diff --git a/integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml b/integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml
new file mode 100644
index 0000000..e023bdf
--- /dev/null
+++ b/integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml
@@ -0,0 +1,3 @@
+name: "Cortex XDR Incident"
+color: "#00b4d8"
+icon: "alert"
diff --git a/integrations/cortex-xdr/manifest.yaml b/integrations/cortex-xdr/manifest.yaml
index d92b7e5..521b116 100644
--- a/integrations/cortex-xdr/manifest.yaml
+++ b/integrations/cortex-xdr/manifest.yaml
@@ -541,3 +541,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_incidents
+  mapper: get_incidents
+  default_incident_type: "Cortex XDR Incident"
diff --git a/integrations/crowdstrike/incident-types/crowdstrike-detection.yaml b/integrations/crowdstrike/incident-types/crowdstrike-detection.yaml
new file mode 100644
index 0000000..e32a491
--- /dev/null
+++ b/integrations/crowdstrike/incident-types/crowdstrike-detection.yaml
@@ -0,0 +1,3 @@
+name: "CrowdStrike Detection"
+color: "#e63946"
+icon: "shield"
diff --git a/integrations/crowdstrike/manifest.yaml b/integrations/crowdstrike/manifest.yaml
index 89be04d..af9019f 100644
--- a/integrations/crowdstrike/manifest.yaml
+++ b/integrations/crowdstrike/manifest.yaml
@@ -1046,3 +1046,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: search_detections
+  mapper: search_detections
+  default_incident_type: "CrowdStrike Detection"
diff --git a/integrations/harfanglab/incident-types/harfanglab-threat.yaml b/integrations/harfanglab/incident-types/harfanglab-threat.yaml
new file mode 100644
index 0000000..832adfe
--- /dev/null
+++ b/integrations/harfanglab/incident-types/harfanglab-threat.yaml
@@ -0,0 +1,3 @@
+name: "HarfangLab Threat"
+color: "#f4a261"
+icon: "alert"
diff --git a/integrations/harfanglab/manifest.yaml b/integrations/harfanglab/manifest.yaml
index 5910bce..3862ac0 100644
--- a/integrations/harfanglab/manifest.yaml
+++ b/integrations/harfanglab/manifest.yaml
@@ -742,3 +742,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_threats
+  mapper: get_threats
+  default_incident_type: "HarfangLab Threat"
diff --git a/integrations/splunk/incident-types/splunk-notable.yaml b/integrations/splunk/incident-types/splunk-notable.yaml
new file mode 100644
index 0000000..7ec2fe1
--- /dev/null
+++ b/integrations/splunk/incident-types/splunk-notable.yaml
@@ -0,0 +1,3 @@
+name: "Splunk Notable"
+color: "#65a30d"
+icon: "alert"
diff --git a/integrations/splunk/manifest.yaml b/integrations/splunk/manifest.yaml
index c4ed970..ada552a 100644
--- a/integrations/splunk/manifest.yaml
+++ b/integrations/splunk/manifest.yaml
@@ -277,3 +277,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: search
+  mapper: search
+  default_incident_type: "Splunk Notable"