Skip to content

fix(integrations): close regressions found in the final validation sweep #6764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 6 commits into from
Aug 16, 2026
Merged

fix(integrations): close regressions found in the final validation sweep #6764

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a7eb8c5
fix(integrations): close regressions found in the final validation sweep
waleedlatif1 Aug 16, 2026
906b23f
fix(integrations): surface corrupt Splunk bodies and partial CrowdStr…
waleedlatif1 Aug 16, 2026
a05865b
fix(integrations): close the three defects Bugbot found in the sweep
waleedlatif1 Aug 16, 2026
15de5c2
fix(integrations): confine the Splunk XML tolerance and the CrowdStri…
waleedlatif1 Aug 16, 2026
0531d3c
test(crowdstrike): pin batched partial-delete parity with an unbatche…
waleedlatif1 Aug 16, 2026
4395da3
fix(splunk): read the dispatch XML envelope instead of discarding it
waleedlatif1 Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 14 additions & 10 deletions apps/docs/content/docs/en/integrations/cloudflare.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,7 +494,7 @@ Gets DNS analytics report for a zone including query counts and trends.
| `zoneId` | string | Yes | The zone ID to get DNS analytics for |
| `since` | string | No | Start date for analytics \(ISO 8601, e.g., "2024-01-01T00:00:00Z"\) or relative \(e.g., "-6h"\) |
| `until` | string | No | End date for analytics \(ISO 8601, e.g., "2024-01-31T23:59:59Z"\) or relative \(e.g., "now"\) |
| `metrics` | string | Yes | Comma-separated metrics to retrieve \(e.g., "queryCount,uncachedCount,staleCount,responseTimeAvg,responseTimeMedian,responseTime90th,responseTime99th"\) |
| `metrics` | string | No | Comma-separated metrics to retrieve \(e.g., "queryCount,uncachedCount,staleCount,responseTimeAvg,responseTimeMedian,responseTime90th,responseTime99th"\). Optional — Cloudflare returns its default metric set when it is omitted |
| `dimensions` | string | No | Comma-separated dimensions to group by \(e.g., "queryName,queryType,responseCode,responseCached,coloName,origin,dayOfWeek,tcp,ipVersion,querySizeBucket,responseSizeBucket"\) |
| `filters` | string | No | Filters to apply to the data \(e.g., "queryType==A"\) |
| `sort` | string | No | Sort order for the result set. Fields must be included in metrics or dimensions \(e.g., "+queryCount" or "-responseTimeAvg"\) |
Expand Down Expand Up @@ -678,7 +678,7 @@ Creates a zone ruleset for a phase, optionally seeded with its first rules. Use
| `zoneId` | string | Yes | The zone ID to create the ruleset in |
| `name` | string | Yes | Human-readable name for the ruleset |
| `phase` | string | Yes | The ruleset phase, e.g. http_ratelimit, http_request_firewall_custom, http_request_firewall_managed, http_request_transform, http_request_dynamic_redirect |
| `kind` | string | No | Ruleset kind: zone, custom, managed, or root. Use zone to create a phase entry point ruleset. Defaults to zone |
| `kind` | string | No | Ruleset kind: zone or custom. Use zone to create a phase entry point ruleset and custom for a ruleset an execute rule deploys. Defaults to zone. "root" is the account-level phase entry point and "managed" is Cloudflare-owned, so neither can be created on this zone-scoped endpoint |
| `description` | string | No | Description of the ruleset |
| `rules` | json | No | JSON array of rules to seed the ruleset with, in evaluation order. Each rule takes action, expression, and optionally description, enabled, action_parameters, and ratelimit |
| `apiKey` | string | Yes | Cloudflare API Token |
Expand Down Expand Up @@ -767,8 +767,8 @@ Updates a rule in a zone ruleset. Cloudflare replaces the rule definition rather
| `expression` | string | Yes | Cloudflare filter expression selecting matching requests. Required because this endpoint replaces the rule definition — omitting it resets the stored expression |
| `description` | string | No | Human-readable description of the rule |
| `enabled` | boolean | No | Whether the rule is enabled |
| `ref` | string | No | Reference tag that stays stable across rule updates |
| `actionParameters` | string | No | JSON object of action-specific parameters, e.g. \{"id":"<MANAGED_RULESET_ID>","overrides":\{"rules":\[\{"id":"<RULE_ID>","action":"log","enabled":true,"score_threshold":40\}\]\}\} |
| `ref` | string | No | Reference tag that stays stable across rule updates. Because the update replaces the rule, omitting it resets the tag to the rule ID and breaks anything matching on the old value |
| `actionParameters` | string | No | JSON object of action-specific parameters, e.g. \{"id":"<MANAGED_RULESET_ID>","overrides":\{"rules":\[\{"id":"<RULE_ID>","action":"log","enabled":true,"score_threshold":40\}\]\}\}. Required on an execute rule and must be sent on every update: the endpoint replaces the rule, so omitting it resets action_parameters to \{\} — which unbinds the managed ruleset the rule deploys and every override under it |
| `ratelimit` | string | No | JSON rate limiting configuration to preserve on a rule in the http_ratelimit phase, e.g. \{"characteristics":\["cf.colo.id","ip.src"\],"period":60,"requests_per_period":100\}. Because the update replaces the rule, omitting this on a rate limiting rule stops it rate limiting |
| `logging` | string | No | JSON logging configuration to preserve, e.g. \{"enabled":true\}. Omitting it on a rule that had logging configured resets it to the default |
| `apiKey` | string | Yes | Cloudflare API Token |
Expand Down Expand Up @@ -1075,8 +1075,8 @@ Creates a Cloudflare Access (Zero Trust) application that puts an identity check
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `accountId` | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint |
| `domain` | string | No | The primary hostname and path secured by Access, e.g. internal.example.com or example.com/admin. Required for the self_hosted, ssh, vnc, rdp, and bookmark types; the saas, app_launcher, warp, biso, dash_sso, infrastructure, mcp, mcp_portal, and proxy_endpoint types do not accept it |
| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be created through the API |
| `domain` | string | No | The primary hostname and path secured by Access, e.g. internal.example.com or example.com/admin. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants |
| `name` | string | No | Friendly name shown in the dashboard and App Launcher |
| `sessionDuration` | string | No | How long an Access session stays valid, e.g. 24h or 30m |
| `allowedIdps` | string | No | Comma-separated identity provider IDs users may authenticate with. Leave empty to allow all configured providers |
Expand All @@ -1087,6 +1087,8 @@ Creates a Cloudflare Access (Zero Trust) application that puts an identity check
| `logoUrl` | string | No | Logo image URL shown in the dashboard and App Launcher |
| `tags` | string | No | Comma-separated tag names categorizing the application |
| `policies` | string | No | JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects, e.g. \["<POLICY_ID>"\] |
| `saasApp` | string | No | JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. \{"auth_type":"saml","consumer_service_url":"https://example.com/acs","sp_entity_id":"https://example.com"\}; OIDC, e.g. \{"auth_type":"oidc","client_id":"...","redirect_uris":\["https://example.com/callback"\]\} |
| `targetCriteria` | string | No | JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. \[\{"port":22,"protocol":"SSH","target_attributes":\{"hostname":\["production"\]\}\}\] |
| `apiKey` | string | Yes | Cloudflare API Token |

