CodexPluginStats
← CrowdStrike Falcon FoundryCONTENT HISTORY

Update to CrowdStrike Falcon Foundry

Snapshot Oct 8, 2026 · 18:03 UTC · version 1.6.0

WHAT CHANGED · RULE-BASED ANALYSIS

Package or technical metadata updated

Package contents changed in 34 files: .codex-plugin/assets/composer-icon.png, .codex-plugin/assets/logo.png, .codex-plugin/plugin.json, …. Open the file diff to inspect the edits.

Observed in package metadata. These changes alone do not establish a new customer-facing feature.

Package file

Before

{"sha256":"5132bd5af60a22182bd531e1e9e3f0f11784038b0ef2ef611459af7b80cb6ff9","size":10229}

After

Not present

Package file

Before

{"sha256":"5132bd5af60a22182bd531e1e9e3f0f11784038b0ef2ef611459af7b80cb6ff9","size":10229}

After

Not present

Package file

Before

3f197f87df1d44442a2fdfa5e040801907e64e4f507744210af6141de86fcce7

After

4eb6889b577e8bb0ef0d499c9e3ec6c42e9494b3bfea460804d3ba9bac7ee91c

Package file

Before

1446

After

1401

Compare saved observations

Download comparison JSON

Changed files

.codex-plugin/assets/composer-icon.png →

.codex-plugin/assets/logo.png →

.codex-plugin/plugin.json →

README.md →

skills/ai-agents-development/SKILL.md →

skills/ai-agents-development/references/knowledge-bases.md →

skills/ai-agents-development/references/manifest-schema.md →

skills/ai-agents-development/references/workflow-invocation.md →

skills/api-integrations/SKILL.md →

skills/api-integrations/references/calling-patterns.md →

skills/api-integrations/scripts/adapt_spec_for_foundry.py →

skills/collections-development/SKILL.md →

skills/debugging-workflows/SKILL.md →

skills/development-workflow/SKILL.md →

skills/development-workflow/references/advanced-patterns.md →

skills/development-workflow/references/counter-rationalizations.md →

skills/development-workflow/references/superpowers-integration.md →

skills/e2e-testing/SKILL.md →

skills/functions-development/SKILL.md →

skills/functions-development/references/execution-and-testing.md →

skills/functions-development/references/python-patterns.md →

skills/functions-development/references/testing-patterns.md →

skills/functions-falcon-api/SKILL.md →

skills/functions-falcon-api/references/advanced-patterns.md →

skills/fusion-redirect/SKILL.md →

skills/security-patterns/SKILL.md →

skills/security-patterns/references/security-examples.md →

skills/ui-development/SKILL.md →

skills/ui-development/references/blueprint-templates.md →

skills/ui-development/references/falcon-theming.md →

skills/ui-development/references/sandboxed-iframe.md →

skills/workflows-development/SKILL.md →

use-cases/greynoise-deep-dive.md →

use-cases/ngsiem-query-export.md →

use-cases/greynoise-deep-dive.md

--- before
+++ after
@@ -65,16 +65,6 @@
 gc.collect()
 ```
 
-### File size guard (lookup upload limit is 50 MB)
-
-```python
-file_size = os.path.getsize(output_path)
-logger.info(f"CSV file size: {file_size} bytes ({file_size / 1024 / 1024:.2f} MB)")
-if file_size > 47_000_000:  # buffer below 50 MB limit
-    logger.warning("File size > 47MB, stopping processing")
-    break
-```
-
 ### Upload lookup file via FalconPy
 
 ```python
@@ -83,6 +73,26 @@
 logger.info(f"API response: {response}")
 ```
 
+### Update large lookup files incrementally
+
+Once a lookup file exists, send only new or changed rows and let Falcon Next-Gen SIEM merge them on
+a key column, rather than rebuilding and re-uploading the whole file on every run:
+
+```python
+with open(output_path, "rb") as f:
+    response = ngsiem.update_lookup_file_entries(
+        search_domain=repository,
+        filename=os.path.basename(output_path),
+        file=f.read(),
+        update_mode="update",   # "append" when creating the file
+        key_columns="ip",
+        ignore_case="false",
+    )
+```
+
+The [Anomali ThreatStream sample](https://github.com/CrowdStrike/foundry-sample-anomali-threatstream)
+uses this pattern for its IOC lookup files.
+
 ### Manifest: extended function resources and required scope
 
