f3nris 0444e120fa feat(crowdstrike): search Next-Gen SIEM detections (1.6.0) ...

NG-SIEM correlation rules file their detections in the unified Alerts
API under product 'ngsiem'. search_detections defaults to epp/ldt and
maps device/process/file blocks those detections do not carry.

New search_ngsiem_detections command (product clause always kept, filter
ANDed, created_from watermark), its own first-cut mapper on the fields
every unified alert carries, and a CrowdStrike NG-SIEM Detection type.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-15 07:53:05 +00:00

..

add_case_tag.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

add_host_group_members.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

apply_quarantine_file_action.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

batch_upload_custom_ioc.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

contain_host.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

create_host_group.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

create_ioa_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

create_ml_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

cspm_list_policy_details.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

cspm_list_service_policy_settings.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

cspm_update_policy_settings.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

cve.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

delete_case_tag.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

delete_custom_ioc.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

delete_file.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

delete_host_groups.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

delete_ioa_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

delete_ml_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

delete_script.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

device_count.py

feat(crowdstrike): count devices by filter without listing them (1.4.0)

2026-09-21 12:41:57 +00:00

device_online_state.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

device_ran_on.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

endpoint.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

get_custom_ioc.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

get_device_details.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

get_evidence_for_case.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

get_file.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

get_ioarules.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

get_script.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ioc_device_count.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

lift_containment.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

list_case_summaries.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_cnapp_alerts.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_detection_summaries.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_files.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_host_files.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_host_group_members.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_host_groups.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

list_identity_entities.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_quarantined_file.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_scripts.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_users.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_workflow_definitions.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_workflow_execution_results.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

list_workflow_executions.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_create_scan.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_create_scheduled_scan.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_delete_scheduled_scan.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_query_malicious_files.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_query_scan_host.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_query_scan.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

ods_query_scheduled_scan.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

process_details.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

processes_ran_on.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

refresh_session.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

remove_host_group_members.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

resolve_case.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

resolve_detection.py

feat(crowdstrike): set a detection's verdict (1.5.0)

2026-10-02 14:25:22 +00:00

resolve_identity_detection.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

resolve_mobile_detection.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

rtr_kill_process.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

rtr_list_network_stats.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

rtr_list_processes.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

rtr_list_scheduled_tasks.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

rtr_remove_file.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

rtr_run_command.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

rtr_run_script.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

search_custom_iocs.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

search_detections.py

feat(crowdstrike): fetch incrementally via a created_from watermark (v1.3.0)

2026-09-01 22:47:46 +02:00

search_device.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

search_ioa_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

search_ml_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

search_ngsiem_detections.py

feat(crowdstrike): search Next-Gen SIEM detections (1.6.0)

2026-10-15 07:53:05 +00:00

spotlight_list_host_by_vulnerability.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

spotlight_search_vulnerability.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

test_connection.py

feat: add test_connection command to all integrations for the instance Test button

2026-06-26 00:00:06 +02:00

update_custom_ioc.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

update_host_group.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

update_ioa_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

update_ml_exclusion.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

upload_custom_ioc.py

feat(crowdstrike): add CrowdStrike Falcon connector (IR enrichment, IOC, containment, RTR)

2026-06-25 23:27:37 +02:00

upload_script.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

workflow_execute.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00

workflow_execution_action.py

feat(crowdstrike): expand to full command set (81 commands)

2026-06-25 23:49:40 +02:00