#### Output
Expand Down Expand Up @@ -1120,8 +1122,8 @@ Updates a Cloudflare Access (Zero Trust) application. This replaces the applicat
| --------- | ---- | -------- | ----------- |
| `accountId` | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
| `appId` | string | Yes | The Access application ID to update |
| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint |
| `domain` | string | No | The primary hostname and path secured by Access. Required for the self_hosted, ssh, vnc, rdp, and bookmark types; the saas, app_launcher, warp, biso, dash_sso, infrastructure, mcp, mcp_portal, and proxy_endpoint types do not accept it |
| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be written through the API |
| `domain` | string | No | The primary hostname and path secured by Access. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants |
| `name` | string | No | Friendly name shown in the dashboard and App Launcher |
| `sessionDuration` | string | No | How long an Access session stays valid, e.g. 24h or 30m |
| `allowedIdps` | string | No | Comma-separated identity provider IDs users may authenticate with |
Expand All @@ -1131,6 +1133,8 @@ Updates a Cloudflare Access (Zero Trust) application. This replaces the applicat
| `customDenyUrl` | string | No | URL denied users are redirected to |
| `logoUrl` | string | No | Logo image URL shown in the dashboard and App Launcher |
| `tags` | string | No | Comma-separated tag names categorizing the application |
| `saasApp` | string | No | JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. \{"auth_type":"saml","consumer_service_url":"https://example.com/acs","sp_entity_id":"https://example.com"\}; OIDC, e.g. \{"auth_type":"oidc","client_id":"...","redirect_uris":\["https://example.com/callback"\]\} |
| `targetCriteria` | string | No | JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. \[\{"port":22,"protocol":"SSH","target_attributes":\{"hostname":\["production"\]\}\}\] |
| `policies` | string | No | JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects |
| `apiKey` | string | Yes | Cloudflare API Token |