 ```yaml
@@ -125,7 +135,7 @@
 
 ## Gotchas
 
-- **Lookup file upload limit is 50 MB**, not what the console displays. Add a file size guard at ~47 MB to leave buffer. This limit may increase in the future.
+- **Keep large lookup files incremental.** Rebuilding and re-uploading a large file on every run is slow and memory-heavy. Write rows in bounded batches and use `update_lookup_file_entries()` to merge new or changed rows instead of replacing the file.
 - **Memory is capped at 1024 MB**. Process API responses in batches (e.g., 10K records), write to CSV immediately, then delete the batch and run `gc.collect()`.
 - **Max execution time is 900 seconds**. Budget time across API fetch, CSV write, and upload. Log progress to track where time is spent.
 - **`humio-auth-proxy:write` scope is required** for `NGSIEM.upload_file()`. Missing this scope causes silent upload failures (function reports success, but no lookup file appears).
Full technical diff · 59 changed fields

removed /files/.codex-plugin~1assets~1composer-icon.png

BEFORE
{
  "sha256": "5132bd5af60a22182bd531e1e9e3f0f11784038b0ef2ef611459af7b80cb6ff9",
  "size": 10229
}
AFTER
Field is absent

removed /files/.codex-plugin~1assets~1logo.png

BEFORE
{
  "sha256": "5132bd5af60a22182bd531e1e9e3f0f11784038b0ef2ef611459af7b80cb6ff9",
  "size": 10229
}
AFTER
Field is absent

changed /files/.codex-plugin~1plugin.json/sha256

BEFORE
"3f197f87df1d44442a2fdfa5e040801907e64e4f507744210af6141de86fcce7"
AFTER
"4eb6889b577e8bb0ef0d499c9e3ec6c42e9494b3bfea460804d3ba9bac7ee91c"

changed /files/.codex-plugin~1plugin.json/size

BEFORE
1446
AFTER
1401

changed /files/README.md/sha256

BEFORE
"35dcb21b0767712e5ff0257a3010d9026539bb206d74eacffedc101d4bb50342"
AFTER
"2fbaa673dd7d8cae86f3623732f1705c712a701b188d9898b85aa7f3cbfdb08c"

changed /files/README.md/size

BEFORE
15811
AFTER
17507

added /files/skills~1ai-agents-development~1SKILL.md

BEFORE
Field was absent
AFTER
{
  "sha256": "60e1e06518b8a91d7293f6a3bdaac4b994439f8b90476e32a2c4d2f0d52ed46c",
  "size": 21835
}

added /files/skills~1ai-agents-development~1references~1knowledge-bases.md

BEFORE
Field was absent
AFTER
{
  "sha256": "3c90b0f2d2a9fed4614137253358826b65201ff2267a352a65ee2107cae9dfa8",
  "size": 5669
}

added /files/skills~1ai-agents-development~1references~1manifest-schema.md

BEFORE
Field was absent
AFTER
{
  "sha256": "b95ce80e5b30b4a2105c4c0c1c6bbfdc5c319ee3066cf6674df61b754c5851ff",
  "size": 10450
}

added /files/skills~1ai-agents-development~1references~1workflow-invocation.md

BEFORE
Field was absent
AFTER
{
  "sha256": "d3d0b1761dc1c97e80e1004b6258a6ab7788b72b8178f13e7dfd886e1e90c77a",
  "size": 6764
}

changed /files/skills~1api-integrations~1SKILL.md/sha256

BEFORE
"877e5f99d17a202deac7e72276dbe775efd9aceaf459c1e4f9678067a00fc1e0"
AFTER
"57f91ddf0ce841755005d445c628f3fae57ce985acb4713cddc038a8aca739a6"

changed /files/skills~1api-integrations~1SKILL.md/size

BEFORE
17429
AFTER
20085

changed /files/skills~1api-integrations~1references~1calling-patterns.md/sha256

BEFORE
"fb5e9e27414c150af2da2652e265b141ab05a509ca651562609b61cc0ac61c00"
AFTER
"cea164de12c95f2608cd167237f37a3b62a69a1cdff40ee0c166e58168ab161d"

changed /files/skills~1api-integrations~1references~1calling-patterns.md/size

BEFORE
8239
AFTER
9905

changed /files/skills~1api-integrations~1scripts~1adapt_spec_for_foundry.py/sha256

