@gillesvilleneuve/crowdstrike-falcon/src/actions/incidents/search-incidents.ts

CrowdStrike Falcon integration for Active Pieces with incident management, host isolation, and real-time response capabilities

import { createAction, Property } from '@activepieces/pieces-framework';
import { makeAuthenticatedApiCall, formatErrorResponse, validateRequiredParams } from '../../common/utils';
import { API_ENDPOINTS } from '../../common/constants';

/**
 * Action to search for incidents in CrowdStrike
 */
export const searchIncidents = createAction({
  name: 'search_incidents',
  displayName: 'Search Incidents',
  description: 'Search for incidents using FQL filters with sorting and paging',
  
  props: {
    filter: Property.LongText({
      displayName: 'Filter',
      description: 'Filter incidents using a query in Falcon Query Language (FQL). Use an asterisk wildcard (*) to include all results.',
      required: false,
    }),
    sort: Property.ShortText({
      displayName: 'Sort',
      description: 'Sort incidents using options like status, start_time, end_time. Format: field|asc or field|desc',
      required: false,
    }),
    limit: Property.Number({
      displayName: 'Limit',
      description: 'Maximum number of incidents to return (default: 100, max: 500)',
      required: false,
      defaultValue: 100,
    }),
    offset: Property.Number({
      displayName: 'Offset',
      description: 'Starting offset for incident results (default: 0)',
      required: false,
      defaultValue: 0,
    }),
  },
  
  async run(context) {
    try {
      const { auth, propsValue } = context;
      
      // Prepare query parameters
      const params: Record<string, string> = {};
      if (propsValue.filter) params.filter = propsValue.filter;
      if (propsValue.sort) params.sort = propsValue.sort;
      if (propsValue.limit) params.limit = propsValue.limit.toString();
      if (propsValue.offset) params.offset = propsValue.offset.toString();
      
      // Make API call to search for incidents
      const response = await makeAuthenticatedApiCall(
        auth,
        API_ENDPOINTS.INCIDENTS_QUERY,
        'GET',
        undefined,
        params
      );
      
      return {
        success: true,
        incident_ids: response.resources || [],
        meta: response.meta || {},
      };
    } catch (error) {
      return formatErrorResponse(error);
    }
  },
});