CrowdStrike Falcon Fusion SOAR
CrowdStrike Falcon Fusion SOAR is no-code workflow automation inside the Falcon platform, and Charlotte Agentic SOAR adds agents with autonomy set per workflow. It places fourteenth of 14 at 3.49, because the pages read name no containment action, 0 of 25, and give no time-to-contain figure.
What CrowdStrike Falcon Fusion SOAR is
Falcon Fusion offers ready-made templates, a visual builder, Charlotte AI help to turn an idea into a workflow, and native case management (crowdstrike.com/en-us/platform/next-gen-siem/falcon-fusion, read 2026-11-03, vendor claim). Charlotte Agentic SOAR is described as one workspace combining AI agents, rule-based workflows and custom apps.
The brief's original Falcon Fusion SOAR URL returned 404 on 2026-11-03. The pages do not say whether Falcon Fusion and Charlotte Agentic SOAR are one product or two, and do not say whether Falcon Fusion comes with Next-Gen SIEM.
vendor claim Falcon Fusion is CrowdStrike's no-code workflow automation inside the Falcon platform, with templates, a visual builder, case management and Charlotte AI help. CrowdStrike now also markets Charlotte Agentic SOAR, a workspace that mixes AI agents, rule-based workflows and custom apps across its tools. crowdstrike.com, read
Products named: Falcon Fusion, Charlotte Agentic SOAR, Falcon Next-Gen SIEM.
no figureon the pages read
Published time to contain
No figure on time to contain, or on any adjacent response metric, was found for CrowdStrike Falcon Fusion SOAR on the pages read. No Fusion-specific containment figure. The Falcon Complete MDR figure is listed as a service.
0 of 250 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, CrowdStrike Falcon Fusion SOAR documents 0 as native or partner on the pages read: 0 native, 0 partner, 0 custom step only, 25 not documented. Coverage share is 0 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| CrowdStrike Falcon Fusion SOAR0 of 25 documented, docs behind login | CrowdStrike Falcon Fusion SOAR: Isolate host, not documented | CrowdStrike Falcon Fusion SOAR: Release isolation, not documented | CrowdStrike Falcon Fusion SOAR: Kill process, not documented | CrowdStrike Falcon Fusion SOAR: Quarantine file, not documented | CrowdStrike Falcon Fusion SOAR: Run script or live response, not documented | CrowdStrike Falcon Fusion SOAR: Block hash, not documented | CrowdStrike Falcon Fusion SOAR: Disable user, not documented | CrowdStrike Falcon Fusion SOAR: Force password reset, not documented | CrowdStrike Falcon Fusion SOAR: Revoke sessions or tokens, not documented | CrowdStrike Falcon Fusion SOAR: Require MFA re-enrolment, not documented | CrowdStrike Falcon Fusion SOAR: Remove from group or role, not documented | CrowdStrike Falcon Fusion SOAR: Delete a delivered message, not documented | CrowdStrike Falcon Fusion SOAR: Quarantine a delivered message, not documented | CrowdStrike Falcon Fusion SOAR: Block sender or domain, not documented | CrowdStrike Falcon Fusion SOAR: Remove a URL rewrite exemption, not documented | CrowdStrike Falcon Fusion SOAR: Pull from quarantine, not documented | CrowdStrike Falcon Fusion SOAR: Disable IAM user or access key, not documented | CrowdStrike Falcon Fusion SOAR: Revoke cloud session, not documented | CrowdStrike Falcon Fusion SOAR: Isolate or stop an instance, not documented | CrowdStrike Falcon Fusion SOAR: Change a security group or firewall rule, not documented | CrowdStrike Falcon Fusion SOAR: Revoke OAuth app consent, not documented | CrowdStrike Falcon Fusion SOAR: Block IP or domain at the firewall, not documented | CrowdStrike Falcon Fusion SOAR: Block at the proxy or DNS filter, not documented | CrowdStrike Falcon Fusion SOAR: Disable a switch port or NAC quarantine, not documented | CrowdStrike Falcon Fusion SOAR: Add to a threat list on the NDR, not documented |
Basis: Public CrowdStrike pages only. The Fusion workflow action catalogue is inside the Falcon console documentation, which requires a login. Third-party docs (XSOAR, Splunk, Torq) document CrowdStrike host containment through the Falcon API, not Fusion actions, so they were not used for this row. Read 2026-11-04.
