diff --git a/integrations/crowdstrike/manifest.yaml b/integrations/crowdstrike/manifest.yaml
index af9019f..c48793a 100644
--- a/integrations/crowdstrike/manifest.yaml
+++ b/integrations/crowdstrike/manifest.yaml
@@ -1,8 +1,8 @@
 id: crowdstrike
 name: CrowdStrike Falcon
-version: 1.2.3
+version: 1.2.4
 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
-changelog: "1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
+changelog: "1.2.4 — Fixed two silent defects in the search_detections OCSF mapper: severity was a ternary that resolved to nothing, so every alert kept the alert rule's default severity instead of Falcon's — it is now a plain path to severity_name, whose words the engine reads natively; and no entry fed the OCSF `time` field, so detected_at was never stamped and MTTD measured the collection delay as zero. 1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
 category: endpoint
 
 # Per-instance configuration. Scripts obtain an OAuth2 bearer token from
diff --git a/integrations/crowdstrike/mappers/search_detections.yaml b/integrations/crowdstrike/mappers/search_detections.yaml
index cfc2454..d0901ab 100644
--- a/integrations/crowdstrike/mappers/search_detections.yaml
+++ b/integrations/crowdstrike/mappers/search_detections.yaml
@@ -2,7 +2,11 @@ name: "CrowdStrike Falcon Alerts → OCSF"
 description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Field paths validated against the Falcon Raptor alert schema. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*."
 field_mappings:
   title: "name"
-  severity: "severity_name = 'Critical' ? 5 : (severity_name = 'High' ? 4 : (severity_name = 'Medium' ? 3 : 2))"
+  # A plain path, not a ternary: the ingestion engine reads the words
+  # informational/low/medium/high/critical natively, so Falcon's severity_name
+  # needs no translation. This was a four-branch ternary that resolved to nothing
+  # and left every alert on the rule's default severity, whatever Falcon said.
+  severity: "severity_name"
   description: "description"
 # results_path = resources; source_path is JSONata over ONE alert object.
 # Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
@@ -23,6 +27,12 @@ ocsf:
   - { source_path: "name",               ocsf_field: "finding_info.title" }
   - { source_path: "description",        ocsf_field: "finding_info.desc" }
   - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
+  # `time` is the MTTD anchor: the ingestion engine reads THIS field and no other
+  # to stamp detected_at. Without it the incident is anchored at ingestion, so the
+  # delay between Falcon detecting and Riposte collecting — over a day on a slow
+  # poll — is measured as zero. finding_info.created_time below does NOT serve
+  # this: it is the finding's own record of the same instant, read by nothing.
+  - { source_path: "created_timestamp",  ocsf_field: "time" }
   - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }
   - { source_path: "pattern_id",         ocsf_field: "finding_info.analytic.uid" }