From 6bccbb5a503c04134aff527469f7760f4affce6f Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Sat, 27 Jun 2026 10:38:09 +0200 Subject: [PATCH] feat(integrations): declare default ingestion (command, mapper, default type) cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block (fetch command + bundled mapper + default incident type) and a bundled default incident type under incident-types/, so the instance Collect section is pre-filled on first configuration and the default type is created on install. Co-Authored-By: Claude Opus 4.8 --- .../cortex-xdr/incident-types/cortex-xdr-incident.yaml | 3 +++ integrations/cortex-xdr/manifest.yaml | 5 +++++ .../crowdstrike/incident-types/crowdstrike-detection.yaml | 3 +++ integrations/crowdstrike/manifest.yaml | 5 +++++ .../harfanglab/incident-types/harfanglab-threat.yaml | 3 +++ integrations/harfanglab/manifest.yaml | 5 +++++ integrations/splunk/incident-types/splunk-notable.yaml | 3 +++ integrations/splunk/manifest.yaml | 5 +++++ 8 files changed, 32 insertions(+) create mode 100644 integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml create mode 100644 integrations/crowdstrike/incident-types/crowdstrike-detection.yaml create mode 100644 integrations/harfanglab/incident-types/harfanglab-threat.yaml create mode 100644 integrations/splunk/incident-types/splunk-notable.yaml diff --git a/integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml b/integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml new file mode 100644 index 0000000..e023bdf --- /dev/null +++ b/integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml @@ -0,0 +1,3 @@ +name: "Cortex XDR Incident" +color: "#00b4d8" +icon: "alert" diff --git a/integrations/cortex-xdr/manifest.yaml b/integrations/cortex-xdr/manifest.yaml index d92b7e5..521b116 100644 --- a/integrations/cortex-xdr/manifest.yaml +++ b/integrations/cortex-xdr/manifest.yaml @@ -541,3 +541,8 @@ commands: properties: {} required: [] outputs_schema: { properties: {} } + +ingestion: + command: get_incidents + mapper: get_incidents + default_incident_type: "Cortex XDR Incident" diff --git a/integrations/crowdstrike/incident-types/crowdstrike-detection.yaml b/integrations/crowdstrike/incident-types/crowdstrike-detection.yaml new file mode 100644 index 0000000..e32a491 --- /dev/null +++ b/integrations/crowdstrike/incident-types/crowdstrike-detection.yaml @@ -0,0 +1,3 @@ +name: "CrowdStrike Detection" +color: "#e63946" +icon: "shield" diff --git a/integrations/crowdstrike/manifest.yaml b/integrations/crowdstrike/manifest.yaml index 89be04d..af9019f 100644 --- a/integrations/crowdstrike/manifest.yaml +++ b/integrations/crowdstrike/manifest.yaml @@ -1046,3 +1046,8 @@ commands: properties: {} required: [] outputs_schema: { properties: {} } + +ingestion: + command: search_detections + mapper: search_detections + default_incident_type: "CrowdStrike Detection" diff --git a/integrations/harfanglab/incident-types/harfanglab-threat.yaml b/integrations/harfanglab/incident-types/harfanglab-threat.yaml new file mode 100644 index 0000000..832adfe --- /dev/null +++ b/integrations/harfanglab/incident-types/harfanglab-threat.yaml @@ -0,0 +1,3 @@ +name: "HarfangLab Threat" +color: "#f4a261" +icon: "alert" diff --git a/integrations/harfanglab/manifest.yaml b/integrations/harfanglab/manifest.yaml index 5910bce..3862ac0 100644 --- a/integrations/harfanglab/manifest.yaml +++ b/integrations/harfanglab/manifest.yaml @@ -742,3 +742,8 @@ commands: properties: {} required: [] outputs_schema: { properties: {} } + +ingestion: + command: get_threats + mapper: get_threats + default_incident_type: "HarfangLab Threat" diff --git a/integrations/splunk/incident-types/splunk-notable.yaml b/integrations/splunk/incident-types/splunk-notable.yaml new file mode 100644 index 0000000..7ec2fe1 --- /dev/null +++ b/integrations/splunk/incident-types/splunk-notable.yaml @@ -0,0 +1,3 @@ +name: "Splunk Notable" +color: "#65a30d" +icon: "alert" diff --git a/integrations/splunk/manifest.yaml b/integrations/splunk/manifest.yaml index c4ed970..ada552a 100644 --- a/integrations/splunk/manifest.yaml +++ b/integrations/splunk/manifest.yaml @@ -277,3 +277,8 @@ commands: properties: {} required: [] outputs_schema: { properties: {} } + +ingestion: + command: search + mapper: search + default_incident_type: "Splunk Notable"