BEFORE
"661b0a0b556477740fa503d78661de374a614cc845271ff7bce5b56be3164141"
AFTER
"0b7d6a0c7f9fb979c117db450d5c1b4debe8767225d0598d029396c4235fd71b"

changed /files/skills~1api-integrations~1scripts~1adapt_spec_for_foundry.py/size

BEFORE
17366
AFTER
17750

changed /files/skills~1collections-development~1SKILL.md/sha256

BEFORE
"41086d83c485b8d52d6031f2441a7d0b340c0e3ac0c6bb0460082aee0da20a50"
AFTER
"c4f7accb086fb4baa5ed129d469b940abf0f56c9ca769e7c5aaaf80ae032073c"

changed /files/skills~1collections-development~1SKILL.md/size

BEFORE
14564
AFTER
18350

changed /files/skills~1debugging-workflows~1SKILL.md/sha256

BEFORE
"85a96dd26bf1f9547634910d33ef4a53195ad460225d725d42e3a665a325f86d"
AFTER
"6fc704a7b8a169f12f65c16e1fda8684dcd328ce5df0002f4e39ee2f6a8be614"

changed /files/skills~1debugging-workflows~1SKILL.md/size

BEFORE
16894
AFTER
18562

changed /files/skills~1development-workflow~1SKILL.md/sha256

BEFORE
"a70e8b49b1823f09643b5a50fbf98c5ce5724394d56a70e5b332083141cf4659"
AFTER
"7d00fc6c614bd33c15a87eda2e6c45d07d5ab9516a92417bc66d3320f04183d8"

changed /files/skills~1development-workflow~1SKILL.md/size

BEFORE
19844
AFTER
21642

changed /files/skills~1development-workflow~1references~1advanced-patterns.md/sha256

BEFORE
"4e4845e54ba671cde1917859467dbb7ffa2fe7992f35c8ecf5088d5e71de81ab"
AFTER
"c92b33b3c5d7e0d763cfc6ffcf7085731e0d1f82251777a72d3b20202b3e6f4a"

changed /files/skills~1development-workflow~1references~1advanced-patterns.md/size

BEFORE
10519
AFTER
15978

changed /files/skills~1development-workflow~1references~1counter-rationalizations.md/sha256

BEFORE
"9011e6867c150d5935ffdda4d1ed9c5955c47837712947764da5aea79dcf6bac"
AFTER
"f80803eaa0edd1cbc7fe07fb1a43c10fdd152c27ba0f7f3f238221ca93e619f7"

changed /files/skills~1development-workflow~1references~1counter-rationalizations.md/size

BEFORE
2856
AFTER
1072

changed /files/skills~1development-workflow~1references~1superpowers-integration.md/sha256

BEFORE
"a7073157ccb4e106f9acbe25c237718bae12a12591729028b2c83a644a8108e9"
AFTER
"727aa4cc31178e71ff8cafdb60796571de1a7d296b70a717c7b14d58d13a5709"

changed /files/skills~1development-workflow~1references~1superpowers-integration.md/size

BEFORE
5379
AFTER
5443

changed /files/skills~1e2e-testing~1SKILL.md/sha256

BEFORE
"41d0f30a8835ee77f0ca0712ad20ffc4d17416a69f7c22905ca3573c4d131993"
AFTER
"10bfe08a6baee205bc04cfcde109c673d0e019fab0fc38eb1faea78911be1ac8"

changed /files/skills~1functions-development~1SKILL.md/sha256

BEFORE
"fff2065b0c76473f9c5604f8d1b342204248d3f74c48562263a72a16dff5c2b3"
AFTER
"75e1c773a3bcfae328b3ba766f05b559e9621b3b00670062d09e49aa778ee97d"

changed /files/skills~1functions-development~1SKILL.md/size

BEFORE
20060
AFTER
21617

changed /files/skills~1functions-development~1references~1execution-and-testing.md/sha256

BEFORE
"08dc21b39243bf23cfc7a8c010a9f601cca011465fe39dafa249fcb58ab51b88"
AFTER
"e8997288a5a90d76eb16007868c2401afe8b985d8e216670b4f53576fe2b4b76"

changed /files/skills~1functions-development~1references~1execution-and-testing.md/size

