CrowdStrike Falcon Streaming

Classifies CrowdStrike Falcon events.

Maps incoming CrowdStrike Falcon event fields.

Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host.
Will add entry to duplicate(older) incident notifying a duplicate incident was ignored.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations

Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events.