feat(integrations): declare default ingestion (command, mapper, default type)

cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block
(fetch command + bundled mapper + default incident type) and a bundled default
incident type under incident-types/, so the instance Collect section is pre-filled
on first configuration and the default type is created on install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/cortex-xdr/incident-types/cortex-xdr-incident.yaml

@@ -0,0 +1,3 @@
+name: "Cortex XDR Incident"
+color: "#00b4d8"
+icon: "alert"

integrations/cortex-xdr/manifest.yaml

@@ -541,3 +541,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_incidents
+  mapper: get_incidents
+  default_incident_type: "Cortex XDR Incident"

integrations/crowdstrike/incident-types/crowdstrike-detection.yaml

@@ -0,0 +1,3 @@
+name: "CrowdStrike Detection"
+color: "#e63946"
+icon: "shield"

integrations/crowdstrike/manifest.yaml

@@ -1046,3 +1046,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: search_detections
+  mapper: search_detections
+  default_incident_type: "CrowdStrike Detection"

integrations/harfanglab/incident-types/harfanglab-threat.yaml

@@ -0,0 +1,3 @@
+name: "HarfangLab Threat"
+color: "#f4a261"
+icon: "alert"

integrations/harfanglab/manifest.yaml

@@ -742,3 +742,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_threats
+  mapper: get_threats
+  default_incident_type: "HarfangLab Threat"

integrations/splunk/incident-types/splunk-notable.yaml

@@ -0,0 +1,3 @@
+name: "Splunk Notable"
+color: "#65a30d"
+icon: "alert"

integrations/splunk/manifest.yaml

@@ -277,3 +277,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: search
+  mapper: search
+  default_incident_type: "Splunk Notable"