BEFORE
24354
AFTER
25951

changed /files/skills~1functions-development~1references~1python-patterns.md/sha256

BEFORE
"9906bccc2e260f7763890ecddb75e00e75360ee887279ee0de8e579b63408e8c"
AFTER
"e783837c573adbda37eccfba1acc86311e90f54dd90120d6c6d172e8cbf2da48"

changed /files/skills~1functions-development~1references~1python-patterns.md/size

BEFORE
12766
AFTER
14229

changed /files/skills~1functions-development~1references~1testing-patterns.md/sha256

BEFORE
"3dc1db081fc4f421f5337cab00f117d5176efb03b0073adc24e0f0a8389266ad"
AFTER
"2cfccb9622476086bb65b26049bfe68c0f34fc90984a1b08f97e01471d2460a0"

changed /files/skills~1functions-development~1references~1testing-patterns.md/size

BEFORE
8971
AFTER
9774

changed /files/skills~1functions-falcon-api~1SKILL.md/sha256

BEFORE
"a1b4f97ff244adc28ab4b63dfd75f3682f03864ee08f277d0d0b4b78ea5ba71c"
AFTER
"594c8f35a460a950bc4268c2085dfcedc159a59dfde2e72e8194f99768064a53"

changed /files/skills~1functions-falcon-api~1SKILL.md/size

BEFORE
21028
AFTER
21591

changed /files/skills~1functions-falcon-api~1references~1advanced-patterns.md/sha256

BEFORE
"6bb869aa82f0c8230a8a4b36d8305f9ae268a6185fd761fdd71188e0deeadbd6"
AFTER
"f3723b6f62b13cd7c962ee5dce0fae0855c3841a485f8de657bd811845694999"

changed /files/skills~1functions-falcon-api~1references~1advanced-patterns.md/size

BEFORE
4513
AFTER
9009

changed /files/skills~1fusion-redirect~1SKILL.md/sha256

BEFORE
"e83b0b195e486dede85a82f9ed6245ec1204b22c8c5ccf1384d2531cce4c2fe4"
AFTER
"74bf0f7eaea14b9a2c24cc4310162bf04ae2d412b89900c1ac699a0c8042d410"

changed /files/skills~1security-patterns~1SKILL.md/sha256

BEFORE
"deb83d1c491539e251f07ed2ce7b8bbed0d350ad8e2c8167b6137191057f0f8b"
AFTER
"54360a49ee704b7dd6e9b1a2d65329588da980d5778fa895b4a09ccd29c7dc4b"

changed /files/skills~1security-patterns~1SKILL.md/size

BEFORE
7571
AFTER
7345

changed /files/skills~1security-patterns~1references~1security-examples.md/sha256

BEFORE
"17948b18bb1ebf56af4cb615ef4d46e098c8109609930c12bf12f290f2f60eaf"
AFTER
"e110b3334dc184b9f1a8c624a444a61dd9c295f74d681707fdd3564b08225011"

changed /files/skills~1security-patterns~1references~1security-examples.md/size

BEFORE
13229
AFTER
13298

changed /files/skills~1ui-development~1SKILL.md/sha256

BEFORE
"b533550837f498a48c18e493f430b71a149b26e50732a89329f8440d6e3a54d0"
AFTER
"8d0b68764321564000fbe29304934eec7c043a7270ef8ea1ae4812427e3f7c1b"

changed /files/skills~1ui-development~1SKILL.md/size

BEFORE
19801
AFTER
21651

changed /files/skills~1ui-development~1references~1blueprint-templates.md/sha256

BEFORE
"f2e078c09b4677d0c978866dd90d9a50beef7a2c451b3b9f0f5b37327056e873"
AFTER
"b7ba2879390c378d5b329741217847bebaf8afd6262ac73ad343309ce52231b2"

changed /files/skills~1ui-development~1references~1blueprint-templates.md/size

BEFORE
10713
AFTER
11357

changed /files/skills~1ui-development~1references~1falcon-theming.md/sha256

BEFORE
"f5cbe71553bd83dd34aff6fc39b354c0075de32734d841a9ac3bb6b767ac12f1"
AFTER
"94759ff019504a923c2cdf85189e072615122535bd2afa433d35621347b92151"

