FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
jankit6
Staff
Staff
Article Id 413126
Description This article describes how to fix an issue that occurs after the API endpoints change at the CrowdStrike end.
Scope FortiSOAR, CrowdStrike Falcon Connector.
Solution

The following API Endpoints are going to be deprecated by CrowdStrike, which will impact the FortiSOAR connector actions or Data ingestion playbooks:

 

  • /detects/aggregates/detects/GET/v1
  • /detects/entities/detects/v2
  • /detects/entities/summaries/GET/v1
  • /detects/queries/detects/v1

FortiSOAR CrowdStrike connector v3.0.0 already includes the new API endpoints. The existing actions can be switched to the new available actions as follows:

 

  1. Detection Aggregates -> Alert Aggregates:
    /detects/aggregates/detects/GET/v1 -> /alerts/aggregates/alerts/v2

 

  1. Update Detection -> Update Alert:

    /detects/entities/detects/v2 -> /alerts/entities/alerts/v3

     

  1. Get Detection Details -> Get Alert Details:

    /detects/entities/summaries/GET/v1 -> /alerts/entities/alerts/v2

     

  1. Detection Search -> Alert Search:
    /detects/queries/detects/v1 → /alerts/queries/alerts/v2

 

If Data Ingestion is configured with Detections -> Edit and changes are made to Alerts:

 

Screenshot_311.png

 

 

Note: For backward compatibility, both the old and new actions are currently available in the connector. However, the deprecated (old) actions will be removed in a future connector release.