CrowdStrike Falcon Streaming

Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host.
Will add entry to duplicate(older) incident notifying a duplicate incident was ignored.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations

Classifies CrowdStrike Falcon events.

Maps incoming CrowdStrike Falcon event fields.

Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.