changed /files/skills~1ui-development~1references~1falcon-theming.md/size

BEFORE
6521
AFTER
6796

added /files/skills~1ui-development~1references~1sandboxed-iframe.md

BEFORE
Field was absent
AFTER
{
  "sha256": "9b2f18b3a6c5fa869553011c63930cd7f3144dc9e8b78c8cdd788ce8f46564b5",
  "size": 3903
}

changed /files/skills~1workflows-development~1SKILL.md/sha256

BEFORE
"1af9d9d4ac310dfa89cf03160989bea6b34ac3d18b3adf7f78b897bcffd88bfd"
AFTER
"223720c0d3c8876c1219df32ec60ac8922d09ded933a6ba8edafd22ec362116d"

changed /files/skills~1workflows-development~1SKILL.md/size

BEFORE
21676
AFTER
21922

changed /files/use-cases~1greynoise-deep-dive.md/sha256

BEFORE
"6f950020c91283e6ecf1093d4b8e27ebb63a1b8bc4512a188ff71c11def70723"
AFTER
"e6d56b2c2224ce344fc9eda34a37e972e07274cacb8e8494287db512085c4bfa"

changed /files/use-cases~1greynoise-deep-dive.md/size

BEFORE
5242
AFTER
5725

changed /files/use-cases~1ngsiem-query-export.md/sha256

BEFORE
"8b909631a97ffedd0b6a1f61fa9b3c4e5da12c2a8e21414efc7ca63eb10a7705"
AFTER
"d8c12f51870ca5c5a7d8a3d867257a8115805da1e8fe04d6e7fafd7a0cdfdf01"

