fix(crowdstrike): map severity and the MTTD anchor in search_detections (v1.2.4)

Two silent defects in the search_detections OCSF mapper.

Severity was a four-branch ternary that resolved to nothing, so every
ingested alert kept the alert rule's default severity instead of Falcon's
— a Low arrived as Medium and a Critical arrived as Medium too. It is now
a plain path to severity_name, whose words the ingestion engine reads
natively. (The ternary form is also repaired upstream, but a plain path is
simpler to read and to correct.)

No entry fed the OCSF `time` field, which is the only field the engine
reads to stamp detected_at. Incidents were anchored at ingestion instead
of at detection, so MTTD measured the collection delay as zero — over a
day on a slow poll. finding_info.created_time carries the same instant but
is read by nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/crowdstrike/mappers/search_detections.yaml

@@ -2,7 +2,11 @@ name: "CrowdStrike Falcon Alerts → OCSF"
 description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Field paths validated against the Falcon Raptor alert schema. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*."
 field_mappings:
   title: "name"
-  severity: "severity_name = 'Critical' ? 5 : (severity_name = 'High' ? 4 : (severity_name = 'Medium' ? 3 : 2))"
+  # A plain path, not a ternary: the ingestion engine reads the words
+  # informational/low/medium/high/critical natively, so Falcon's severity_name
+  # needs no translation. This was a four-branch ternary that resolved to nothing
+  # and left every alert on the rule's default severity, whatever Falcon said.
+  severity: "severity_name"
   description: "description"
 # results_path = resources; source_path is JSONata over ONE alert object.
 # Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
@@ -23,6 +27,12 @@ ocsf:
   - { source_path: "name",               ocsf_field: "finding_info.title" }
   - { source_path: "description",        ocsf_field: "finding_info.desc" }
   - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
+  # `time` is the MTTD anchor: the ingestion engine reads THIS field and no other
+  # to stamp detected_at. Without it the incident is anchored at ingestion, so the
+  # delay between Falcon detecting and Riposte collecting — over a day on a slow
+  # poll — is measured as zero. finding_info.created_time below does NOT serve
+  # this: it is the finding's own record of the same instant, read by nothing.
+  - { source_path: "created_timestamp",  ocsf_field: "time" }
   - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }
   - { source_path: "pattern_id",         ocsf_field: "finding_info.analytic.uid" }