chore: import upstream snapshot with attribution

apps/sim/tools/crowdstrike/get_sensor_aggregates.ts

@@ -0,0 +1,161 @@
+import type {
+  CrowdStrikeGetSensorAggregatesParams,
+  CrowdStrikeGetSensorAggregatesResponse,
+} from '@/tools/crowdstrike/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const crowdstrikeGetSensorAggregatesTool: ToolConfig<
+  CrowdStrikeGetSensorAggregatesParams,
+  CrowdStrikeGetSensorAggregatesResponse
+> = {
+  id: 'crowdstrike_get_sensor_aggregates',
+  name: 'CrowdStrike Get Sensor Aggregates',
+  description:
+    'Get documented CrowdStrike Identity Protection sensor aggregates from a JSON aggregate query body',
+  version: '1.0.0',
+
+  params: {
+    clientId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon API client ID',
+    },
+    clientSecret: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon API client secret',
+    },
+    cloud: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon cloud region',
+    },
+    aggregateQuery: {
+      type: 'json',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'JSON aggregate query body documented by CrowdStrike for sensor aggregates',
+    },
+  },
+
+  request: {
+    url: '/api/tools/crowdstrike/query',
+    method: 'POST',
+    headers: () => ({
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => ({
+      aggregateQuery: params.aggregateQuery,
+      cloud: params.cloud,
+      clientId: params.clientId,
+      clientSecret: params.clientSecret,
+      operation: 'crowdstrike_get_sensor_aggregates',
+    }),
+  },
+
+  transformResponse: async (response) => {
+    const data = await response.json()
+
+    if (!response.ok || data.success === false) {
+      throw new Error(data.error || 'Failed to fetch CrowdStrike sensor aggregates')
+    }
+
+    return {
+      success: true,
+      output: data.output,
+    }
+  },
+
+  outputs: {
+    aggregates: {
+      type: 'array',
+      description: 'Aggregate result groups returned by CrowdStrike',
+      items: {
+        type: 'object',
+        properties: {
+          buckets: {
+            type: 'array',
+            description: 'Buckets within the aggregate result',
+            items: {
+              type: 'object',
+              properties: {
+                count: {
+                  type: 'number',
+                  description: 'Bucket document count',
+                  optional: true,
+                },
+                from: {
+                  type: 'number',
+                  description: 'Bucket lower bound',
+                  optional: true,
+                },
+                keyAsString: {
+                  type: 'string',
+                  description: 'String representation of the bucket key',
+                  optional: true,
+                },
+                label: {
+                  type: 'json',
+                  description: 'Bucket label object',
+                  optional: true,
+                },
+                stringFrom: {
+                  type: 'string',
+                  description: 'String lower bound',
+                  optional: true,
+                },
+                stringTo: {
+                  type: 'string',
+                  description: 'String upper bound',
+                  optional: true,
+                },
+                subAggregates: {
+                  type: 'json',
+                  description: 'Nested aggregate results for this bucket',
+                  optional: true,
+                },
+                to: {
+                  type: 'number',
+                  description: 'Bucket upper bound',
+                  optional: true,
+                },
+                value: {
+                  type: 'number',
+                  description: 'Bucket metric value',
+                  optional: true,
+                },
+                valueAsString: {
+                  type: 'string',
+                  description: 'String representation of the bucket value',
+                  optional: true,
+                },
+              },
+            },
+          },
+          docCountErrorUpperBound: {
+            type: 'number',
+            description: 'Upper bound for bucket count error',
+            optional: true,
+          },
+          name: {
+            type: 'string',
+            description: 'Aggregate result name',
+            optional: true,
+          },
+          sumOtherDocCount: {
+            type: 'number',
+            description: 'Document count not included in the returned buckets',
+            optional: true,
+          },
+        },
+      },
+    },
+    count: {
+      type: 'number',
+      description: 'Number of aggregate result groups returned',
+    },
+  },
+}