changed /files/use-cases~1ngsiem-query-export.md/size

BEFORE
6630
AFTER
6827
Full snapshot data
{
  "files": {
    ".codex-plugin/plugin.json": {
      "sha256": "4eb6889b577e8bb0ef0d499c9e3ec6c42e9494b3bfea460804d3ba9bac7ee91c",
      "size": 1401
    },
    "LICENSE": {
      "sha256": "98e0a8035cd69aa3f126e1f6c4f3922d350cb2253ad79807f895d9d04e373d46",
      "size": 1076
    },
    "README.md": {
      "sha256": "2fbaa673dd7d8cae86f3623732f1705c712a701b188d9898b85aa7f3cbfdb08c",
      "size": 17507
    },
    "assets/crowdstrike-logo.png": {
      "sha256": "5132bd5af60a22182bd531e1e9e3f0f11784038b0ef2ef611459af7b80cb6ff9",
      "size": 10229
    },
    "requirements.txt": {
      "sha256": "512249ffb3d6c6aed0bbabc674577f4383178c878a29a7e93e986fea90e9c7e4",
      "size": 174
    },
    "skills/ai-agents-development/SKILL.md": {
      "sha256": "60e1e06518b8a91d7293f6a3bdaac4b994439f8b90476e32a2c4d2f0d52ed46c",
      "size": 21835
    },
    "skills/ai-agents-development/references/knowledge-bases.md": {
      "sha256": "3c90b0f2d2a9fed4614137253358826b65201ff2267a352a65ee2107cae9dfa8",
      "size": 5669
    },
    "skills/ai-agents-development/references/manifest-schema.md": {
      "sha256": "b95ce80e5b30b4a2105c4c0c1c6bbfdc5c319ee3066cf6674df61b754c5851ff",
      "size": 10450
    },
    "skills/ai-agents-development/references/workflow-invocation.md": {
      "sha256": "d3d0b1761dc1c97e80e1004b6258a6ab7788b72b8178f13e7dfd886e1e90c77a",
      "size": 6764
    },
    "skills/api-integrations/SKILL.md": {
      "sha256": "57f91ddf0ce841755005d445c628f3fae57ce985acb4713cddc038a8aca739a6",
      "size": 20085
    },
    "skills/api-integrations/references/auth-examples.md": {
      "sha256": "d8e3cb92b8135bce7adf1c1a70b3198ceefdc9eb047ce985038007651c7d67fe",
      "size": 3576
    },
    "skills/api-integrations/references/calling-patterns.md": {
      "sha256": "cea164de12c95f2608cd167237f37a3b62a69a1cdff40ee0c166e58168ab161d",
      "size": 9905
    },
    "skills/api-integrations/references/spec-adaptation-examples.md": {
      "sha256": "7f361cf400c96d5097797aff7d7a37cd8dae65729c1a7f4f3ad6716b10337caf",
      "size": 6185
    },
    "skills/api-integrations/scripts/adapt_spec_for_foundry.py": {
      "sha256": "0b7d6a0c7f9fb979c117db450d5c1b4debe8767225d0598d029396c4235fd71b",
      "size": 17750
    },
    "skills/collections-development/SKILL.md": {
      "sha256": "c4f7accb086fb4baa5ed129d469b940abf0f56c9ca769e7c5aaaf80ae032073c",
      "size": 18350
    },
    "skills/collections-development/references/advanced-patterns.md": {
      "sha256": "cf6246c67d3d993acd494a6bd6d4937f91ff5d656b49a1abbaffc7870bdd5f75",
      "size": 9297
    },
    "skills/debugging-workflows/SKILL.md": {
      "sha256": "6fc704a7b8a169f12f65c16e1fda8684dcd328ce5df0002f4e39ee2f6a8be614",
      "size": 18562
    },
    "skills/development-workflow/SKILL.md": {
      "sha256": "7d00fc6c614bd33c15a87eda2e6c45d07d5ab9516a92417bc66d3320f04183d8",
      "size": 21642
    },
    "skills/development-workflow/references/advanced-patterns.md": {
      "sha256": "c92b33b3c5d7e0d763cfc6ffcf7085731e0d1f82251777a72d3b20202b3e6f4a",
      "size": 15978
    },
    "skills/development-workflow/references/counter-rationalizations.md": {
      "sha256": "f80803eaa0edd1cbc7fe07fb1a43c10fdd152c27ba0f7f3f238221ca93e619f7",
      "size": 1072
    },
    "skills/development-workflow/references/headless-operation.md": {
      "sha256": "6ff5cfec2ba47a66915c1722783460aa9b9bc1d121c907cca17a349a309e85b5",
      "size": 9141
    },
    "skills/development-workflow/references/performance-optimization.md": {
      "sha256": "bef6aed81d05fe31442121c4633568387013dce88c6e0f4970264746647518dc",
      "size": 2027
    },
    "skills/development-workflow/references/superpowers-integration.md": {
      "sha256": "727aa4cc31178e71ff8cafdb60796571de1a7d296b70a717c7b14d58d13a5709",
      "size": 5443
    },
    "skills/development-workflow/scripts/detect_fusion_redirect.py": {
      "sha256": "a3b1a35ee6af0659df1026c7dc91d4fadf0e7b13507503548d2898b6e8a2e0a7",
      "size": 5466
    },
    "skills/e2e-testing/SKILL.md": {
      "sha256": "10bfe08a6baee205bc04cfcde109c673d0e019fab0fc38eb1faea78911be1ac8",
      "size": 21255
    },
    "skills/e2e-testing/references/debugging-with-mcp.md": {
      "sha256": "2ec362bcba75dcf35fea006554c2df3b3dab735b24ca143f51e55012f7eda80a",
      "size": 5012
    },
    "skills/functions-development/SKILL.md": {
      "sha256": "75e1c773a3bcfae328b3ba766f05b559e9621b3b00670062d09e49aa778ee97d",
      "size": 21617
