id: crowdstrike
name: CrowdStrike Falcon
version: 1.2.3
description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
changelog: "1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
category: endpoint

# Per-instance configuration. Scripts obtain an OAuth2 bearer token from
# {base_url}/oauth2/token using client_id/client_secret, then call the API.
config_schema:
  properties:
    base_url:
      type: string
      description: "CrowdStrike API base URL (region-specific), e.g. https://api.crowdstrike.com or https://api.eu-1.crowdstrike.com"
      default: https://api.crowdstrike.com
    client_id:
      type: string
      description: "Falcon API client ID (Support → API Clients and Keys)"
      x-soar-sensitive: true
    client_secret:
      type: string
      description: "Falcon API client secret"
      x-soar-sensitive: true
  required:
    - client_id
    - client_secret

# Documented for reference; the bundled scripts perform the OAuth2 client-
# credentials exchange themselves and send Authorization: Bearer <token>.
auth:
  - id: oauth2
    type: oauth2_client_credentials
    secret_field: client_secret

commands:
  # ── Enrichment / read ─────────────────────────────────────────────────────
  - id: search_device
    name: crowdstrike-search-device
    description: "Search managed devices (hosts) by hostname, IP, platform, or status; returns full device details for matches."
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Hostname to match (exact)." }
        ip: { type: string, description: "Local IP address to match." }
        platform_name: { type: string, description: "Platform: Windows, Mac, or Linux." }
        status: { type: string, description: "Containment status: normal, containment_pending, contained, or lift_containment_pending." }
        limit: { type: number, description: "Max device IDs to resolve (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: get_device_details
    name: crowdstrike-get-device-details
    description: "Retrieve full details for one or more devices by ID."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: device_online_state
    name: crowdstrike-device-online-state
    description: "Get the current online/offline state for one or more devices by ID."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: search_detections
    name: crowdstrike-search-detections
    description: "Search detections/alerts using an FQL filter; returns full alert entities for matches. Use as an alert rule ingestion source (results path: resources)."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\"). For incremental fetch add e.g. created_timestamp:>'<ISO8601>'." }
        limit: { type: number, description: "Max alerts to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: resources
      dedup_key: composite_id

  - id: list_host_groups
    name: crowdstrike-list-host-groups
    description: "List host groups, optionally filtered by an FQL expression."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "Optional FQL filter, e.g. \"name:*'*prod*'\"." }
        limit: { type: number, description: "Max groups to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: spotlight_search_vulnerability
    name: crowdstrike-spotlight-search-vulnerability
    description: "Search Falcon Spotlight vulnerabilities by FQL filter or CVE ID, with CVE facet detail."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "FQL filter (defaults to \"status:'open'\")." }
        cve_id: { type: string, description: "Comma-separated CVE IDs; overrides filter when provided." }
        limit: { type: number, description: "Max vulnerabilities to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: ioc_device_count
    name: crowdstrike-ioc-device-count
    description: "Count how many devices have observed a given indicator (IOC)."
    risk: read
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
        value: { type: string, description: "Indicator value." }
      required: [type, value]
    outputs_schema: { properties: {} }

  # ── Actions (containment, detection workflow, IOC management) ──────────────
  - id: contain_host
    name: crowdstrike-contain-host
    description: "Network-contain one or more hosts (isolate them while keeping Falcon connectivity)."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs to contain." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: lift_containment
    name: crowdstrike-lift-containment
    description: "Lift network containment on one or more hosts (reconnect them)."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs to release." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: resolve_detection
    name: crowdstrike-resolve-detection
    description: "Update detections/alerts: change status, append a comment, and/or assign to an analyst."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated alert composite IDs." }
        status: { type: string, description: "New status: new, in_progress, closed, or reopened." }
        comment: { type: string, description: "Optional comment to append." }
        assign_to_uuid: { type: string, description: "Optional analyst UUID to assign the detection to." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: upload_custom_ioc
    name: crowdstrike-upload-custom-ioc
    description: "Create a custom IOC indicator (allow/prevent/detect) applied globally."
    risk: destructive
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: sha256, md5, domain, ipv4, or ipv6." }
        value: { type: string, description: "Indicator value." }
        action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
        platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
        severity: { type: string, description: "Optional severity: informational, low, medium, high, or critical." }
        description: { type: string, description: "Optional description." }
        source: { type: string, description: "Optional source label." }
      required: [type, value, action, platforms]
    outputs_schema: { properties: {} }

