@gillesvilleneuve/crowdstrike-falcon/src/common/constants.ts

CrowdStrike Falcon integration for Active Pieces with incident management, host isolation, and real-time response capabilities

/**
 * Constants for CrowdStrike Falcon API
 */

export const API_ENDPOINTS = {
  // Authentication
  OAUTH_TOKEN: '/oauth2/token',
  
  // Incidents
  INCIDENTS_QUERY: '/incidents/queries/incidents/v1',
  INCIDENTS_ENTITIES: '/incidents/entities/incidents/v1',
  INCIDENTS_ACTIONS: '/incidents/entities/incident-actions/v1',
  
  // Devices/Hosts
  DEVICES_QUERY: '/devices/queries/devices/v1',
  DEVICES_ENTITIES: '/devices/entities/devices/v1',
  DEVICES_ACTIONS: '/devices/entities/devices-actions/v2',
  
  // Real-time Response
  RTR_SESSION_INIT: '/real-time-response/entities/sessions/v1',
  RTR_SESSION_BATCH: '/real-time-response/combined/batch-init-session/v1',
  RTR_COMMAND_EXEC: '/real-time-response/entities/command/v1',
  RTR_ACTIVE_RESPONDER_COMMAND: '/real-time-response/entities/active-responder-command/v1',
  RTR_ADMIN_COMMAND: '/real-time-response/entities/admin-command/v1',
  RTR_COMMAND_STATUS: '/real-time-response/entities/command/v1',
  RTR_FILE_GET: '/real-time-response/entities/extracted-file-contents/v1',
};

export const ERROR_MESSAGES = {
  AUTHENTICATION_FAILED: 'Authentication failed. Please check your credentials.',
  NETWORK_ERROR: 'Network error occurred while connecting to CrowdStrike API.',
  INVALID_RESPONSE: 'Received invalid response from CrowdStrike API.',
  MISSING_PARAMETERS: 'Required parameters are missing.',
  HOST_NOT_FOUND: 'Host not found or not accessible.',
  SESSION_INIT_FAILED: 'Failed to initialize RTR session.',
  COMMAND_EXECUTION_FAILED: 'Failed to execute command.',
  ISOLATION_FAILED: 'Failed to change host isolation status.',
};

export const DEFAULT_HEADERS = {
  'Content-Type': 'application/json',
  'Accept': 'application/json',
};

export const ISOLATION_STATUSES = {
  ISOLATED: 'isolated',
  NOT_ISOLATED: 'normal',
  PENDING_ISOLATION: 'pending_isolation',
  PENDING_REMOVAL: 'pending_removal',
};

export const RTR_COMMAND_TYPES = {
  READ_ONLY: 'read-only',
  ACTIVE_RESPONDER: 'active-responder',
  ADMIN: 'admin',
};