fix(crowdstrike): map severity and the MTTD anchor in search_detections (v1.2.4)

Two silent defects in the search_detections OCSF mapper.

Severity was a four-branch ternary that resolved to nothing, so every
ingested alert kept the alert rule's default severity instead of Falcon's
— a Low arrived as Medium and a Critical arrived as Medium too. It is now
a plain path to severity_name, whose words the ingestion engine reads
natively. (The ternary form is also repaired upstream, but a plain path is
simpler to read and to correct.)

No entry fed the OCSF `time` field, which is the only field the engine
reads to stamp detected_at. Incidents were anchored at ingestion instead
of at detection, so MTTD measured the collection delay as zero — over a
day on a slow poll. finding_info.created_time carries the same instant but
is read by nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

integrations/crowdstrike/manifest.yaml

@@ -1,8 +1,8 @@
 id: crowdstrike
 name: CrowdStrike Falcon
-version: 1.2.3
+version: 1.2.4
 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
-changelog: "1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
+changelog: "1.2.4 — Fixed two silent defects in the search_detections OCSF mapper: severity was a ternary that resolved to nothing, so every alert kept the alert rule's default severity instead of Falcon's — it is now a plain path to severity_name, whose words the engine reads natively; and no entry fed the OCSF `time` field, so detected_at was never stamped and MTTD measured the collection delay as zero. 1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
 category: endpoint
 
 # Per-instance configuration. Scripts obtain an OAuth2 bearer token from

integrations/crowdstrike/mappers/search_detections.yaml

@@ -2,7 +2,11 @@ name: "CrowdStrike Falcon Alerts → OCSF"
 description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Field paths validated against the Falcon Raptor alert schema. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*."
 field_mappings:
   title: "name"
-  severity: "severity_name = 'Critical' ? 5 : (severity_name = 'High' ? 4 : (severity_name = 'Medium' ? 3 : 2))"
+  # A plain path, not a ternary: the ingestion engine reads the words
+  # informational/low/medium/high/critical natively, so Falcon's severity_name
+  # needs no translation. This was a four-branch ternary that resolved to nothing
+  # and left every alert on the rule's default severity, whatever Falcon said.
+  severity: "severity_name"
   description: "description"
 # results_path = resources; source_path is JSONata over ONE alert object.
 # Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
@@ -23,6 +27,12 @@ ocsf:
   - { source_path: "name",               ocsf_field: "finding_info.title" }
   - { source_path: "description",        ocsf_field: "finding_info.desc" }
   - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
+  # `time` is the MTTD anchor: the ingestion engine reads THIS field and no other
+  # to stamp detected_at. Without it the incident is anchored at ingestion, so the
+  # delay between Falcon detecting and Riposte collecting — over a day on a slow
+  # poll — is measured as zero. finding_info.created_time below does NOT serve
+  # this: it is the finding's own record of the same instant, read by nothing.
+  - { source_path: "created_timestamp",  ocsf_field: "time" }
   - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }
   - { source_path: "pattern_id",         ocsf_field: "finding_info.analytic.uid" }