  - id: delete_custom_ioc
    name: crowdstrike-delete-custom-ioc
    description: "Delete one or more custom IOC indicators by ID."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated IOC indicator IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  # ── Real Time Response ────────────────────────────────────────────────────
  - id: rtr_run_command
    name: crowdstrike-rtr-run-command
    description: "Open an RTR batch session and run a read-only command (e.g. ls, ps, cat) on the target hosts."
    risk: destructive
    inputs_schema:
      properties:
        host_ids: { type: string, description: "Comma-separated device IDs." }
        command_type: { type: string, description: "Base command, e.g. ls, ps, cat, reg." }
        full_command: { type: string, description: "Full command string, e.g. 'ls C:\\\\'." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Command timeout in seconds (default 30)." }
      required: [host_ids, command_type, full_command]
    outputs_schema: { properties: {} }

  - id: rtr_run_script
    name: crowdstrike-rtr-run-script
    description: "Open an RTR batch session and run a script via runscript (cloud-stored by name or inline raw PowerShell)."
    risk: destructive
    inputs_schema:
      properties:
        host_ids: { type: string, description: "Comma-separated device IDs." }
        script_name: { type: string, description: "Name of a cloud-stored RTR script (exactly one of script_name/raw)." }
        raw: { type: string, description: "Inline raw PowerShell script (exactly one of script_name/raw)." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Script timeout in seconds (default 30)." }
      required: [host_ids]
    outputs_schema: { properties: {} }

  - id: rtr_list_processes
    name: crowdstrike-rtr-list-processes
    description: "Open an RTR session on a single host and list running processes (ps)."
    risk: destructive
    inputs_schema:
      properties:
        host_id: { type: string, description: "A single device ID." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Command timeout in seconds (default 30)." }
      required: [host_id]
    outputs_schema: { properties: {} }

  - id: rtr_kill_process
    name: crowdstrike-rtr-kill-process
    description: "Open an RTR session on a single host and kill one or more processes by PID."
    risk: destructive
    inputs_schema:
      properties:
        host_id: { type: string, description: "A single device ID." }
        process_ids: { type: string, description: "Comma-separated process IDs (PIDs) to kill." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Command timeout in seconds (default 30)." }
      required: [host_id, process_ids]
    outputs_schema: { properties: {} }

  - id: search_custom_iocs
    name: crowdstrike-search-custom-iocs
    description: "Search custom IOC indicators using optional FQL filter parts (type, value, source, expiration)."
    risk: read
    inputs_schema:
      properties:
        types: { type: string, description: "Indicator type filter value, e.g. domain or sha256." }
        values: { type: string, description: "Indicator value filter." }
        sources: { type: string, description: "Source label filter." }
        expiration: { type: string, description: "Expiration date filter (ISO 8601)." }
        limit: { type: string, description: "Max results to return (default 50)." }
        sort: { type: string, description: "Sort expression, e.g. created_on.desc." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  - id: get_custom_ioc
    name: crowdstrike-get-custom-ioc
    description: "Retrieve a custom IOC indicator by its ID."
    risk: read
    inputs_schema:
      properties:
        ioc_id: { type: string, description: "IOC indicator ID to retrieve." }
      required: [ioc_id]
    outputs_schema: { properties: {} }

  - id: update_custom_ioc
    name: crowdstrike-update-custom-ioc
    description: "Update an existing custom IOC indicator (action, platforms, severity, source, description, expiration)."
    risk: destructive
    inputs_schema:
      properties:
        ioc_id: { type: string, description: "IOC indicator ID to update." }
        action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
        platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
        severity: { type: string, description: "Severity: informational, low, medium, high, or critical." }
        source: { type: string, description: "Source label." }
        description: { type: string, description: "Description text." }
        expiration: { type: string, description: "Expiration date (ISO 8601)." }
      required: [ioc_id]
    outputs_schema: { properties: {} }

  - id: batch_upload_custom_ioc
    name: crowdstrike-batch-upload-custom-ioc
    description: "Create multiple custom IOC indicators in a single call by providing a JSON array of indicator objects."
    risk: destructive
    inputs_schema:
      properties:
        multiple_indicators_json: { type: string, description: "JSON array string of indicator objects to create." }
      required: [multiple_indicators_json]
    outputs_schema: { properties: {} }

  - id: processes_ran_on
    name: crowdstrike-processes-ran-on
    description: "List process IDs that ran a given indicator on a specific device."
    risk: read
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
        value: { type: string, description: "Indicator value." }
        device_id: { type: string, description: "Device ID to scope the query." }
      required: [type, value, device_id]
    outputs_schema: { properties: {} }

