Invoke FalconWorkflow - CrowdStrike/psfalcon GitHub Wiki
Execute an on-demand Falcon Fusion SOAR workflow
Requires 'Workflow: Write'.
| Name | Type | Description | Min | Max | Allowed | Pipeline | PipelineByName |
|---|---|---|---|---|---|---|---|
| Cid | String[] | Target CID. Child CIDs are supported in Flight Control environments. | |||||
| Key | String | Optional UUID used to help de-duplicate executions | |||||
| Depth | Int32 | Execution depth limit to help prevent execution loops from multiple workflow triggers | 1 |
4 |
|||
| SourceEventUrl | String | Optional source URL for auditing | |||||
| Json | String | Json string to define workflow trigger key/value pairs | |||||
| Name | String | Workflow name | X | ||||
| Id | String[] | Workflow identifier | X | X |
Invoke-FalconWorkflow [[-Cid] <String[]>] [[-Key] <String>] [[-Depth] <Int32>] [[-SourceEventUrl] <String>] -Json <String> -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]Invoke-FalconWorkflow [[-Cid] <String[]>] [[-Key] <String>] [[-Depth] <Int32>] [[-SourceEventUrl] <String>] -Json <String> -Name <String> [-WhatIf] [-Confirm] [<CommonParameters>]POST /workflows/entities/execute/v1
2025-09-19: PSFalcon v2.2.9