Expand Down Expand Up @@ -1224,7 +1228,7 @@ Creates a Cloudflare Access (Zero Trust) policy on an application, deciding who
| `exclude` | string | No | JSON array of Access rules evaluated with NOT logic — matching any one rejects the request |
| `require` | string | No | JSON array of Access rules evaluated with AND logic — all of them must match |
| `precedence` | number | No | Evaluation order of the policy within the application |
| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h |
| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130 |
| `approvalRequired` | boolean | No | Whether an approver must grant each access request |
| `isolationRequired` | boolean | No | Whether the session must run in a remote isolated browser |
| `purposeJustificationRequired` | boolean | No | Whether users must state a reason for access |
Expand Down Expand Up @@ -1267,7 +1271,7 @@ Updates a Cloudflare Access (Zero Trust) policy on an application. This replaces
| `exclude` | string | No | JSON array of Access rules evaluated with NOT logic |
| `require` | string | No | JSON array of Access rules evaluated with AND logic |
| `precedence` | number | No | Evaluation order of the policy within the application |
| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h |
| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130 |
| `approvalRequired` | boolean | No | Whether an approver must grant each access request |
| `isolationRequired` | boolean | No | Whether the session must run in a remote isolated browser |
| `purposeJustificationRequired` | boolean | No | Whether users must state a reason for access |
Expand Down
14 changes: 9 additions & 5 deletions apps/docs/content/docs/en/integrations/crowdstrike.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ Close an open CrowdStrike Falcon Real Time Response session (DELETE /real-time-r

### CrowdStrike Execute RTR Command

Run a read-only Real Time Response command in an open CrowdStrike Falcon session (POST /real-time-response/entities/command/v1). baseCommand names the family only (cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ipconfig, ls, mount, netstat, ps, reg); subcommands go in commandString. Host-modifying commands need the Active Responder or Admin endpoints. Requires the "Real time response: Read" API scope.
Run a read-only Real Time Response command in an open CrowdStrike Falcon session (POST /real-time-response/entities/command/v1). baseCommand names the family only (cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ifconfig, ipconfig, ls, mount, netstat, ps, reg, users); subcommands go in commandString. Host-modifying commands need the Active Responder or Admin endpoints. Requires the "Real time response: Read" API scope.

#### Input

Expand All @@ -158,7 +158,7 @@ Run a read-only Real Time Response command in an open CrowdStrike Falcon session
| `clientSecret` | string | Yes | CrowdStrike Falcon API client secret |
| `cloud` | string | Yes | CrowdStrike Falcon cloud region |
| `sessionId` | string | Yes | RTR session ID returned by Init RTR Session |
| `baseCommand` | string | Yes | Read-only RTR base command family, one of: cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ipconfig, ls, mount, netstat, ps, reg. Subcommands belong in commandString, not here. |
| `baseCommand` | string | Yes | Read-only RTR base command family, one of: cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ifconfig, ipconfig, ls, mount, netstat, ps, reg, users. Subcommands belong in commandString, not here — and only reg query is read-tier, since reg set and reg delete are Active Responder commands. |
| `commandString` | string | Yes | Full command line to run, such as "ls C:\\Windows" or "reg query HKLM\\Software" |