  - id: process_details
    name: crowdstrike-process-details
    description: "Retrieve full details for one or more processes by process ID."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated process IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: device_ran_on
    name: crowdstrike-device-ran-on
    description: "List device IDs on which a given indicator has been observed."
    risk: read
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
        value: { type: string, description: "Indicator value." }
      required: [type, value]
    outputs_schema: { properties: {} }

  - id: create_host_group
    name: crowdstrike-create-host-group
    description: "Create a new host group (static or dynamic) with an optional description and assignment rule."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Name for the new host group." }
        group_type: { type: string, description: "Group type: static or dynamic." }
        description: { type: string, description: "Optional description for the host group." }
        assignment_rule: { type: string, description: "Optional FQL assignment rule (required for dynamic groups)." }
      required: [name, group_type]
    outputs_schema: { properties: {} }

  - id: update_host_group
    name: crowdstrike-update-host-group
    description: "Update an existing host group's name, description, or assignment rule."
    risk: safe_write
    inputs_schema:
      properties:
        host_group_id: { type: string, description: "ID of the host group to update." }
        name: { type: string, description: "New name for the host group." }
        description: { type: string, description: "New description for the host group." }
        assignment_rule: { type: string, description: "New FQL assignment rule for dynamic groups." }
      required: [host_group_id]
    outputs_schema: { properties: {} }

  - id: delete_host_groups
    name: crowdstrike-delete-host-groups
    description: "Delete one or more host groups by ID."
    risk: destructive
    inputs_schema:
      properties:
        host_group_id: { type: string, description: "Comma-separated host group IDs to delete." }
      required: [host_group_id]
    outputs_schema: { properties: {} }

  - id: list_host_group_members
    name: crowdstrike-list-host-group-members
    description: "List devices that are members of a host group, with optional FQL filter and pagination."
    risk: read
    inputs_schema:
      properties:
        host_group_id: { type: string, description: "Host group ID to list members of." }
        filter: { type: string, description: "Optional FQL filter to narrow results." }
        limit: { type: string, description: "Max members to return (default 50)." }
        offset: { type: string, description: "Pagination offset." }
        sort: { type: string, description: "Sort expression, e.g. hostname.asc." }
      required: []
    outputs_schema: { properties: {} }

  - id: add_host_group_members
    name: crowdstrike-add-host-group-members
    description: "Add one or more hosts to a host group by device ID."
    risk: safe_write
    inputs_schema:
      properties:
        host_group_id: { type: string, description: "ID of the host group to add hosts to." }
        host_ids: { type: string, description: "Comma-separated device IDs to add." }
      required: [host_group_id, host_ids]
    outputs_schema: { properties: {} }

  - id: remove_host_group_members
    name: crowdstrike-remove-host-group-members
    description: "Remove one or more hosts from a host group by device ID."
    risk: safe_write
    inputs_schema:
      properties:
        host_group_id: { type: string, description: "ID of the host group to remove hosts from." }
        host_ids: { type: string, description: "Comma-separated device IDs to remove." }
      required: [host_group_id, host_ids]
    outputs_schema: { properties: {} }

  # ── Cases ─────────────────────────────────────────────────────────────────
  - id: list_case_summaries
    name: crowdstrike-list-case-summaries
    description: "List case summaries. If ids are provided, fetches those specific cases; otherwise queries all cases sorted by creation date and returns their summaries."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated case IDs (optional). If omitted, all cases are listed." }
      required: []
    outputs_schema: { properties: {} }

  - id: get_evidence_for_case
    name: crowdstrike-get-evidence-for-case
    description: "Retrieve full case details including evidence for a single case by ID. Evidence is available at resources[0].evidence in the response."
    risk: read
    inputs_schema:
      properties:
        id: { type: string, description: "Case ID." }
      required: [id]
    outputs_schema: { properties: {} }

  - id: add_case_tag
    name: crowdstrike-add-case-tag
    description: "Add one or more tags to an existing case."
    risk: safe_write
    inputs_schema:
      properties:
        id: { type: string, description: "Case ID." }
        tags: { type: string, description: "Comma-separated tags to add." }
      required: [id, tags]
    outputs_schema: { properties: {} }

  - id: delete_case_tag
    name: crowdstrike-delete-case-tag
    description: "Remove a single tag from an existing case."
    risk: safe_write
    inputs_schema:
      properties:
        id: { type: string, description: "Case ID." }
        tag: { type: string, description: "Tag to remove." }
      required: [id, tag]
    outputs_schema: { properties: {} }

