Integrating CrowdStrike Falcon Fusion SOAR with Cloudflare’s SASE platform

Cloudflare has announced a new integration between the Cloudflare One platform and CrowdStrike’s Falcon Fusion SOAR, part of an ongoing partnership with CrowdStrike. The out-of-the-box integration provides two pre-built connectors for Zero Trust Access and Email Security, designed for organisations already using CrowdStrike Falcon Insight XDR or Falcon Next-Gen SIEM.

Using signals from these integrations, SOC teams can create automated workflows that run with minimal to no human intervention, and Falcon Fusion SOAR’s drag-and-drop editor lets users chain Cloudflare actions with other signals to automate large portions of the SOC workflow.

A sample automated flow involves a phishing email detected by Cloudflare Email Security, with Falcon Fusion SOAR retrieving detection details, blocking the sender, and updating allow/deny lists, followed by Cloudflare Zero Trust revoking active session tokens and, if confirmed, isolating the device.

The bidirectional webhook and API integration enables detection and remediation to be coordinated between endpoint and network, reducing mean time-to-response from minutes to seconds, with current guidance to enable these workflows from the Cloudflare Dashboard and CrowdStrike console.