apps/sim/tools/crowdstrike/get_sensor_details.ts

@@ -0,0 +1,193 @@
+import type {
+  CrowdStrikeGetSensorDetailsParams,
+  CrowdStrikeGetSensorDetailsResponse,
+} from '@/tools/crowdstrike/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const crowdstrikeGetSensorDetailsTool: ToolConfig<
+  CrowdStrikeGetSensorDetailsParams,
+  CrowdStrikeGetSensorDetailsResponse
+> = {
+  id: 'crowdstrike_get_sensor_details',
+  name: 'CrowdStrike Get Sensor Details',
+  description:
+    'Get documented CrowdStrike Identity Protection sensor details for one or more device IDs',
+  version: '1.0.0',
+
+  params: {
+    clientId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon API client ID',
+    },
+    clientSecret: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon API client secret',
+    },
+    cloud: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon cloud region',
+    },
+    ids: {
+      type: 'json',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'JSON array of CrowdStrike sensor device IDs',
+    },
+  },
+
+  request: {
+    url: '/api/tools/crowdstrike/query',
+    method: 'POST',
+    headers: () => ({
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => ({
+      cloud: params.cloud,
+      clientId: params.clientId,
+      clientSecret: params.clientSecret,
+      ids: params.ids,
+      operation: 'crowdstrike_get_sensor_details',
+    }),
+  },
+
+  transformResponse: async (response) => {
+    const data = await response.json()
+
+    if (!response.ok || data.success === false) {
+      throw new Error(data.error || 'Failed to fetch CrowdStrike sensor details')
+    }
+
+    return {
+      success: true,
+      output: data.output,
+    }
+  },
+
+  outputs: {
+    sensors: {
+      type: 'array',
+      description: 'CrowdStrike identity sensor detail records',
+      items: {
+        type: 'object',
+        properties: {
+          agentVersion: {
+            type: 'string',
+            description: 'Sensor agent version',
+            optional: true,
+          },
+          cid: {
+            type: 'string',
+            description: 'CrowdStrike customer identifier',
+          },
+          deviceId: {
+            type: 'string',
+            description: 'Sensor device identifier',
+          },
+          heartbeatTime: {
+            type: 'number',
+            description: 'Last heartbeat timestamp',
+            optional: true,
+          },
+          hostname: {
+            type: 'string',
+            description: 'Sensor hostname',
+            optional: true,
+          },
+          idpPolicyId: {
+            type: 'string',
+            description: 'Assigned Identity Protection policy ID',
+            optional: true,
+          },
+          idpPolicyName: {
+            type: 'string',
+            description: 'Assigned Identity Protection policy name',
+            optional: true,
+          },
+          ipAddress: {
+            type: 'string',
+            description: 'Sensor local IP address',
+            optional: true,
+          },
+          kerberosConfig: {
+            type: 'string',
+            description: 'Kerberos configuration status',
+            optional: true,
+          },
+          ldapConfig: {
+            type: 'string',
+            description: 'LDAP configuration status',
+            optional: true,
+          },
+          ldapsConfig: {
+            type: 'string',
+            description: 'LDAPS configuration status',
+            optional: true,
+          },
+          machineDomain: {
+            type: 'string',
+            description: 'Machine domain',
+            optional: true,
+          },
+          ntlmConfig: {
+            type: 'string',
+            description: 'NTLM configuration status',
+            optional: true,
+          },
+          osVersion: {
+            type: 'string',
+            description: 'Operating system version',
+            optional: true,
+          },
+          rdpToDcConfig: {
+            type: 'string',
+            description: 'RDP to domain controller configuration status',
+            optional: true,
+          },
+          smbToDcConfig: {
+            type: 'string',
+            description: 'SMB to domain controller configuration status',
+            optional: true,
+          },
+          status: {
+            type: 'string',
+            description: 'Sensor protection status',
+            optional: true,
+          },
+          statusCauses: {
+            type: 'array',
+            description: 'Documented causes behind the current status',
+            optional: true,
+            items: {
+              type: 'string',
+            },
+          },
+          tiEnabled: {
+            type: 'string',
+            description: 'Threat intelligence enablement status',
+            optional: true,
+          },
+        },
+      },
+    },
+    count: {
+      type: 'number',
+      description: 'Number of sensors returned',
+    },
+    pagination: {
+      type: 'json',
+      description: 'Pagination metadata when returned by the underlying API',
+      optional: true,
+      properties: {
+        limit: { type: 'number', description: 'Page size used for the query', optional: true },
+        offset: { type: 'number', description: 'Offset returned by CrowdStrike', optional: true },
+        total: { type: 'number', description: 'Total records available', optional: true },
+      },
+    },
+  },
+}

apps/sim/tools/crowdstrike/index.ts

@@ -0,0 +1,4 @@
+export { crowdstrikeGetSensorAggregatesTool } from './get_sensor_aggregates'
+export { crowdstrikeGetSensorDetailsTool } from './get_sensor_details'
+export { crowdstrikeQuerySensorsTool } from './query_sensors'
+export * from './types'

