f3nris 8eed7ed9fb fix(crowdstrike): NG-SIEM detections are filed under thirdparty (1.6.2) ...

On a real tenant the Unified Detections raised from ingested FortiGate
logs are product 'thirdparty'; 'ngsiem' matched nothing. The command now
reads thirdparty and ngsiem by default (products input), and its mapper
is rewritten from real payloads: source product/vendor, matched host,
connection endpoints and ports, vendor signature id, Falcon priority,
console link, and a description built from what fired on which connection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VBnLYwQbUCaf5vpv77N14Q

2026-10-15 08:32:36 +00:00

..

search_detections.yaml

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

search_ngsiem_detections.yaml

fix(crowdstrike): NG-SIEM detections are filed under thirdparty (1.6.2)

2026-10-15 08:32:36 +00:00