Crowdstrike connector is ingesting duplicate reports

[nhuber0724]

Description

The Crowdstrike Connector is creating duplicate reports as it seems anytime a report is modified in Crowdstrike, even if there is no substantial modification or for an unknown reason, the connector will ingest that report into the platform; however, that report will be identical to a report already ingested from Crowdstrike.

Environment

OpenCTI v.6.4.7

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Run the Crowdstrike Connector
2. Search for duplicate reports

Expected Output

We should not see identical reports from the same source (Crowdstrike)

Actual Output

Crowdstrike is making unknown modifications to reports within and the connector is pulling the report in based on the modification date causing duplicate reports. The reports are exactly the same. Sometimes one report will have labels and another identical report will contain no labels.

Additional information

Screenshots (optional)