Limits: Docs gated behind login. Scores understate capability. Third hardest to read.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
3.49rank 14 of 14
Rubric scores
CrowdStrike Falcon Fusion SOAR sits alone in its band: no other platform is within 0.25 of its total.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 2.0 | 0.500 | not documented. 0 of 25 containment actions documented as native or partner (0 percent) across 0 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 3.5 | 0.525 | not documented. The 2025-11-05 announcement states "stopping breaches at machine speed" and gives no figure. vendor claim crowdstrike.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 4.0 | 0.600 | not documented. Release says agents act "under analyst command" and analysts set boundaries; no approval workflow is described. vendor claim crowdstrike.com, read |
| Explanation and audit trail | 15 | 3.5 | 0.525 | not documented. Audit trail is not mentioned in the release. crowdstrike.com, read |
| Integration depth documented | 10 | 4.0 | 0.400 | not documented. Release says it coordinates CrowdStrike, custom and third-party agents; no count or list. crowdstrike.com, read |
| Detection-to-response coupling | 8 | 6.5 | 0.520 | partial. Release describes orchestration across "prevention, detection, investigation, and response" within the Falcon platform; direct ingestion is implied, not stated. vendor claim crowdstrike.com, read |
| Pricing transparency | 6 | 3.0 | 0.180 | not documented. No price stated. crowdstrike.com, read |
| Deployment and data handling | 6 | 4.0 | 0.240 | not documented. Release gives no availability or deployment detail and carries a forward-looking disclaimer. crowdstrike.com, read |
| Total | 100 | 3.49 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where CrowdStrike Falcon Fusion SOAR is strong
- Vendor claim: autonomy can be set per workflow, from human approval to fully autonomous, and every agent action and workflow run is logged. This is a stated control and a stated record, without detail of either. crowdstrike.com, read
- Vendor claim: Falcon Fusion runs inside the Falcon platform with native case management, and Next-Gen SIEM can be bought standalone and analyses third-party data without other Falcon modules. crowdstrike.com, read
- The Agentic SOAR page offers a free trial for 15 days, so a team on the Falcon platform can test it without a purchase. crowdstrike.com, read
Where CrowdStrike Falcon Fusion SOAR is behind
- Time-to-contain evidence: none. The 2025-11-05 announcement says stopping breaches at machine speed and gives no figure. The Falcon Fusion page claims 75 hours a month saved by automating 900 false positives at one healthcare organisation, which is time saved, not containment. crowdstrike.com, read
- Neither the Falcon Fusion page nor the Agentic SOAR page names a containment, isolation, disable-user or block action. Built-in connectors are described only as spanning identity, cloud, network, ITSM and collaboration tools. crowdstrike.com, read
- The release says agents act under analyst command with boundaries set by analysts, but describes no approval workflow. It carries a forward-looking disclaimer and no availability or deployment detail. crowdstrike.com, read
What only CrowdStrike Falcon Fusion SOAR has
CrowdStrike lists Next-Gen SIEM as a feature in its Falcon Go, Pro and Enterprise bundles with no separate price, and sells Falcon Complete add-ons through sales. crowdstrike.com, read
nonelisted
Pricing as published
vendor claim No price for Falcon Fusion or Agentic SOAR on the pages read. Next-Gen SIEM appears as a feature in Falcon Go, Pro and Enterprise bundles with no separate price. Falcon Complete add-ons are sold through sales. Add-on prices vary by bundle. crowdstrike.com, read
Trial or free tier. Free trial for 15 days, per the Agentic SOAR page and the site's trial offer. crowdstrike.com, read
Integrations. No count published; named: Microsoft Defender (third-party EDR support for Next-Gen SIEM, starting with Defender). vendor claim crowdstrike.com, read
3names on its pages
Named customers
Customers below are names on CrowdStrike Falcon Fusion SOAR's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- HEUKING, TaylorMade Golf, Porter Airlines. crowdstrike.com, read
3graded
Claims CrowdStrike Falcon Fusion SOAR makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| A healthcare organisation saved 75 hours per month by automating 900 false positives | one healthcare organisation. Measured by vendor. | C | vendor claim crowdstrike.com, read |
| 70 percent customer efficiency improvement with workflow automation | aggregate of Falcon Insight XDR customers (size not stated). Measured by vendor. | C | vendor claim crowdstrike.com, read |
| Next-Gen SIEM reduces three-year cost by 80 percent versus legacy SIEM | pre-sale customer metrics, not described. Measured by vendor. | D | vendor claim crowdstrike.com, read |
Who should shortlist CrowdStrike Falcon Fusion SOAR
- Your endpoint estate is CrowdStrike and you want workflow automation inside the same console.
- You will confirm the native host containment actions in a pilot, since the pages read list none.
- You want to try autonomy per workflow on a 15-day trial.
CrowdStrike Falcon Fusion SOAR places 14th of 14 at a total of 3.49, with 0 of 25 containment actions documented. The last place reflects thin public pages, not a finding that the product lacks actions: the pages read name none of the 25 containment actions. A buyer on the Falcon platform should ask CrowdStrike for the action list before ranking it, and a documented list would move its place.
The same platform under other weights
- Regulated financial: 14th of 14, total 3.51.
- Lean team: 14th of 14, total 3.52.
- MSSP: 14th of 14, total 3.44.
- Microsoft estate: 14th of 14, total 3.70.
- CrowdStrike estate: 14th of 14, total 3.64.
Compare CrowdStrike Falcon Fusion SOAR
- CrowdStrike Falcon Fusion SOAR alternatives: 3 gaps and 5 platforms that answer them.
- CrowdStrike Falcon Fusion SOAR against ServiceNow Security Operations, totals 3.49 and 4.16.
- CrowdStrike Falcon Fusion SOAR against Prophet Security, totals 3.49 and 4.87.
- CrowdStrike Falcon Fusion SOAR against Mate Security, totals 3.49 and 4.87.
- CrowdStrike Falcon Fusion SOAR against Dropzone AI, totals 3.49 and 5.00.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.