f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(crowdstrike): mark search_detections as ingestion source (ingest hints)

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-26 14:41:02 +02:00
parent 2c4d40103e
commit 096fa21808
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/crowdstrike/manifest.yaml
+7 -4
View File
@@ -1,8 +1,8 @@
id: crowdstrike id: crowdstrike
name: CrowdStrike Falcon name: CrowdStrike Falcon
version: 1.2.0 version: 1.2.1
description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows." description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
changelog: "1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR." changelog: "1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
category: endpoint category: endpoint
# Per-instance configuration. Scripts obtain an OAuth2 bearer token from # Per-instance configuration. Scripts obtain an OAuth2 bearer token from
@@ -70,14 +70,17 @@ commands:
- id: search_detections - id: search_detections
name: crowdstrike-search-detections name: crowdstrike-search-detections
description: "Search detections/alerts using an FQL filter; returns full alert entities for matches." description: "Search detections/alerts using an FQL filter; returns full alert entities for matches. Use as an alert rule ingestion source (results path: resources)."
risk: read risk: read
inputs_schema: inputs_schema:
properties: properties:
filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\")." } filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\"). For incremental fetch add e.g. created_timestamp:>'<ISO8601>'." }
limit: { type: number, description: "Max alerts to return (default 50)." } limit: { type: number, description: "Max alerts to return (default 50)." }
required: [] required: []
outputs_schema: { properties: {} } outputs_schema: { properties: {} }
ingest:
results_path: resources
dedup_key: composite_id
- id: list_host_groups - id: list_host_groups
name: crowdstrike-list-host-groups name: crowdstrike-list-host-groups