fix(crowdstrike): keep command lines intact and repair rule conditions and grouping

[kryonsx]

Summary

Five of the seventeen CrowdStrike rules test a field that this integration can never deliver, so they can never fire. Eight rules group or deduplicate alerts by fields that do not exist on an alert, and the filter damages quoted command lines.

This draft fixes those. It deliberately leaves the outcome block and the sign-in address mapping to the separate outcome draft #2680. The two drafts merge cleanly, and both test sets pass together.

Built and tested on the latest versions: v11 d2479c1a, go-sdk v1.1.36, and EventProcessor 8a3ade7. That engine revision is the same source as today's eventprocessor:v11.2.14 image and eventprocessor/base:1.1.7.

Predecessor: #2602 (closed, historical context only). Related: #2680 (outcome-only, separate campaign).

Evidence (read-only, described without identifying data)

• One pre-release instance holds CrowdStrike data: the Falcon event stream of one account, retained since 2026-09-21, about 1,170 records.
• It contains four event types:
  • APIActivityAuditEvent;
  • AuditLogV3Event (a second, nested copy of each audit record);
  • UserActivityAuditEvent;
  • AuthActivityAuditEvent.
• There are no detection, incident, real-time-response, custom-indicator or process records.
• The deployed filter and rules match this repository.
• No CrowdStrike rule has ever raised an alert or a circuit-breaker alert on that instance.
• Falcon's event-stream field reference sits behind the console login and was not available. Every change rests on the plugin, filter, engine and go-sdk code plus the real records.

Filter (filters/crowdstrike/crowdstrike.yml)

• Quoted command lines: removes the two steps that strip one double quote from each end of log.eventCommandLine. They left quoted Windows paths and arguments unbalanced; for example, "C:\Tools\x.exe" -a "C:\Temp\y.dmp" was stored as C:\Tools\x.exe" -a "C:\Temp\y.dmp.
• Dead renames: removes three renames that repeat earlier ones and can never find their source.
• Version comment: kept at 1.2.0 so this draft does not conflict with fix(crowdstrike): explicit final outcome and sign-in client address #2680 on line 1.

Rules

• inhibit_system_recovery, os_credential_dumping_activity, suspicious_encoded_powershell_execution, suspicious_native_downloaders, windows_event_log_clearing:
  • remove equals("log.event_simpleName", "ProcessRollup2");
  • event_simpleName is a Data Replicator field; the plugin forwards only event-stream records (metadata and event), and no filter step writes it.
• Seven rules: groupBy uses adversary.host/adversary.user instead of origin.*. An alert has no origin, so these keys were always skipped.
• Brute-force rule: deduplicateBy: adversary.ip instead of origin.ip. Before, every failure after the threshold raised another alert.
• Names, conditions otherwise, thresholds, windows, history searches and MITRE labels are unchanged.

Validation

• Playground (engine 8a3ade7), filter:
  • 63 real records (private) and fabricated records gave 0 errors.
  • All real records are identical before and after.
  • The original filter altered 7 of 8 fabricated command lines; the new one keeps all 8.
• Playground (engine 8a3ade7), rules:
  • The five command-line rules alert only on the 14 fabricated positives.
  • They alert on no near miss and no real record, with no circuit breakers or condition errors.
  • The new grouping keys resolve on all 65 alerts of the regrouped rules (alerts plugin grouping.go).
  • The brute-force history query was attempted without OpenSearch, so live history remains untested; it was checked against a local mock.
• go-sdk v1.1.36 replay: the five rules go from 0 matches to their positives, with 0 real-record matches.
• Go tests:
  • The full plugins/alerts suite passes.
  • All four new tests fail against the original files.
  • Merged with fix(crowdstrike): explicit final outcome and sign-in client address #2680's branch in a throwaway worktree, the suite passes.

Deferred

These need Falcon documentation, real records or an owner decision:

• the AuditLogV3Event copies (drop, pass through or map). If they were ever normalized, each failure would count twice in the brute-force history.
• actor and target user fields;
• the command-line location and the severity scale;
• platform and operation names;
• the meaning of PolicyDisabled;
• outcome values (fix(crowdstrike): explicit final outcome and sign-in client address #2680);
• MITRE relabelling for techniques retired in ATT&CK v19. This should be one repository-wide pass: T1562 appears in 66 rules and "Defense Evasion" in 132.

Operational notes (not code changes)

• The plugin keeps stream offsets only in memory, so events created while it is down are skipped (plugins/crowdstrike/main.go).
• On the reviewed instance, a second API client fails every stream refresh with "not found". It should be fixed or revoked at the source.

See filters/audits/crowdstrike.md.

🤖 Generated with Claude Code