From 44694f6d9e307420d0613114bfeeb292d64331f7 Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Fri, 26 Jun 2026 14:44:25 +0200 Subject: [PATCH] fix(crowdstrike): correct search_detections OCSF mapper against Raptor alert schema Co-Authored-By: Claude Opus 4.8 --- integrations/crowdstrike/manifest.yaml | 4 +- .../mappers/search_detections.yaml | 44 +++++++++---------- 2 files changed, 22 insertions(+), 26 deletions(-) diff --git a/integrations/crowdstrike/manifest.yaml b/integrations/crowdstrike/manifest.yaml index d60e617..3a37f34 100644 --- a/integrations/crowdstrike/manifest.yaml +++ b/integrations/crowdstrike/manifest.yaml @@ -1,8 +1,8 @@ id: crowdstrike name: CrowdStrike Falcon -version: 1.2.1 +version: 1.2.2 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows." -changelog: "1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR." +changelog: "1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR." category: endpoint # Per-instance configuration. Scripts obtain an OAuth2 bearer token from diff --git a/integrations/crowdstrike/mappers/search_detections.yaml b/integrations/crowdstrike/mappers/search_detections.yaml index 75aee0c..10a9e60 100644 --- a/integrations/crowdstrike/mappers/search_detections.yaml +++ b/integrations/crowdstrike/mappers/search_detections.yaml @@ -1,5 +1,5 @@ name: "CrowdStrike Falcon Alerts → OCSF" -description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*." +description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Field paths validated against the XSOAR Raptor key maps. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*." field_mappings: title: "name" severity: "severity_name = 'Critical' ? 5 : (severity_name = 'High' ? 4 : (severity_name = 'Medium' ? 3 : 2))" @@ -9,7 +9,7 @@ field_mappings: ocsf: # ── Endpoint / device ───────────────────────────────────────────── - { source_path: "device.hostname", ocsf_field: "src_endpoint.hostname" } - - { source_path: "device.machine_domain", ocsf_field: "src_endpoint.domain" } + - { source_path: "device.hostinfo.domain", ocsf_field: "src_endpoint.domain" } - { source_path: "device.external_ip", ocsf_field: "src_endpoint.ip" } - { source_path: "device.local_ip", ocsf_field: "device.ip" } - { source_path: "device.os_version", ocsf_field: "src_endpoint.os.name" } @@ -17,17 +17,17 @@ ocsf: - { source_path: "device.mac_address", ocsf_field: "src_endpoint.mac" } - { source_path: "device.device_id", ocsf_field: "device.uid" } - { source_path: "device.agent_version", ocsf_field: "metadata.product.version" } + - { source_path: "device.cid", ocsf_field: "cloud.account.uid" } # ── Finding / analytic ──────────────────────────────────────────── - - { source_path: "composite_id", ocsf_field: "finding_info.uid" } - - { source_path: "name", ocsf_field: "finding_info.title" } - - { source_path: "description", ocsf_field: "finding_info.desc" } - - { source_path: "created_timestamp", ocsf_field: "finding_info.created_time" } - - { source_path: "updated_timestamp", ocsf_field: "finding_info.modified_time" } - - { source_path: "type", ocsf_field: "finding_info.analytic.type" } - - { source_path: "pattern_id", ocsf_field: "finding_info.analytic.uid" } - - { source_path: "confidence", ocsf_field: "confidence" } - - { source_path: "status", ocsf_field: "status" } - - { source_path: "pattern_disposition_description", ocsf_field: "status_detail" } + - { source_path: "composite_id", ocsf_field: "finding_info.uid" } + - { source_path: "name", ocsf_field: "finding_info.title" } + - { source_path: "description", ocsf_field: "finding_info.desc" } + - { source_path: "created_timestamp", ocsf_field: "finding_info.created_time" } + - { source_path: "updated_timestamp", ocsf_field: "finding_info.modified_time" } + - { source_path: "scenario", ocsf_field: "finding_info.analytic.name" } + - { source_path: "pattern_id", ocsf_field: "finding_info.analytic.uid" } + - { source_path: "confidence", ocsf_field: "confidence" } + - { source_path: "status", ocsf_field: "status" } # ── MITRE ATT&CK ────────────────────────────────────────────────── - { source_path: "tactic", ocsf_field: "attacks.tactic.name" } - { source_path: "tactic_id", ocsf_field: "attacks.tactic.uid" } @@ -36,23 +36,19 @@ ocsf: # ── Triggering process — the actor ──────────────────────────────── - { source_path: "filename", ocsf_field: "actor.process.name" } - { source_path: "cmdline", ocsf_field: "actor.process.cmd_line" } - - { source_path: "process_id", ocsf_field: "actor.process.pid" } - { source_path: "filepath", ocsf_field: "actor.process.file.path" } - { source_path: "sha256", ocsf_field: "actor.process.file.hashes.sha256" } - { source_path: "md5", ocsf_field: "actor.process.file.hashes.md5" } - { source_path: "user_name", ocsf_field: "actor.user.name" } - { source_path: "user_id", ocsf_field: "actor.user.uid" } - - { source_path: "logon_domain", ocsf_field: "actor.user.domain" } # ── Parent process ──────────────────────────────────────────────── - - { source_path: "parent_details.filename", ocsf_field: "actor.process.parent_process.name" } - - { source_path: "parent_details.cmdline", ocsf_field: "actor.process.parent_process.cmd_line" } - - { source_path: "parent_details.process_id", ocsf_field: "actor.process.parent_process.pid" } + - { source_path: "parent_details.cmdline", ocsf_field: "actor.process.parent_process.cmd_line" } # ── Detected file — the subject ─────────────────────────────────── - - { source_path: "filename", ocsf_field: "file.name" } - - { source_path: "filepath", ocsf_field: "file.path" } - - { source_path: "sha256", ocsf_field: "file.hashes.sha256" } - - { source_path: "md5", ocsf_field: "file.hashes.md5" } + - { source_path: "filename", ocsf_field: "file.name" } + - { source_path: "filepath", ocsf_field: "file.path" } + - { source_path: "sha256", ocsf_field: "file.hashes.sha256" } + - { source_path: "md5", ocsf_field: "file.hashes.md5" } + - { source_path: "alleged_filetype", ocsf_field: "file.type" } # ── IOC / observable ────────────────────────────────────────────── - - { source_path: "ioc_value", ocsf_field: "observables.value" } - - { source_path: "ioc_type", ocsf_field: "observables.type" } - - { source_path: "ioc_description", ocsf_field: "observables.name" } + - { source_path: "ioc_value", ocsf_field: "observables.value" } + - { source_path: "ioc_type", ocsf_field: "observables.type" }