6bccbb5a50
cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block (fetch command + bundled mapper + default incident type) and a bundled default incident type under incident-types/, so the instance Collect section is pre-filled on first configuration and the default type is created on install. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>