f3nris 0444e120fa feat(crowdstrike): search Next-Gen SIEM detections (1.6.0) ...

NG-SIEM correlation rules file their detections in the unified Alerts
API under product 'ngsiem'. search_detections defaults to epp/ldt and
maps device/process/file blocks those detections do not carry.

New search_ngsiem_detections command (product clause always kept, filter
ANDed, created_from watermark), its own first-cut mapper on the fields
every unified alert carries, and a CrowdStrike NG-SIEM Detection type.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-15 07:53:05 +00:00

..

search_detections.yaml

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

search_ngsiem_detections.yaml

feat(crowdstrike): search Next-Gen SIEM detections (1.6.0)

2026-10-15 07:53:05 +00:00