Add Crowdstrike AID device info lookup table

[arielkr256]

Summary

• Adds lookup_tables/crowdstrike/crowdstrike_aid_device_info.yml
• Maps Crowdstrike AIDs to devices with most-recent ComputerName, known IPs (aip aggregate), and the full latest aid_master event details (10-day window)
• Enriches Crowdstrike log types keyed by aid (plus SensorId for DetectionSummary)
• Disabled by default; daily refresh (1440 min)

[cursor]

PR Summary

Low Risk
Low risk: adds a new, disabled-by-default lookup table and wires it into the Crowdstrike pack; impact is limited to extra query/refresh load only if enabled.

Overview
Adds a new Crowdstrike lookup table, crowdstrike_aid_device_info, that aggregates recent aid_master FDR events to map aid to the latest ComputerName, a de-duplicated list of aip values, and the most recent full event payload.

Updates the Crowdstrike pack (packs/crowdstrike.yml) to include this lookup table for optional enrichment; the table is disabled by default and configured to refresh daily.

^{Reviewed by Cursor Bugbot for commit 9f6b2ed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9f6b2ed. Configure here.}

[cursor]

Missing AssociatedLogTypes per PR description intent

High Severity

The PR description states this lookup "enriches Crowdstrike log types keyed by aid (plus SensorId for DetectionSummary)," but AssociatedLogTypes only contains Crowdstrike.FDREvent. Many Crowdstrike log types with an aid field — such as Crowdstrike.ProcessRollup2, Crowdstrike.DNSRequest, Crowdstrike.UserIdentity, Crowdstrike.NetworkConnect, Crowdstrike.AIDMaster, etc. — are missing. Crowdstrike.DetectionSummary with a SensorId selector is also absent.

 

^{Reviewed by Cursor Bugbot for commit 9f6b2ed. Configure here.}