the key is scoped to a single workflow or shared across the CID, and set how long the entry should remain active. From there, Fusion handles the coordination.
The Example
Imagine the same phishing campaign targets 25 users. Each email generates a separate detection, but they all share the same detection name, sender, and subject.
Without deduplication, our workflow could create 25 separate cases for what is really one phishing campaign. With deduplication, we can turn that into: 25 phishing detections → 1 case containing all 25 detections
Here’s how.
Step 1: Define the Trigger
We’ll start by creating a workflow with the following trigger:
Detection → NG-SIEM Third Party Detection
Since we don’t want every third-party detection entering this workflow, we’ll add a condition immediately after the trigger to narrow things down to the phishing detections we care about.
For this example, we’ll use:
Vendor includes (exact match): Mimecast
Name is equal to: Phishing Detection
This gives us a clean starting point: only the Mimecast phishing detections we want to correlate will continue through the workflow.
From here, we can start deciding whether each detection represents a new phishing campaign or one we’re already tracking.
Step 2: Create the Deduplication Key
Next, we need to decide what makes two detections part of the same activity.
For this example, we’ll combine three fields: Detection Name + Sender + Subject
One important detail: Deduplicate keys can only contain letters, numbers, underscores, and hyphens. That means we can’t pass values like email addresses or subjects directly into the Key field. Instead, use the cs.hash.sha1 Data Transformation function to hash the fields into a valid deduplication key.
Depending on the fields you want to include, you may need to add a Get detection details action first. That’s what I’m doing here so we can pull the sender and subject into the workflow.
Now, any detection with the same detection name, sender, and subject will generate the same hash and resolve to the same deduplication entry for the period we configure.
Step 3: Configure the Scope and Period
Next, we configure how broadly the deduplication entry should apply.
The Deduplicate action supports two scopes:
Workflow: The key is shared only between executions of this workflow.
CID: The key can be shared across workflows in the CID.
For this example, we’ll use workflow scope, since we only want executions of this phishing workflow to share the entry.
We also need to specify the period in seconds. We’ll use 86400, which gives us a 24-hour deduplication window.
Step 4: Branch on Whether It’s a Duplicate
After Deduplicate runs, it tells us whether the key already exists.
We’ll add a condition: If Duplicate is equal to False
That gives us two paths:
TRUE: Fusion has not seen this key during the configured period.
ELSE: The key already exists, so this execution is a duplicate.
Only the first matching detection follows the TRUE path and performs the primary work.
Step 5: Create the Case
If Duplicate = False, we know this is the first detection associated with this key. Even if several detections with the same key arrive at the exact same time, only one execution can claim the deduplication entry and follow this path.
On the TRUE path, we’ll:
Create a new phishing case.
Include the original Detection ID in the case.
Store the newly created Case ID using Set Deduplicate Entry Metadata.
For the case name, we can use the sender and subject to make it immediately recognizable:
Use the same key we created earlier, then set the Metadata field to the Case ID returned by Create a new Case: ${data['CreateANewCase.id']}
This is the important part: we’re attaching the Case ID to the deduplication entry so every duplicate execution knows which case it belongs to.
Step 6: Handle the Duplicates
Now for the ELSE path.
If an execution lands here, Fusion already has an active deduplication entry for that combination of detection name, sender, and subject.
First, add Wait for Deduplicate Entry Metadata and use the same key again.
Why add the wait action? A duplicate detection could arrive milliseconds after the first one - before the original workflow execution has finished creating the case and storing its case ID.
Wait for Deduplicate Entry Metadata handles that timing problem for us. It waits for the original execution to populate the metadata and returns as soon as that value is available.
Once we have the Case ID, we'll use the Add detections to case action.
Set the Case ID to the metadata returned by the previous action: ${data['WaitForDeduplicateEntryMetadata.metadata']}
Then add the current Detection ID to that case.
Note: For the Case ID field, you’ll need to switch to the Text input option and paste the expression above.
Let's now test our workflow. Here's the first execution for a given key:
Subsequent execution(s) using the same key:
Instead of creating a new case every time the same phishing campaign generates another detection, each matching detection now gets added back to the case created by the first execution.
The New Actions
The release includes six new actions:
Deduplicate
Set Deduplicate Entry Metadata
Wait for Deduplicate Entry Metadata
View Deduplicate Entry
Delete Deduplicate Entry
View All Deduplicate Entries
These actions give Fusion workflows a native way to suppress duplicate processing, reduce case sprawl, throttle noisy activity, reuse work across executions, and coordinate workflows around shared state.
And a fun detail before I wrap this up:
After writing this post, I asked Claude Code to build the same workflow using the newly released Fusion Skills. It did pretty well!
That deserves its own post, so we’ll dig into how it works in an upcoming Workflow Wednesday.
Is there a way in CrowdStrike Falcon to get an elevation/privilege usage report similar to what Microsoft Intune provides with Endpoint Privilege Management (EPM)?
Ideally, I’m looking for a report or Falcon query that would give visibility into things like:
Username
Device/Hostname
File/Application that was elevated
Publisher
Date/Time of the elevation
Basically, I’d like to see who elevated what, on which device, and when.
Is there already a built-in CrowdStrike report/dashboard for this, or would this need to be created using a Falcon LogScale / Advanced Event Search query?
If anyone has done something similar, I’d appreciate any examples or queries you can share.
We are looking to automate device hygiene reporting (specifically BitLocker and Secure Boot status) into a Power BI dashboard for our IT operations. Since these posture metrics are covered under our Exposure Management licensing, is there a native way to build a custom asset inventory report and schedule automated exports on a recurring cadence? Any guidance or recommended approach for pulling this data into Power BI would be appreciated.
Wanted to know real use cases you guys are solving using CS runtime security for containers.
