CrowdStrike API Connector: Polling Timestamp Switch Closes Alert Ingestion Gap

What Changed

The CrowdStrike API Data Connector (CCF-based) polling configuration has been updated from created_timestamp to updated_timestamp for both the Alerts and EPP Detections polling streams. Additionally, logResponseContent was removed from three inner polling steps.

Security Impact (Visibility and Fidelity)

Before this fix: Both polling query parameters used created_timestamp to bound the API request window. This means any CrowdStrike alert or EPP detection that was created before the current polling window but subsequently updated (e.g., triage state change, severity re-classification, analyst assignment, or enrichment by CrowdStrike backend) would never be returned by the API poller. The poller only saw events whose created_timestamp fell within the active 5-minute window – events updated in the window but created earlier were silently absent.

After this fix: Both streams now filter and sort by updated_timestamp, ensuring that any alert or detection modified within the polling window is captured regardless of when it was originally created.

Practical impact: Deployments running any version prior to 3.3.8 have been operating with incomplete alert ingestion. Updated or enriched CrowdStrike detections – including cases where severity was escalated post-creation – were not being forwarded to Microsoft Sentinel. Analytic Rules and Hunting Queries operating on CrowdStrikeAlerts or the EPP detections table may have missed correlated activity.

Secondary change: logResponseContent was removed from the Alerts and EPP Detections inner poller steps. This reduces raw API response logging – verify this does not impair troubleshooting workflows if your team relies on connector diagnostic logs for ingestion validation.

Affected Files

Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_Definition.json
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_PollingConfig.json
(packaging artefacts: 3.3.8.zip, ReleaseNotes.md, Solution_CrowdStrike.json, mainTemplate.json)