You are setting up a Falcon Fusion SOAR workflow to notify your team when any...

To notify your team when anew executable is downloaded and executed inside a running container, you must use aruntime-focused triggerin Falcon Fusion. The correct selection isContainer detection > Container runtime detection.

Container runtime detections monitor live container behavior, including process execution, file writes, network activity, and binary downloads. When an executable is introduced and run at runtime, this represents potential malicious activity or policy violation that cannot be detected during image assessment.

Image Assessmenttriggers apply only to pre-runtime image scanning and cannot detect runtime execution.Container drift detectionfocuses on changes to container state relative to the original image but does not specifically target execution-based detections.

CrowdStrike Falcon Cloud Security documentation clearly distinguishes runtime detections as the correct signal source for SOAR automation involving live container behavior. Therefore, the correct trigger configuration isContainer detection > Container runtime detection.