#### Output
Expand Down Expand Up @@ -501,6 +501,10 @@ Get CrowdStrike Identity Protection sensor details for one or more device IDs (P
| ↳ `statusCauses` | array | Documented causes behind the current status |
| ↳ `tiEnabled` | string | Threat intelligence enablement status |
| `count` | number | Number of sensors returned |
| `pagination` | json | Pagination metadata \(limit, offset, total\) |
| ↳ `limit` | number | Page size used for the query |
| ↳ `offset` | number | Offset returned by CrowdStrike |
| ↳ `total` | number | Total records available |
| `errors` | array | Errors CrowdStrike returned alongside a partially successful response |
| ↳ `code` | number | CrowdStrike error code |
| ↳ `id` | string | Identifier the error applies to |
Expand Down Expand Up @@ -676,7 +680,7 @@ Add hosts to or remove hosts from a CrowdStrike Falcon static host group (POST /

### CrowdStrike Query Alerts

Search CrowdStrike Falcon alerts with a Falcon Query Language filter and return their composite IDs. Uses the current Alerts API (GET /alerts/queries/alerts/v2), which supersedes the deprecated Detects API. Requires the "Alerts: Read" API scope.
Search CrowdStrike Falcon alerts with a Falcon Query Language filter and return their composite IDs. Uses the current Alerts API (GET /alerts/queries/alerts/v2), which replaced the Detects API decommissioned on September 30, 2025. Requires the "Alerts: Read" API scope.

#### Input

Expand Down Expand Up @@ -902,7 +906,7 @@ Update CrowdStrike Falcon alerts by composite ID: change status, assign or unass

### CrowdStrike Update Indicators

Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/entities/indicators/v1). DESTRUCTIVE: CrowdStrike blanks out any field you omit, so read each indicator with crowdstrike_get_indicator_details first and resend its full field set with your edits applied. Changing action or scope changes prevention behavior fleet-wide. type and value are immutable. Requires the "IOC Management: Write" API scope.
Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/entities/indicators/v1). DESTRUCTIVE: omitted fields may be cleared, so read each indicator with crowdstrike_get_indicator_details first and resend its full field set with your edits applied. Changing action or scope changes prevention behavior fleet-wide. type and value are immutable. Requires the "IOC Management: Write" API scope.

#### Input

Expand All @@ -911,7 +915,7 @@ Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/ent
| `clientId` | string | Yes | CrowdStrike Falcon API client ID |
| `clientSecret` | string | Yes | CrowdStrike Falcon API client secret |
| `cloud` | string | Yes | CrowdStrike Falcon cloud region |
| `indicators` | json | Yes | JSON array of indicators to update. Each entry requires id, and must also repeat every field it wants to keep: CrowdStrike blanks out any updatable field the entry omits. Updatable fields: action, severity, description, source, tags \(array\), platforms \(array\), applied_globally \(boolean\), host_groups \(array\), expiration \(ISO 8601\), mobile_action, metadata \(\{ filename \}\). type and value cannot be changed. |
| `indicators` | json | Yes | JSON array of indicators to update. Each entry requires id, and should also repeat every field it wants to keep: an updatable field the entry omits may be cleared. Updatable fields: action, severity, description, source, tags \(array\), platforms \(array\), applied_globally \(boolean\), host_groups \(array\), expiration \(ISO 8601\), mobile_action, metadata \(\{ filename \}\). type and value cannot be changed. |
| `comment` | string | No | Audit comment explaining why these indicators were updated |
| `retrodetects` | boolean | No | Whether to generate retroactive detections for the updated indicators |
| `ignoreWarnings` | boolean | No | Whether to apply the updates even when CrowdStrike returns warnings |
Expand Down
2 changes: 1 addition & 1 deletion apps/docs/content/docs/en/integrations/datadog.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,7 +366,7 @@ List all scheduled downtimes in Datadog.
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `currentOnly` | boolean | No | Only return currently active downtimes |
| `limit` | number | No | Number of downtimes to return per page \(default: 30, max: 100\) |
| `limit` | number | No | Number of downtimes to return per page. Datadog defaults to 30 and declares no maximum; keep this at 100 or below to stay within the bound Sim recommends. |
| `offset` | number | No | Index of the first downtime to return \(e.g., 0, 30, 60\) |
| `apiKey` | string | Yes | Datadog API key |
| `applicationKey` | string | Yes | Datadog Application key |
Expand Down
Loading
Loading