CrowdStrike Medium Severity Alert Detection

This analytic detects CrowdStrike alerts specifically categorized with a 'MEDIUM' severity. These alerts indicate suspicious activity that warrants prompt attention but is not immediately critical. Such activities might include unusual behavior or attempted policy violations. The rule processes CrowdStrike stream data, renames relevant fields for consistency, and then filters for events where the 'severity' field contains 'MEDIUM'. The primary goal is to identify and flag these medium-severity incidents for further investigation and mitigation to prevent potential escalation of attacks.