apps/sim/tools/crowdstrike/query_sensors.ts

@@ -0,0 +1,213 @@
+import type {
+  CrowdStrikeQuerySensorsParams,
+  CrowdStrikeQuerySensorsResponse,
+} from '@/tools/crowdstrike/types'
+import type { ToolConfig } from '@/tools/types'
+
+export const crowdstrikeQuerySensorsTool: ToolConfig<
+  CrowdStrikeQuerySensorsParams,
+  CrowdStrikeQuerySensorsResponse
+> = {
+  id: 'crowdstrike_query_sensors',
+  name: 'CrowdStrike Query Sensors',
+  description: 'Search CrowdStrike identity protection sensors by hostname, IP, or related fields',
+  version: '1.0.0',
+
+  params: {
+    clientId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon API client ID',
+    },
+    clientSecret: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon API client secret',
+    },
+    cloud: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'CrowdStrike Falcon cloud region',
+    },
+    filter: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Falcon Query Language filter for identity sensor search',
+    },
+    limit: {
+      type: 'number',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Maximum number of sensor records to return',
+    },
+    offset: {
+      type: 'number',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Pagination offset for the identity sensor query',
+    },
+    sort: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Sort expression for identity sensor results',
+    },
+  },
+
+  request: {
+    url: '/api/tools/crowdstrike/query',
+    method: 'POST',
+    headers: () => ({
+      'Content-Type': 'application/json',
+    }),
+    body: (params) => ({
+      cloud: params.cloud,
+      clientId: params.clientId,
+      clientSecret: params.clientSecret,
+      filter: params.filter,
+      limit: params.limit,
+      offset: params.offset,
+      operation: 'crowdstrike_query_sensors',
+      sort: params.sort,
+    }),
+  },
+
+  transformResponse: async (response) => {
+    const data = await response.json()
+
+    if (!response.ok || data.success === false) {
+      throw new Error(data.error || 'Failed to query CrowdStrike sensors')
+    }
+
+    return {
+      success: true,
+      output: data.output,
+    }
+  },
+
+  outputs: {
+    sensors: {
+      type: 'array',
+      description: 'Matching CrowdStrike identity sensor records',
+      items: {
+        type: 'object',
+        properties: {
+          agentVersion: {
+            type: 'string',
+            description: 'Sensor agent version',
+            optional: true,
+          },
+          cid: {
+            type: 'string',
+            description: 'CrowdStrike customer identifier',
+          },
+          deviceId: {
+            type: 'string',
+            description: 'Sensor device identifier',
+          },
+          heartbeatTime: {
+            type: 'number',
+            description: 'Last heartbeat timestamp',
+            optional: true,
+          },
+          hostname: {
+            type: 'string',
+            description: 'Sensor hostname',
+            optional: true,
+          },
+          idpPolicyId: {
+            type: 'string',
+            description: 'Assigned Identity Protection policy ID',
+            optional: true,
+          },
+          idpPolicyName: {
+            type: 'string',
+            description: 'Assigned Identity Protection policy name',
+            optional: true,
+          },
+          ipAddress: {
+            type: 'string',
+            description: 'Sensor local IP address',
+            optional: true,
+          },
+          kerberosConfig: {
+            type: 'string',
+            description: 'Kerberos configuration status',
+            optional: true,
+          },
+          ldapConfig: {
+            type: 'string',
+            description: 'LDAP configuration status',
+            optional: true,
+          },
+          ldapsConfig: {
+            type: 'string',
+            description: 'LDAPS configuration status',
+            optional: true,
+          },
+          machineDomain: {
+            type: 'string',
+            description: 'Machine domain',
+            optional: true,
+          },
+          ntlmConfig: {
+            type: 'string',
+            description: 'NTLM configuration status',
+            optional: true,
+          },
+          osVersion: {
+            type: 'string',
+            description: 'Operating system version',
+            optional: true,
+          },
+          rdpToDcConfig: {
+            type: 'string',
+            description: 'RDP to domain controller configuration status',
+            optional: true,
+          },
+          smbToDcConfig: {
+            type: 'string',
+            description: 'SMB to domain controller configuration status',
+            optional: true,
+          },
+          status: {
+            type: 'string',
+            description: 'Sensor protection status',
+            optional: true,
+          },
+          statusCauses: {
+            type: 'array',
+            description: 'Documented causes behind the current status',
+            optional: true,
+            items: {
+              type: 'string',
+            },
+          },
+          tiEnabled: {
+            type: 'string',
+            description: 'Threat intelligence enablement status',
+            optional: true,
+          },
+        },
+      },
+    },
+    count: {
+      type: 'number',
+      description: 'Number of sensors returned',
+    },
+    pagination: {
+      type: 'json',
+      description: 'Pagination metadata (limit, offset, total)',
+      optional: true,
+      properties: {
+        limit: { type: 'number', description: 'Page size used for the query', optional: true },
+        offset: { type: 'number', description: 'Offset returned by CrowdStrike', optional: true },
+        total: { type: 'number', description: 'Total records available', optional: true },
+      },
+    },
+  },
+}