  - id: resolve_case
    name: crowdstrike-resolve-case
    description: "Update a case: change status, name, description, assigned analyst, or severity."
    risk: destructive
    inputs_schema:
      properties:
        id: { type: string, description: "Case ID." }
        status: { type: string, description: "New case status (optional)." }
        name: { type: string, description: "New case name (optional)." }
        assigned_to_uuid: { type: string, description: "UUID of the analyst to assign the case to (optional)." }
        description: { type: string, description: "Updated case description (optional)." }
        severity: { type: number, description: "Severity level as an integer (optional)." }
      required: [id]
    outputs_schema: { properties: {} }

  - id: list_detection_summaries
    name: crowdstrike-list-detection-summaries
    description: "List alert/detection summaries. Accepts explicit composite IDs or an FQL filter to query alerts first, then fetches full entities."
    risk: read
    inputs_schema:
      properties:
        fetch_query: { type: string, description: "FQL filter to query alerts (optional, used when ids are not provided)." }
        ids: { type: string, description: "Comma-separated alert composite IDs (optional). Takes priority over fetch_query." }
      required: []
    outputs_schema: { properties: {} }

  - id: endpoint
    name: crowdstrike-endpoint
    description: "Look up a device/endpoint by device ID, local IP, or hostname; returns full device details for matches."
    risk: read
    inputs_schema:
      properties:
        id: { type: string, description: "Device ID to match (optional)." }
        ip: { type: string, description: "Local IP address to match (optional)." }
        hostname: { type: string, description: "Hostname to match (optional)." }
      required: []
    outputs_schema: { properties: {} }

# RTR script/file management and extended Real Time Response commands
# Fragment — matches manifest.yaml command block format

  - id: upload_script
    name: crowdstrike-upload-script
    description: "Upload a PowerShell script to the RTR cloud script library."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Script name (unique identifier in the library)." }
        permission_type: { type: string, description: "Visibility: private, group, or public (default private)." }
        content: { type: string, description: "PowerShell script content." }
      required: [name, content]
    outputs_schema: { properties: {} }

  - id: get_script
    name: crowdstrike-get-script
    description: "Retrieve one or more RTR cloud scripts by ID."
    risk: read
    inputs_schema:
      properties:
        script_id: { type: string, description: "Comma-separated script IDs." }
      required: [script_id]
    outputs_schema: { properties: {} }

  - id: delete_script
    name: crowdstrike-delete-script
    description: "Delete an RTR cloud script by ID."
    risk: destructive
    inputs_schema:
      properties:
        script_id: { type: string, description: "Script ID to delete." }
      required: [script_id]
    outputs_schema: { properties: {} }

  - id: list_scripts
    name: crowdstrike-list-scripts
    description: "List all RTR cloud scripts available in the tenant."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: list_files
    name: crowdstrike-list-files
    description: "List all RTR PUT files (files available for deployment to hosts)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: get_file
    name: crowdstrike-get-file
    description: "Retrieve one or more RTR PUT files by ID."
    risk: read
    inputs_schema:
      properties:
        file_id: { type: string, description: "Comma-separated PUT file IDs." }
      required: [file_id]
    outputs_schema: { properties: {} }

  - id: delete_file
    name: crowdstrike-delete-file
    description: "Delete an RTR PUT file by ID."
    risk: destructive
    inputs_schema:
      properties:
        file_id: { type: string, description: "PUT file ID to delete." }
      required: [file_id]
    outputs_schema: { properties: {} }

  - id: refresh_session
    name: crowdstrike-refresh-session
    description: "Refresh an existing RTR session for a host, extending its TTL."
    risk: safe_write
    inputs_schema:
      properties:
        host_id: { type: string, description: "Device ID of the host whose session to refresh." }
      required: [host_id]
    outputs_schema: { properties: {} }

  - id: list_host_files
    name: crowdstrike-list-host-files
    description: "List files extracted from an RTR session on a specific host. Opens a new session if no session_id is provided."
    risk: read
    inputs_schema:
      properties:
        host_id: { type: string, description: "Device ID of the target host." }
        session_id: { type: string, description: "Existing RTR session ID (optional; a new session is opened if omitted)." }
      required: [host_id]
    outputs_schema: { properties: {} }

