fix(crowdstrike): NG-SIEM detections are filed under thirdparty (1.6.2)

On a real tenant the Unified Detections raised from ingested FortiGate
logs are product 'thirdparty'; 'ngsiem' matched nothing. The command now
reads thirdparty and ngsiem by default (products input), and its mapper
is rewritten from real payloads: source product/vendor, matched host,
connection endpoints and ports, vendor signature id, Falcon priority,
console link, and a description built from what fired on which connection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VBnLYwQbUCaf5vpv77N14Q

integrations/crowdstrike/scripts/search_ngsiem_detections.py

@@ -33,10 +33,14 @@ def csv(v):
 
 def main():
     tok = token()
-    # Next-Gen SIEM correlation rules raise their detections in the same unified
-    # Alerts API as the EDR, under product 'ngsiem'. The product clause is always
-    # kept, so a filter narrows the NG-SIEM detections and never widens past them.
-    fql = "product:'ngsiem'"
+    # Next-Gen SIEM files its detections in the same unified Alerts API as the
+    # EDR, under two products: 'thirdparty' for the alerts it raises from ingested
+    # third-party logs (a FortiGate IPS hit, say) and 'ngsiem' for those of the
+    # tenant's own correlation rules. The product clause is always kept, so a
+    # filter narrows these detections and never widens past them.
+    products = [p.strip().strip("'\"") for p in str(INPUTS.get("products") or "thirdparty,ngsiem").split(",") if p.strip()]
+    # ',' is OR in FQL; parenthesised so the group binds before the '+' ANDs.
+    fql = "(" + ",".join("product:'" + p.replace("'", "\\'") + "'" for p in products) + ")"
     extra = str(INPUTS.get("filter") or "").strip()
     if extra:
         fql += "+(" + extra + ")"