An alert only summarises its detection; addresses, user, process and
command line live in the events tagged with its short id. with_events
runs one event search per alert (alert_short_ids, first_seen_at - 1 min
to now, as Sekoia's XSOAR integration does), in parallel within the
60 s command budget, and nests the dotted ECS names. A search not done
in time leaves events_pending + events_job_uuid: the alert still goes
out, as the rule's watermark would not offer it again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VBnLYwQbUCaf5vpv77N14Q
Sekoia XDR (siem): alert ingestion (list_alerts) with an exhaustive OCSF mapper
and a bundled 'Sekoia XDR Alert' default type, plus 20 commands across alerts
(list/get/search, status workflow, comments), event search jobs (create/status/
results + one-shot search_events), cases, asset management, users, kill chains
and a generic authenticated HTTP passthrough. Bearer-token auth, EU host default.
SEKOIA Intelligence Center (enrichment): observable/indicator/indicator-context
CTI queries plus ip/url/domain/file/email reputation lookups (STIX type resolved
automatically). No fetch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
f3nris
Guillaume BOURGEOIS