Custom IOA rules are defined using which syntax?

What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?

Which role is required to manage groups and policies in Falcon?

Where can you modify settings to permit certain traffic during a containment period?

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?