fix(crowdstrike): say what an empty alert search matched (1.6.1)

search_detections and search_ngsiem_detections now return a query block
(FQL sent, Falcon's total, errors) next to resources, so an empty run can
be told apart from a wrong region or an API client that sees no alerts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/crowdstrike/scripts/search_detections.py

@@ -51,6 +51,14 @@ def main():
         result = call("POST", "/alerts/entities/alerts/v2", tok, body={"composite_ids": ids})
     else:
         result = {"resources": []}
+    # An empty page says nothing on its own: keep what the query answered — the
+    # FQL actually sent, Falcon's total for it and any errors — so a run with no
+    # alerts reads as "matched nothing" rather than as a silent failure.
+    result["query"] = {
+        "filter": fql,
+        "total": ((found.get("meta") or {}).get("pagination") or {}).get("total"),
+        "errors": found.get("errors") or [],
+    }
     print(json.dumps(result))
 
 

integrations/crowdstrike/scripts/search_ngsiem_detections.py

@@ -53,6 +53,14 @@ def main():
         result = call("POST", "/alerts/entities/alerts/v2", tok, body={"composite_ids": ids})
     else:
         result = {"resources": []}
+    # An empty page says nothing on its own: keep what the query answered — the
+    # FQL actually sent, Falcon's total for it and any errors — so a run with no
+    # alerts reads as "matched nothing" rather than as a silent failure.
+    result["query"] = {
+        "filter": fql,
+        "total": ((found.get("meta") or {}).get("pagination") or {}).get("total"),
+        "errors": found.get("errors") or [],
+    }
     print(json.dumps(result))