  - id: rtr_remove_file
    name: crowdstrike-rtr-remove-file
    description: "Open an RTR batch session and remove a file from one or more hosts using the rm command."
    risk: destructive
    inputs_schema:
      properties:
        host_ids: { type: string, description: "Comma-separated device IDs." }
        file_path: { type: string, description: "Full path of the file to remove on the host." }
        os: { type: string, description: "Target OS: Windows, Linux, or Mac." }
        queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
        timeout: { type: string, description: "Command timeout in seconds (default 30)." }
      required: [host_ids, file_path, os]
    outputs_schema: { properties: {} }

  - id: rtr_list_network_stats
    name: crowdstrike-rtr-list-network-stats
    description: "Open an RTR batch session on a single host and run netstat to list active network connections."
    risk: read
    inputs_schema:
      properties:
        host_id: { type: string, description: "Device ID of the target host." }
        queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
        timeout: { type: string, description: "Command timeout in seconds (default 30)." }
      required: [host_id]
    outputs_schema: { properties: {} }

  - id: rtr_list_scheduled_tasks
    name: crowdstrike-rtr-list-scheduled-tasks
    description: "Open an RTR batch session and enumerate scheduled tasks on Windows hosts via schtasks."
    risk: read
    inputs_schema:
      properties:
        host_ids: { type: string, description: "Comma-separated device IDs." }
        queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
        timeout: { type: string, description: "Command timeout in seconds (default 30)." }
      required: [host_ids]
    outputs_schema: { properties: {} }

  # ── ML Exclusions ──────────────────────────────────────────────────────────
  - id: create_ml_exclusion
    name: crowdstrike-create-ml-exclusion
    description: "Create a new ML exclusion to prevent the machine learning engine from triggering on a specific value."
    risk: destructive
    inputs_schema:
      properties:
        value: { type: string, description: "The exclusion value (e.g. file path or hash)." }
        excluded_from: { type: string, description: "Comma-separated list of ML detection categories to exclude from (e.g. blocking,extraction)." }
        comment: { type: string, description: "Optional comment describing the reason for the exclusion." }
        groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." }
      required: [value, excluded_from]
    outputs_schema: { properties: {} }

  - id: update_ml_exclusion
    name: crowdstrike-update-ml-exclusion
    description: "Update an existing ML exclusion by ID (value, comment, or groups)."
    risk: destructive
    inputs_schema:
      properties:
        id: { type: string, description: "ML exclusion ID to update." }
        value: { type: string, description: "New exclusion value (optional)." }
        comment: { type: string, description: "Updated comment (optional)." }
        groups: { type: string, description: "Comma-separated host group IDs to replace the current scoping (optional)." }
      required: [id]
    outputs_schema: { properties: {} }

  - id: delete_ml_exclusion
    name: crowdstrike-delete-ml-exclusion
    description: "Delete one or more ML exclusions by ID."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated ML exclusion IDs to delete." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: search_ml_exclusion
    name: crowdstrike-search-ml-exclusion
    description: "Search ML exclusions by explicit IDs, a value substring match, or an FQL filter; returns full exclusion entities."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over value and filter)." }
        value: { type: string, description: "Value substring to search for (takes priority over filter when ids is absent)." }
        filter: { type: string, description: "FQL filter string (used when neither ids nor value is provided)." }
        limit: { type: string, description: "Max results to return." }
        offset: { type: string, description: "Pagination offset." }
        sort: { type: string, description: "Sort expression, e.g. value.asc." }
      required: []
    outputs_schema: { properties: {} }

  # ── IOA Exclusions ─────────────────────────────────────────────────────────
  - id: create_ioa_exclusion
    name: crowdstrike-create-ioa-exclusion
    description: "Create a new IOA exclusion to suppress a specific Indicator of Attack pattern."
    risk: destructive
    inputs_schema:
      properties:
        exclusion_name: { type: string, description: "Display name for the IOA exclusion." }
        pattern_id: { type: string, description: "ID of the IOA pattern to exclude." }
        cl_regex: { type: string, description: "Command-line regular expression to match." }
        ifn_regex: { type: string, description: "Image filename regular expression to match." }
        pattern_name: { type: string, description: "Human-readable pattern name (optional)." }
        comment: { type: string, description: "Optional comment." }
        description: { type: string, description: "Optional description." }
        groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." }
        detection_json: { type: string, description: "Optional detection JSON override." }
      required: [exclusion_name, pattern_id, cl_regex, ifn_regex]
    outputs_schema: { properties: {} }

