{
  "name": "CrowdStrikeFalcon_Sync",
  "version": "1.0",
  "author": "Fabien Bloume, StrangeBee",
  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
  "license": "AGPL-V3",
  "description": "Sync TheHive status back to CS Alerts or Incidents",
  "dataTypeList": [
    "thehive:case", "thehive:alert"
  ],
  "command": "CrowdstrikeFalcon/CrowdstrikeFalconSync.py",
  "baseConfig": "CrowdstrikeFalcon",
  "config": {
    "service": "sync"
  },
  "configurationItems": [
    {
      "name": "client_id",
      "description": "Crowdstrike client ID key",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": ""
    },
    {
      "name": "client_secret",
      "description": "Crowdstrike client secret key",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": ""
    },
    {
      "name": "base_url",
      "description": "Crowdstrike base URL. Also supports US-1, US-2, EU-1, US-GOV-1 values",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "https://api.crowdstrike.com"
    },
    {
      "name": "custom_field_name_alert_id",
      "description": "Custom field in TheHive containing the CSFalcon Alert ID",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "csfalcon-alert-id"
    },
    {
      "name": "custom_field_name_incident_id",
      "description": "Custom field in TheHive containing the CSFalcon Incident ID",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "csfalcon-incident-id"
    }
  ],
  "registration_required": true,
  "subscription_required": true,
  "free_subscription": false,
  "service_homepage": "https://www.crowdstrike.com",
  "service_logo": {
    "path": "assets/crowdstrike.png",
    "caption": "Crowdstrike logo"
  }
}