fix(crowdstrike): resolve_detection fails when Falcon changed nothing (1.6.3)

The alerts PATCH answers 200 to a refused update (errors, resources_affected
0) and the command reported it as a success. It now exits in error with
Falcon's reasons and the ids sent; an empty update is refused up front.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VBnLYwQbUCaf5vpv77N14Q

integrations/crowdstrike/scripts/resolve_detection.py

@@ -62,8 +62,23 @@ def main():
         action_params.append({"name": "append_comment", "value": str(INPUTS["comment"])})
     if INPUTS.get("assign_to_uuid"):
         action_params.append({"name": "assign_to_uuid", "value": str(INPUTS["assign_to_uuid"])})
+    if not action_params:
+        raise ValueError("nothing to change: give a status, a verdict, a comment or an assignee")
     body = {"action_parameters": action_params, "composite_ids": ids}
     result = call("PATCH", "/alerts/entities/alerts/v3", tok, body=body)
+    # Falcon answers 200 to an update it refused: the reasons sit in errors and
+    # meta.writes.resources_affected stays at 0. Passing that on as a success
+    # left an incident closed in Riposte and still open in the console.
+    affected = ((result.get("meta") or {}).get("writes") or {}).get("resources_affected")
+    if result.get("errors") or affected == 0:
+        print(json.dumps({
+            "error": "Falcon updated no alert" if affected == 0 else "Falcon refused part of the update",
+            "resources_affected": affected,
+            "errors": result.get("errors") or [],
+            # The PATCH takes composite ids (<cid>:<id>), not the alert's bare id.
+            "composite_ids": ids,
+        }))
+        sys.exit(1)
     print(json.dumps(result))