  - id: update_ioa_exclusion
    name: crowdstrike-update-ioa-exclusion
    description: "Update an existing IOA exclusion by ID."
    risk: destructive
    inputs_schema:
      properties:
        id: { type: string, description: "IOA exclusion ID to update." }
        exclusion_name: { type: string, description: "New display name (optional)." }
        pattern_id: { type: string, description: "New pattern ID (optional)." }
        pattern_name: { type: string, description: "New pattern name (optional)." }
        cl_regex: { type: string, description: "New command-line regex (optional)." }
        ifn_regex: { type: string, description: "New image filename regex (optional)." }
        comment: { type: string, description: "Updated comment (optional)." }
        description: { type: string, description: "Updated description (optional)." }
        groups: { type: string, description: "Comma-separated host group IDs to replace current scoping (optional)." }
        detection_json: { type: string, description: "Updated detection JSON (optional)." }
      required: [id]
    outputs_schema: { properties: {} }

  - id: delete_ioa_exclusion
    name: crowdstrike-delete-ioa-exclusion
    description: "Delete one or more IOA exclusions by ID."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated IOA exclusion IDs to delete." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: search_ioa_exclusion
    name: crowdstrike-search-ioa-exclusion
    description: "Search IOA exclusions by explicit IDs, a name substring match, or an FQL filter; returns full exclusion entities."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over name and filter)." }
        name: { type: string, description: "Name substring to search for (takes priority over filter when ids is absent)." }
        filter: { type: string, description: "FQL filter string (used when neither ids nor name is provided)." }
        limit: { type: string, description: "Max results to return." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  # ── Quarantine ─────────────────────────────────────────────────────────────
  - id: list_quarantined_file
    name: crowdstrike-list-quarantined-file
    description: "List quarantined files by explicit IDs or an FQL filter query."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated quarantined file IDs (takes priority over filter)." }
        filter: { type: string, description: "FQL filter string (used when ids is absent)." }
        limit: { type: string, description: "Max results to return (default 50)." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  - id: apply_quarantine_file_action
    name: crowdstrike-apply-quarantine-file-action
    description: "Apply an action (delete, release, or unrelease) to one or more quarantined files."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated quarantined file IDs." }
        action: { type: string, description: "Action to apply: delete, release, or unrelease." }
        comment: { type: string, description: "Comment explaining the reason for the action." }
      required: [ids, action, comment]
    outputs_schema: { properties: {} }

  # ── Spotlight CVE ──────────────────────────────────────────────────────────
  - id: cve
    name: crowdstrike-cve
    description: "Retrieve Falcon Spotlight vulnerability details for one or more CVE IDs, including CVE facet metadata."
    risk: read
    inputs_schema:
      properties:
        cve: { type: string, description: "Comma-separated CVE IDs to look up (e.g. CVE-2021-44228,CVE-2022-3786)." }
      required: [cve]
    outputs_schema: { properties: {} }

  - id: spotlight_list_host_by_vulnerability
    name: crowdstrike-spotlight-list-host-by-vulnerability
    description: "List hosts affected by one or more CVE IDs using Falcon Spotlight, with host_info facet details."
    risk: read
    inputs_schema:
      properties:
        cve_ids: { type: string, description: "Comma-separated CVE IDs to filter by (e.g. CVE-2021-44228)." }
        limit: { type: string, description: "Max results to return (default 50)." }
      required: [cve_ids]
    outputs_schema: { properties: {} }

  # ── ODS — On-Demand Scans ────────────────────────────────────────────────────
  - id: ods_query_scan
    name: crowdstrike-ods-query-scan
    description: "Query ODS scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated scan IDs to retrieve directly." }
        filter: { type: string, description: "FQL filter to narrow query results." }
        limit: { type: string, description: "Max results to return." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  - id: ods_query_scheduled_scan
    name: crowdstrike-ods-query-scheduled-scan
    description: "Query ODS scheduled scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated scheduled scan IDs to retrieve directly." }
        filter: { type: string, description: "FQL filter to narrow query results." }
        limit: { type: string, description: "Max results to return." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  - id: ods_query_scan_host
    name: crowdstrike-ods-query-scan-host
    description: "Query ODS scan hosts by ID or FQL filter. If ids provided, fetch those scan-host records directly; otherwise query and resolve."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated scan-host IDs to retrieve directly." }
        filter: { type: string, description: "FQL filter to narrow query results." }
        limit: { type: string, description: "Max results to return." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  - id: ods_query_malicious_files
    name: crowdstrike-ods-query-malicious-files
    description: "Query ODS malicious files by file_ids or FQL filter. If file_ids provided, fetch those records directly; otherwise query and resolve."
    risk: read
    inputs_schema:
      properties:
        file_ids: { type: string, description: "Comma-separated malicious file IDs to retrieve directly." }
        filter: { type: string, description: "FQL filter to narrow query results." }
        limit: { type: string, description: "Max results to return." }
        offset: { type: string, description: "Pagination offset." }
      required: []
    outputs_schema: { properties: {} }

