fix(crowdstrike): NG-SIEM detections are filed under thirdparty (1.6.2)

Browse Source

On a real tenant the Unified Detections raised from ingested FortiGate
logs are product 'thirdparty'; 'ngsiem' matched nothing. The command now
reads thirdparty and ngsiem by default (products input), and its mapper
is rewritten from real payloads: source product/vendor, matched host,
connection endpoints and ports, vendor signature id, Falcon priority,
console link, and a description built from what fired on which connection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VBnLYwQbUCaf5vpv77N14Q

...

This commit is contained in:

Guillaume BOURGEOIS

2026-10-15 08:32:36 +00:00

parent f34c87f0c8

commit 8eed7ed9fb

3 changed files with 43 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

integrations/crowdstrike/manifest.yaml

+5 -4

File diff suppressed because one or more lines are too long