feat: add test_connection command to all integrations for the instance Test button

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/crowdstrike/manifest.yaml

@@ -1,8 +1,8 @@
 id: crowdstrike
 name: CrowdStrike Falcon
-version: 1.1.0
+version: 1.1.1
 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
-changelog: "1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
+changelog: "1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
 category: endpoint
 
 # Per-instance configuration. Scripts obtain an OAuth2 bearer token from
@@ -1033,3 +1033,13 @@ commands:
         email: { type: string, description: "Optional filter by email address (informational; include in query if supported)." }
       required: [type]
     outputs_schema: { properties: {} }
+
+  # ── Connectivity test ─────────────────────────────────────────────────────
+  - id: test_connection
+    name: crowdstrike-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/crowdstrike/scripts/test_connection.py

@@ -0,0 +1,32 @@
+import json, os, sys, urllib.request, urllib.parse, urllib.error
+
+SECRETS = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+INPUTS = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+BASE = SECRETS.get("base_url", "https://api.crowdstrike.com").rstrip("/")
+
+
+def token():
+    data = urllib.parse.urlencode({"client_id": SECRETS.get("client_id", ""), "client_secret": SECRETS.get("client_secret", "")}).encode()
+    req = urllib.request.Request(BASE + "/oauth2/token", data=data, headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"}, method="POST")
+    with urllib.request.urlopen(req, timeout=30) as r:
+        return json.loads(r.read()).get("access_token", "")
+
+
+def main():
+    # Acquiring the OAuth2 token validates client_id/client_secret: bad
+    # credentials make the exchange fail (HTTPError -> exit 1).
+    tok = token()
+    if not tok:
+        print(json.dumps({"ok": False, "error": "No access token returned"}))
+        sys.exit(1)
+    print(json.dumps({"ok": True, "authenticated": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)