  - id: ods_create_scan
    name: crowdstrike-ods-create-scan
    description: "Create an ODS on-demand scan targeting specific hosts and/or host groups."
    risk: destructive
    inputs_schema:
      properties:
        hosts: { type: string, description: "Comma-separated device IDs to scan." }
        host_groups: { type: string, description: "Comma-separated host group IDs to scan." }
        file_paths: { type: string, description: "Comma-separated file paths to include in the scan." }
        scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." }
        description: { type: string, description: "Optional description for the scan." }
        quarantine: { type: string, description: "Quarantine detected malicious files: true or false." }
      required: []
    outputs_schema: { properties: {} }

  - id: ods_create_scheduled_scan
    name: crowdstrike-ods-create-scheduled-scan
    description: "Create a recurring ODS scheduled scan for one or more host groups."
    risk: destructive
    inputs_schema:
      properties:
        host_groups: { type: string, description: "Comma-separated host group IDs (required)." }
        file_paths: { type: string, description: "Comma-separated file paths to include." }
        scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." }
        description: { type: string, description: "Optional description." }
        schedule_start_timestamp: { type: string, description: "ISO 8601 start timestamp (required)." }
        schedule_interval: { type: string, description: "Recurrence: Never, Daily, Weekly, Every other week, Every four weeks, or Monthly (required)." }
      required: [host_groups, schedule_start_timestamp, schedule_interval]
    outputs_schema: { properties: {} }

  - id: ods_delete_scheduled_scan
    name: crowdstrike-ods-delete-scheduled-scan
    description: "Delete one or more ODS scheduled scans by ID."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated scheduled scan IDs to delete." }
      required: [ids]
    outputs_schema: { properties: {} }

  # ── CSPM — Cloud Security Posture Management ──────────────────────────────────
  - id: cspm_list_policy_details
    name: crowdstrike-cspm-list-policy-details
    description: "Retrieve CSPM policy details for one or more policy IDs."
    risk: read
    inputs_schema:
      properties:
        policy_ids: { type: string, description: "Comma-separated CSPM policy IDs." }
      required: [policy_ids]
    outputs_schema: { properties: {} }

  - id: cspm_list_service_policy_settings
    name: crowdstrike-cspm-list-service-policy-settings
    description: "List CSPM service policy settings for a given policy ID and cloud platform."
    risk: read
    inputs_schema:
      properties:
        policy_id: { type: string, description: "CSPM policy ID." }
        cloud_platform: { type: string, description: "Cloud platform: aws (default), azure, or gcp." }
        service: { type: string, description: "Optional cloud service name to filter." }
        limit: { type: string, description: "Max results to return." }
      required: [policy_id]
    outputs_schema: { properties: {} }

  - id: cspm_update_policy_settings
    name: crowdstrike-cspm-update-policy-settings
    description: "Update CSPM policy settings: enable/disable, change severity, scope to regions or account."
    risk: destructive
    inputs_schema:
      properties:
        policy_id: { type: string, description: "CSPM policy ID to update (required)." }
        account_id: { type: string, description: "Optional cloud account ID to scope the update." }
        enabled: { type: string, description: "Enable policy: true (default) or false." }
        regions: { type: string, description: "Comma-separated regions to scope the policy." }
        severity: { type: string, description: "Optional severity override." }
        tag_excluded: { type: string, description: "Exclude tagged resources: true or false." }
      required: [policy_id]
    outputs_schema: { properties: {} }

  # ── Users / Rules / Alerts ────────────────────────────────────────────────────
  - id: list_users
    name: crowdstrike-list-users
    description: "List Falcon users. If id provided, fetch those users directly; otherwise query with optional filter."
    risk: read
    inputs_schema:
      properties:
        id: { type: string, description: "Comma-separated user UUIDs to retrieve directly." }
        filter: { type: string, description: "FQL filter to narrow query results." }
        offset: { type: string, description: "Pagination offset (default 0)." }
        limit: { type: string, description: "Max results to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: get_ioarules
    name: crowdstrike-get-ioarules
    description: "Retrieve IOA (Indicator of Attack) custom rules by rule ID."
    risk: read
    inputs_schema:
      properties:
        rule_ids: { type: string, description: "Comma-separated IOA rule IDs." }
      required: [rule_ids]
    outputs_schema: { properties: {} }