apps/sim/tools/crowdstrike/types.ts

@@ -0,0 +1,137 @@
+import type { ToolResponse } from '@/tools/types'
+
+export type CrowdStrikeCloud = 'us-1' | 'us-2' | 'eu-1' | 'us-gov-1' | 'us-gov-2'
+
+export interface CrowdStrikeBaseParams {
+  clientId: string
+  clientSecret: string
+  cloud: CrowdStrikeCloud
+}
+
+export interface CrowdStrikeQuerySensorsParams extends CrowdStrikeBaseParams {
+  filter?: string
+  limit?: number
+  offset?: number
+  sort?: string
+}
+
+export interface CrowdStrikeGetSensorDetailsParams extends CrowdStrikeBaseParams {
+  ids: string[]
+}
+
+interface CrowdStrikeAggregateDateRangeSpec {
+  from: string
+  to: string
+}
+
+interface CrowdStrikeAggregateExtendedBoundsSpec {
+  max: string
+  min: string
+}
+
+interface CrowdStrikeAggregateRangeSpec {
+  from: number
+  to: number
+}
+
+export interface CrowdStrikeAggregateQuery {
+  date_ranges?: CrowdStrikeAggregateDateRangeSpec[]
+  exclude?: string
+  extended_bounds?: CrowdStrikeAggregateExtendedBoundsSpec
+  field?: string
+  filter?: string
+  from?: number
+  include?: string
+  interval?: string
+  max_doc_count?: number
+  min_doc_count?: number
+  missing?: string
+  name?: string
+  q?: string
+  ranges?: CrowdStrikeAggregateRangeSpec[]
+  size?: number
+  sort?: string
+  sub_aggregates?: CrowdStrikeAggregateQuery[]
+  time_zone?: string
+  type?: string
+}
+
+export interface CrowdStrikeGetSensorAggregatesParams extends CrowdStrikeBaseParams {
+  aggregateQuery: CrowdStrikeAggregateQuery
+}
+
+interface CrowdStrikePagination {
+  limit: number | null
+  offset: number | null
+  total: number | null
+}
+
+interface CrowdStrikeSensor {
+  agentVersion: string | null
+  cid: string | null
+  deviceId: string | null
+  heartbeatTime: number | null
+  hostname: string | null
+  idpPolicyId: string | null
+  idpPolicyName: string | null
+  ipAddress: string | null
+  kerberosConfig: string | null
+  ldapConfig: string | null
+  ldapsConfig: string | null
+  machineDomain: string | null
+  ntlmConfig: string | null
+  osVersion: string | null
+  rdpToDcConfig: string | null
+  smbToDcConfig: string | null
+  status: string | null
+  statusCauses: string[]
+  tiEnabled: string | null
+}
+
+export interface CrowdStrikeQuerySensorsResponse extends ToolResponse {
+  output: {
+    count: number
+    pagination: CrowdStrikePagination | null
+    sensors: CrowdStrikeSensor[]
+  }
+}
+
+export interface CrowdStrikeGetSensorDetailsResponse extends ToolResponse {
+  output: {
+    count: number
+    pagination: CrowdStrikePagination | null
+    sensors: CrowdStrikeSensor[]
+  }
+}
+
+export interface CrowdStrikeSensorAggregateBucket {
+  count: number | null
+  from: number | null
+  keyAsString: string | null
+  label: Record<string, unknown> | null
+  stringFrom: string | null
+  stringTo: string | null
+  subAggregates: CrowdStrikeSensorAggregateResult[]
+  to: number | null
+  value: number | null
+  valueAsString: string | null
+}
+
+export interface CrowdStrikeSensorAggregateResult {
+  buckets: CrowdStrikeSensorAggregateBucket[]
+  docCountErrorUpperBound: number | null
+  name: string | null
+  sumOtherDocCount: number | null
+}
+
+export interface CrowdStrikeGetSensorAggregatesResponse extends ToolResponse {
+  output: {
+    aggregates: CrowdStrikeSensorAggregateResult[]
+    count: number
+  }
+}
+
+export type CrowdStrikeResponse =
+  | CrowdStrikeQuerySensorsResponse
+  | CrowdStrikeGetSensorDetailsResponse
+  | CrowdStrikeGetSensorAggregatesResponse