To automate response actions when a vulnerability is discovered in a container image, CrowdStrike Falcon Fusion uses the triggerKubernetes and containers > Image assessment > Vulnerabilities. This trigger activates when Falcon identifies vulnerabilities during container image scanning and assessment.

Image assessment vulnerabilities occurpre-runtime, making this trigger ideal for shift-left security automation. Actions such as sending notifications, opening tickets, tagging images, or blocking deployments via policy enforcement can be automatically initiated before vulnerable images reach production.

TheContainer detectionstrigger applies to runtime events, not image vulnerabilities.Vulnerabilities user actiontriggers depend on manual interaction and are not suitable for automated detection-driven workflows.

By using the image assessment vulnerability trigger, organizations can integrate Falcon Cloud Security findings directly into CI/CD pipelines and remediation workflows, ensuring faster response and reduced risk exposure.

Therefore, the correct Fusion workflow trigger isKubernetes and containers > Image assessment > Vulnerabilities.