{
	"id": "CrowdStrike Falcon",
	"name": "CrowdStrike Falcon Incident Classifier",
	"type": "classification",
	"description": "CrowdStrike Falcon Incident Classifier",
	"version": -1,
	"defaultIncidentType": "CrowdStrike Falcon Incident",
	"keyTypeMap": {
        "CS Command And Scripting": "Crowdstrike Command And Scripting",
		"detection": "CrowdStrike Falcon Detection",
		"incident": "CrowdStrike Falcon Incident",
		"IDP detection": "CrowdStrike Falcon IDP Detection",
		"iom_configurations": "CrowdStrike Falcon IOM Event",
		"ioa_detection": "CrowdStrike Falcon IOA Event",
        "MOBILE detection": "CrowdStrike Falcon Mobile Detection",
        "On-Demand Scans detection": "CrowdStrike Falcon On-Demand Scans Detection",
        "OFP detection": "CrowdStrike Falcon OFP Detection",
        "thirdparty_detection": "CrowdStrike Falcon Third Party Detection",
        "ngsiem_detection": "CrowdStrike Falcon NGSIEM Detection",
        "Recon notifications": "CrowdStrike Falcon Intelligence Recon notification",
        "ngsiem_incident": "CrowdStrike Falcon NGSIEM Incident",
        "ngsiem_automated_lead": "CrowdStrike Falcon NGSIEM Automated Lead",
        "ngsiem_case": "CrowdStrike Falcon NGSIEM Case"
	},
	"transformer": {
        "complex": {
			"filters": [],
			"root": ".",
			"transformers": [
				{
					"args": {
						"conditions": {
							"isContext": false,
							"value": {
								"simple": "[{\n    \"condition\": \"#{incident_type} == 'detection' and 'T1059' in #{technique_id}\",\n    \"return\": \"CS Command And Scripting\"\n  },\n{\n\"default\": #{incident_type}\n}\n]"
							}
						},
						"flags": {
							"isContext": false
						}
					},
					"operator": "If-Elif"
				}
			]
		}
	},
    "fromVersion": "6.0.0",
    "marketplaces": [
        "xsoar"
    ]
}