From 096fa2180812a29a11480398584be53a146e64bf Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Fri, 26 Jun 2026 14:41:02 +0200 Subject: [PATCH] feat(crowdstrike): mark search_detections as ingestion source (ingest hints) Co-Authored-By: Claude Opus 4.8 --- integrations/crowdstrike/manifest.yaml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/integrations/crowdstrike/manifest.yaml b/integrations/crowdstrike/manifest.yaml index ae5f730..d60e617 100644 --- a/integrations/crowdstrike/manifest.yaml +++ b/integrations/crowdstrike/manifest.yaml @@ -1,8 +1,8 @@ id: crowdstrike name: CrowdStrike Falcon -version: 1.2.0 +version: 1.2.1 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows." -changelog: "1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR." +changelog: "1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR." category: endpoint # Per-instance configuration. Scripts obtain an OAuth2 bearer token from @@ -70,14 +70,17 @@ commands: - id: search_detections name: crowdstrike-search-detections - description: "Search detections/alerts using an FQL filter; returns full alert entities for matches." + description: "Search detections/alerts using an FQL filter; returns full alert entities for matches. Use as an alert rule ingestion source (results path: resources)." risk: read inputs_schema: properties: - filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\")." } + filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\"). For incremental fetch add e.g. created_timestamp:>''." } limit: { type: number, description: "Max alerts to return (default 50)." } required: [] outputs_schema: { properties: {} } + ingest: + results_path: resources + dedup_key: composite_id - id: list_host_groups name: crowdstrike-list-host-groups