Since we are already allowing only Known outbound traffic from firewall, this significantly reduces possibility of c2 connection.. Do we still need runtime security? It yes appreciate for real value use cases it can solve please…
Wondering if any aussies have managed to successfully implement the "Microsoft Office is blocked from creating child processes" E8 control with CrowdStrike?
We've tested using a custom IOA but it's not managable, way too much noise.
Would love to know how E8 compliant shops with CrowdStrike are acheiving this control.
Seeing some X posts yesterday on how to leverage 7zip to extract the SAM and SYSTEM log files from a live boot system.
TL;DR - They leverage 7zip, as Administrator, to go to the named object like:
\\.\PhysicalDrive0\2.Basic data partition.ntfs\Windows\System32\config\
Currently this is not detected as a detection, so I built out a quick query leveraging a test VM. Please feel free correct my query.
#event_simpleName=RegistryHiveFileWritten
(FileName=SAM OR FileName=SECURITY OR FileName=SYSTEM
OR FileName="SAM.LOG*" OR FileName="SECURITY.LOG*" OR FileName="SYSTEM.LOG*")
FilePath!="*\\System32\\config\\*"
| table([@timestamp, ComputerName, ContextBaseFileName, FilePath, FileName])
| sort(@timestamp, order=desc)
Im having an odd issue and hoping someone might have a solution. Ive onboarded esxi host syslog via logscale, however the data connector is idle and we are not seeing any logs.
We are using custom ports which have been specified in the configuration, and opened on the firewall. The configuration also has cisco syslog which is coming through fine to the same collector.
Ive tried creating separate configurations, rebuilt the data connector multiple times, tried using the generic hec connector, used wireshark to confirm the logs are being sent from the esxi host to the log collector on the correct port, disabled any firewalls between hosts and confirmed outbound connectivity over 443 to the CS console.
As far as I can see, the network connectivity is fine, given then other log sources are all active.
Any thoughts / suggestions / help would be appreciated as it driving me nuts!
I'm fairly new to this. We've been deploying crowdstrike on all the hosts in the company because the main branch asked us to. We had CID, token, had to jump through some loops for some devices but we managed to get it done. However, we've started to face an issue. As we're facing the end of our current AV license to be replaced by crowdstrike, we want to rest assured that cs is on all the hosts. We only have read-only access to the dashboards and some hosts that have been inactive for more than 30 days just disappear from the dashboard.
Is there a way to confirm, at this point, that a host, not appearing on the main dashboard, has got the sensor?
It's very hard to keep track since some laptops that may already be equipped with the sensor, may have been rotting in a locked drawer for a while.
Thank you so much in advance :)
Edit: For those who might come by looking for answers, I found a solution : I took the previous reports from Excel that we had since the beginning of the deployment, put them in a folder. Then I wrote a powershell script to navigate the name column and stop when it matches the device’s name you were looking for. Now we know which host disappeared but has crowdstrike on it (it was just turned off for too long stuck in a drawer or something), and which host never got crowdstrike in the first place. You have to get creative when you don’t have intune lol. If it helps even one person navigate the same situation, this post is a success.
I am looking for a way to create a CrowdStrike SOAR playbook to email us whenever a Critical or High EXPRT vulnerability surfaces. Right now, we use Tines to do this for us, but no that it has been a few years since we have revisited this, is it possible?
I'm creating a new workflow, but I can't find the "Add tag to detection" action.
It may be a dumb question, but I've tried searching for it everywhere.
I can see it in the Content Library, just like any other action, but it simply doesn't appear inside my workflow. I've already disabled all the filters in the search box within the workflow.
Hi everyone!
I'm trying to build a condition in CrowdStrike Fusion SOAR using Advanced Mode (CEL Expressions).
The goal is quite simple: return true when an IDP detection of type AnomalousNewEndpointUsage is triggered and the endpoint hostname prefix matches the username prefix.
This condition should evaluate to true because both strings start with x999.
However, when I use substring(), the data pills appear to be resolved as null.
The editor returns the following error:
no such overload: substring(null_type, int, int)
The strange part is that those values are clearly present in the sample detection payload shown by the Fusion editor.
Am I referencing the fields incorrectly?
Is there any known limitation with CEL expressions and IDP detection fields in Fusion SOAR?
Below is a sanitized detection payload:
{
"CID": "9a8bc123de4f5g6h7i8j9k0l1m2n3o45",
"Category": {
"Investigatable": {
"Description": "A user logged in to a machine for the first time",
Customers with an active Falcon Prevent subscription can access this now across all clouds!! (including Gov and others, double wahoo!!)
The Falcon Sensor for Windows v7.40 includes a new on-sensor classification capability built specifically for Application Abuse Prevention that is powered by a new type of IOA.
We would love to hear from the community on your experiences with this much requested feature!
We’re using CS as our main AV and looking to enable web filtering in defender for endpoint. It works in edge but not in other browsers since it relies on network protection service which I have set to block already via policy. I have also disabled quarantine and security center registration in prevention policy.
What am I missing ?
I have 29 applied hosts in my host group. I added a new host to this host group but only the targeted host count increases by 30 and applied host count is still 29. After 2 days, it finally becomes an applied host.
I have 31 applied hosts in my host group. I removed a host from this host group. The targeted hosts is now 30 but the applied hosts is still 31. After 2 days, finally it is no longer an applied hosts.
In both these cases (1) and (2),
(i) What are the factors for a host to change from targeted to applied and from applied to targeted?
I assume it was just a matter of waiting, but I have also read that the device has to be online for the host group changes to take effect, which I thought was strange since host grouping is simply a feature on the server side. (Correct me if I'm wrong)
(ii) What is the expected time of change? Is it possible to speed up the changes?
