@gillesvilleneuve/crowdstrike-falcon/src/actions/incidents/get-incident-details.ts

CrowdStrike Falcon integration for Active Pieces with incident management, host isolation, and real-time response capabilities

import { createAction, Property } from '@activepieces/pieces-framework';
import { makeAuthenticatedApiCall, formatErrorResponse, validateRequiredParams } from '../../common/utils';
import { API_ENDPOINTS } from '../../common/constants';

/**
 * Action to get incident details from CrowdStrike
 */
export const getIncidentDetails = createAction({
  name: 'get_incident_details',
  displayName: 'Get Incident Details',
  description: 'Retrieve detailed information about specific incidents by their IDs',
  
  props: {
    incident_ids: Property.Array({
      displayName: 'Incident IDs',
      description: 'List of incident IDs to retrieve details for',
      required: true,
    }),
  },
  
  async run(context) {
    try {
      const { auth, propsValue } = context;
      
      // Validate required parameters
      validateRequiredParams(propsValue, ['incident_ids']);
      
      if (!Array.isArray(propsValue.incident_ids) || propsValue.incident_ids.length === 0) {
        throw new Error('At least one incident ID must be provided');
      }
      
      // Make API call to get incident details
      const response = await makeAuthenticatedApiCall(
        auth,
        API_ENDPOINTS.INCIDENTS_ENTITIES,
        'POST',
        {
          ids: propsValue.incident_ids
        }
      );
      
      return {
        success: true,
        incidents: response.resources || [],
        meta: response.meta || {},
      };
    } catch (error) {
      return formatErrorResponse(error);
    }
  },
});