Crowdstrike Connector is ingesting very dated reports based on update field

[nhuber0724]

Use case

Currently the Crowdstrike connector is ingesting very old reports based on the update field. This is causing old, irrelevant, and duplicate reports to be ingested. As a result, analysts must go through the reporting to determine if duplicates actually exist, and remove the old reports.

Current Workaround

There is no specific workaround besides manually reviewing duplicate reports to determine whether or not they are actually duplicate or substantial updates and then manually removing the duplicate reports.

Proposed Solution

Include, within the Crowdstrike Connector, a variable that will ingest reports based on or after a specific date specified by the customer, or, create a variable that will allow the customer to decide whether to ingest data based on creation or updated date.

Additional Information

Would you be willing to submit a PR? No

We strongly encourage you to submit a PR if you want and whenever you want. If your issue concern a "Community-support" connector, your PR will probably be accepted after some review. If the connector is "Partner-support" or "Filigran-support", a dev team make take over but will base its work on your PR, speeding the process. It will be much appreciated.