CrowdStrike SOAR only run trigger after a condition is met

For CrowdStrike SOAR, if you have the same trigger configured multiple times and the first node is a true/false check, that workflow will only run if that first step is true. This is not documented and makes it so you can, for example, have 10 workflows for Detection > NG-SIEM Detection where the first step is “Is vendor X” and only the workflow for vendor X will run.

Get HanSolo71’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

It looks like this in the workflow:

The first step has CEL like this in it:

data['Trigger.Detection.NGSIEM.SourceVendors'] != null &&
size(data['Trigger.Detection.NGSIEM.SourceVendors']) > 0 &&
data['Trigger.Detection.NGSIEM.SourceVendors'].exists(v, v.lowerAscii() == 'aws')