CrowdStrike Falcon Incident Classifier

Details

ID	`CrowdStrike Falcon`
Type	classification
Version	-1
From Version	6.0.0
Default Incident Type	CrowdStrike Falcon Incident
Feed	No

Key Type Map

Key	Incident Type
`CS Command And Scripting`	Crowdstrike Command And Scripting
`detection`	CrowdStrike Falcon Detection
`incident`	CrowdStrike Falcon Incident
`IDP detection`	CrowdStrike Falcon IDP Detection
`iom_configurations`	CrowdStrike Falcon IOM Event
`ioa_detection`	CrowdStrike Falcon IOA Event
`MOBILE detection`	CrowdStrike Falcon Mobile Detection
`On-Demand Scans detection`	CrowdStrike Falcon On-Demand Scans Detection
`OFP detection`	CrowdStrike Falcon OFP Detection
`thirdparty_detection`	CrowdStrike Falcon Third Party Detection
`ngsiem_detection`	CrowdStrike Falcon NGSIEM Detection
`Recon notifications`	CrowdStrike Falcon Intelligence Recon notification
`ngsiem_incident`	CrowdStrike Falcon NGSIEM Incident
`ngsiem_automated_lead`	CrowdStrike Falcon NGSIEM Automated Lead
`ngsiem_case`	CrowdStrike Falcon NGSIEM Case

Source

classifier-CrowdStrike_Falcon_Incident_Classifier.json

Download History Raw

{
	"id": "CrowdStrike Falcon",
	"name": "CrowdStrike Falcon Incident Classifier",
	"type": "classification",
	"description": "CrowdStrike Falcon Incident Classifier",
	"version": -1,
	"defaultIncidentType": "CrowdStrike Falcon Incident",
	"keyTypeMap": {
        "CS Command And Scripting": "Crowdstrike Command And Scripting",
		"detection": "CrowdStrike Falcon Detection",
		"incident": "CrowdStrike Falcon Incident",
		"IDP detection": "CrowdStrike Falcon IDP Detection",
		"iom_configurations": "CrowdStrike Falcon IOM Event",
		"ioa_detection": "CrowdStrike Falcon IOA Event",
        "MOBILE detection": "CrowdStrike Falcon Mobile Detection",
        "On-Demand Scans detection": "CrowdStrike Falcon On-Demand Scans Detection",
        "OFP detection": "CrowdStrike Falcon OFP Detection",
        "thirdparty_detection": "CrowdStrike Falcon Third Party Detection",
        "ngsiem_detection": "CrowdStrike Falcon NGSIEM Detection",
        "Recon notifications": "CrowdStrike Falcon Intelligence Recon notification",
        "ngsiem_incident": "CrowdStrike Falcon NGSIEM Incident",
        "ngsiem_automated_lead": "CrowdStrike Falcon NGSIEM Automated Lead",
        "ngsiem_case": "CrowdStrike Falcon NGSIEM Case"
	},
	"transformer": {
        "complex": {
			"filters": [],
			"root": ".",
			"transformers": [
				{
					"args": {
						"conditions": {
							"isContext": false,
							"value": {
								"simple": "[{\n    \"condition\": \"#{incident_type} == 'detection' and 'T1059' in #{technique_id}\",\n    \"return\": \"CS Command And Scripting\"\n  },\n{\n\"default\": #{incident_type}\n}\n]"
							}
						},
						"flags": {
							"isContext": false
						}
					},
					"operator": "If-Elif"
				}
			]
		}
	},
    "fromVersion": "6.0.0",
    "marketplaces": [
        "xsoar"
    ]
}