  - id: list_cnapp_alerts
    name: crowdstrike-list-cnapp-alerts
    description: "List CNAPP container security alerts, optionally filtered by FQL expression."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "Optional FQL filter to narrow results." }
      required: []
    outputs_schema: { properties: {} }

  - id: resolve_identity_detection
    name: crowdstrike-resolve-identity-detection
    description: "Resolve or update Falcon Identity Detection alerts: change status, assign, comment, tag, or unassign."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated composite alert IDs (required)." }
        update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." }
        assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." }
        append_comment: { type: string, description: "Comment text to append." }
        add_tag: { type: string, description: "Tag to add to the detection." }
        remove_tag: { type: string, description: "Tag to remove from the detection." }
        unassign: { type: string, description: "Unassign the detection: true or false." }
        show_in_ui: { type: string, description: "Show in UI: true or false." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: resolve_mobile_detection
    name: crowdstrike-resolve-mobile-detection
    description: "Resolve or update Falcon Mobile Detection alerts: change status, assign, comment, tag, or unassign."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated composite alert IDs (required)." }
        update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." }
        assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." }
        append_comment: { type: string, description: "Comment text to append." }
        add_tag: { type: string, description: "Tag to add to the detection." }
        remove_tag: { type: string, description: "Tag to remove from the detection." }
        unassign: { type: string, description: "Unassign the detection: true or false." }
        show_in_ui: { type: string, description: "Show in UI: true or false." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: list_workflow_definitions
    name: crowdstrike-list-workflow-definitions
    description: "List Falcon Fusion workflow definitions using an optional FQL filter, pagination offset/limit, and sort expression."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "FQL filter expression." }
        limit: { type: string, description: "Maximum number of results (default 50)." }
        offset: { type: string, description: "Pagination offset (default 0)." }
        sort: { type: string, description: "Sort expression, e.g. name.asc." }
      required: []
    outputs_schema: { properties: {} }

  - id: workflow_execute
    name: crowdstrike-workflow-execute
    description: "Trigger execution of one or more Falcon Fusion workflow definitions."
    risk: destructive
    inputs_schema:
      properties:
        definition_id: { type: string, description: "Comma-separated workflow definition IDs to execute." }
        name: { type: string, description: "Optional workflow name filter." }
        key: { type: string, description: "Optional idempotency key for the execution." }
        source_event_url: { type: string, description: "Optional source event URL." }
        execution_cid: { type: string, description: "Comma-separated CIDs to target for execution." }
        body: { type: string, description: "JSON string body to pass as the execution payload (default {})." }
      required: [definition_id]
    outputs_schema: { properties: {} }

  - id: list_workflow_executions
    name: crowdstrike-list-workflow-executions
    description: "List Falcon Fusion workflow execution records using an optional FQL filter, pagination offset/limit, and sort expression."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "FQL filter expression." }
        limit: { type: string, description: "Maximum number of results (default 50)." }
        offset: { type: string, description: "Pagination offset (default 0)." }
        sort: { type: string, description: "Sort expression, e.g. start_timestamp.desc." }
      required: []
    outputs_schema: { properties: {} }

  - id: list_workflow_execution_results
    name: crowdstrike-list-workflow-execution-results
    description: "Retrieve detailed results for one or more workflow execution IDs."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated workflow execution IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: workflow_execution_action
    name: crowdstrike-workflow-execution-action
    description: "Perform an action (cancel or resume) on one or more workflow executions."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated workflow execution IDs." }
        action_name: { type: string, description: "Action to perform: cancel or resume.", enum: [cancel, resume] }
      required: [ids, action_name]
    outputs_schema: { properties: {} }

  - id: list_identity_entities
    name: crowdstrike-list-identity-entities
    description: "Query Falcon Identity Protection entities (users or endpoints) via the GraphQL API, returning risk scores and factors."
    risk: read
    inputs_schema:
      properties:
        type: { type: string, description: "Entity type: USER or ENDPOINT.", enum: [USER, ENDPOINT] }
        limit: { type: string, description: "Maximum number of nodes to return (default 50)." }
        primary_display_name: { type: string, description: "Optional filter by primary display name (informational; include in query if supported)." }
        email: { type: string, description: "Optional filter by email address (informational; include in query if supported)." }
      required: [type]
    outputs_schema: { properties: {} }

  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: crowdstrike-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: search_detections
  mapper: search_detections
  default_incident_type: "CrowdStrike Detection"