Thanks for the explanation! So, there are several exports configured and I can't figure out which one goes to SecOps. Any idea how to figure that out? Because that could point me to the filter that should also contain finding_class="CHOKEPOINT"

Could Case Closure be proposed as a new type of Trigger?

I'm referring to Security Analysts manually closing cases from the UI when an investigation is concluded and then have a way for the rest of the team to be notified about that case closure event and how it was closed (Reason/Root Cause/Closing Commen...

@mccrilb @alube I ended up configuring the CrowdStrike Alert Connector with the following Dynamic List.

Thanks, @mccrilb! I'll see if I can implement the ODS alert ingestion this way! Thanks for the tip!