feat(crowdstrike): set a detection's verdict (1.5.0)

Falcon records a verdict as a tag — true_positive, false_positive or
ignored, which the console's Resolution column reads — and update_status
only takes new, in_progress, reopened and closed, so resolve_detection
had no way to record one. Its new verdict input adds the tag after
removing the other two, add_tag never replacing one; status and verdict
are drop-downs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WhDQSYZd1mFtRsXK4ixtyB

integrations/crowdstrike/scripts/resolve_detection.py

@@ -31,16 +31,38 @@ def csv(v):
     return [x.strip() for x in str(v or "").split(",") if x.strip()]
 
 
+VERDICTS = ("true_positive", "false_positive", "ignored")
+
+
 def main():
     tok = token()
+    ids = csv(INPUTS.get("ids"))
+    verdict = str(INPUTS.get("verdict") or "").strip()
+    if verdict and verdict not in VERDICTS:
+        raise ValueError("verdict must be one of " + ", ".join(VERDICTS) + ", got " + verdict)
     action_params = []
+    if verdict:
+        # The console's Resolution is read from these tags, and add_tag never
+        # replaces one: drop the other two first, or a false positive turned
+        # true positive would show both. Removing a tag the alert does not
+        # carry is not an error worth stopping for — the add below is the call
+        # that has to land.
+        for other in VERDICTS:
+            if other == verdict:
+                continue
+            try:
+                call("PATCH", "/alerts/entities/alerts/v3", tok,
+                     body={"action_parameters": [{"name": "remove_tag", "value": other}], "composite_ids": ids})
+            except urllib.error.HTTPError:
+                pass
+        action_params.append({"name": "add_tag", "value": verdict})
     if INPUTS.get("status"):
         action_params.append({"name": "update_status", "value": str(INPUTS["status"])})
     if INPUTS.get("comment"):
         action_params.append({"name": "append_comment", "value": str(INPUTS["comment"])})
     if INPUTS.get("assign_to_uuid"):
         action_params.append({"name": "assign_to_uuid", "value": str(INPUTS["assign_to_uuid"])})
-    body = {"action_parameters": action_params, "composite_ids": csv(INPUTS.get("ids"))}
+    body = {"action_parameters": action_params, "composite_ids": ids}
     result = call("PATCH", "/alerts/entities/alerts/v3", tok, body=body)
     print(json.dumps(result))