[CrowdStrike-Endpoint-Security] Updating action when deleting indicator on OpenCTI

[al0rd25l]

Use case

Stop detecting matches on an indicator in CrowdStrike when it has been deleted on OpenCTI.

Current Workaround

When CROWDSTRIKE_PERMANENT_DELETE is set to False, if an indicator is deleted (whether it is actually deleted or it just stops being seen by the stream), it is not removed from CrowdStrike. Instead, it is just labeled with TO_DELETE. And while you can update the action later, this approach is not practical since viewing these labels requires accessing each indicator individually.

Proposed Solution

Add a function to update the action and mobile_action fields from detect to no_action for a "deleted" indicator (pretty much similar to the _handle_labels function).

Additional Information

Perhaps, if to allow flexibility, it can be configured as an optional env variable CROWDSTRIKE_UPDATE_ACTION.
Not sure if you find it necessary to keep the label update with this approach (I personally don’t see the need for it).

Would you be willing to submit a PR?

Sure, I'm already running a custom version with a _handle_action function, I would just need to add the optional variable setting.