    },
    "skills/functions-development/references/code-review-checklist.md": {
      "sha256": "f919a2fc42f0c5f09c37f3155749245e892203e9c4137ec12aab0deea7c4a74c",
      "size": 5752
    },
    "skills/functions-development/references/execution-and-testing.md": {
      "sha256": "e8997288a5a90d76eb16007868c2401afe8b985d8e216670b4f53576fe2b4b76",
      "size": 25951
    },
    "skills/functions-development/references/go-patterns.md": {
      "sha256": "2eba409b628a1080d710ba3746c3c5513f0ea9485b1dc123138a77106aa756ba",
      "size": 6790
    },
    "skills/functions-development/references/python-patterns.md": {
      "sha256": "e783837c573adbda37eccfba1acc86311e90f54dd90120d6c6d172e8cbf2da48",
      "size": 14229
    },
    "skills/functions-development/references/testing-patterns.md": {
      "sha256": "2cfccb9622476086bb65b26049bfe68c0f34fc90984a1b08f97e01471d2460a0",
      "size": 9774
    },
    "skills/functions-falcon-api/SKILL.md": {
      "sha256": "594c8f35a460a950bc4268c2085dfcedc159a59dfde2e72e8194f99768064a53",
      "size": 21591
    },
    "skills/functions-falcon-api/references/advanced-patterns.md": {
      "sha256": "f3723b6f62b13cd7c962ee5dce0fae0855c3841a485f8de657bd811845694999",
      "size": 9009
    },
    "skills/fusion-redirect/SKILL.md": {
      "sha256": "74bf0f7eaea14b9a2c24cc4310162bf04ae2d412b89900c1ac699a0c8042d410",
      "size": 2557
    },
    "skills/security-patterns/SKILL.md": {
      "sha256": "54360a49ee704b7dd6e9b1a2d65329588da980d5778fa895b4a09ccd29c7dc4b",
      "size": 7345
    },
    "skills/security-patterns/references/security-examples.md": {
      "sha256": "e110b3334dc184b9f1a8c624a444a61dd9c295f74d681707fdd3564b08225011",
      "size": 13298
    },
    "skills/ui-development/SKILL.md": {
      "sha256": "8d0b68764321564000fbe29304934eec7c043a7270ef8ea1ae4812427e3f7c1b",
      "size": 21651
    },
    "skills/ui-development/references/advanced-patterns.md": {
      "sha256": "1b06fa851b0b908f2aa63554cba84a4b8c589308a6aec76f3fdb0a0074501320",
      "size": 10767
    },
    "skills/ui-development/references/blueprint-templates.md": {
      "sha256": "b7ba2879390c378d5b329741217847bebaf8afd6262ac73ad343309ce52231b2",
      "size": 11357
    },
    "skills/ui-development/references/falcon-theming.md": {
      "sha256": "94759ff019504a923c2cdf85189e072615122535bd2afa433d35621347b92151",
      "size": 6796
    },
    "skills/ui-development/references/foundry-js.md": {
      "sha256": "3eaf2f283dda65bf8e50040b096cd2dbb1c244326d270753d4b763055bcfc048",
      "size": 6731
    },
    "skills/ui-development/references/react-patterns.md": {
      "sha256": "e1352ab239f691747c89b7497efd4442777bdb490ee89ad6008b1dc1b8669759",
      "size": 13138
    },
    "skills/ui-development/references/sandboxed-iframe.md": {
      "sha256": "9b2f18b3a6c5fa869553011c63930cd7f3144dc9e8b78c8cdd788ce8f46564b5",
      "size": 3903
    },
    "skills/ui-development/references/shoelace-reference.md": {
      "sha256": "3a58104ca6437fdc7aad0d9d8d66442e6f49b5ff21b18b96726eda48e4804533",
      "size": 7076
    },
    "skills/ui-development/references/vue-patterns.md": {
      "sha256": "c2b1cb5997a011ed45b6f842f13187d7f8f62b66d9761f041222474c7ddc2a2b",
      "size": 7877
    },
    "skills/workflows-development/SKILL.md": {
      "sha256": "223720c0d3c8876c1219df32ec60ac8922d09ded933a6ba8edafd22ec362116d",
      "size": 21922
    },
    "skills/workflows-development/references/action-discovery.md": {
      "sha256": "5ec918d9aae754feb33a898ed8120511b0bc91b2afcef132c09da4250822115a",
      "size": 3322
    },
    "skills/workflows-development/references/advanced-patterns.md": {
      "sha256": "c507760d2ee9da89db81d9526e1495c9ab09f763aab1ac7ae71dad585996bd42",
      "size": 8801
    },
    "skills/workflows-development/references/cel-expressions.md": {
      "sha256": "3108a44df72ecb3a1ed3ac0fcce80187bdfe056b57d91567a96732cc9440ef60",
      "size": 2678
    },
    "skills/workflows-development/references/event-query-vs-api.md": {
      "sha256": "959ec087f92e1ff88f04d4a275d39979c88497347cececda5e7c53d7b9bbd3f7",
      "size": 2605
    },
    "skills/workflows-development/references/http-actions.md": {
      "sha256": "e1a388ce26ac69ffdc9816206e5ac937848f273d6bf2c28b43ac81303f40434a",
      "size": 7457
    },
    "skills/workflows-development/references/pagination-patterns.md": {
      "sha256": "a10ced00650004dd2d5442180c5c711571ed8b0125f78c1bb610e1b192965858",
      "size": 1702
    },
    "skills/workflows-development/references/workflow-examples.md": {
      "sha256": "f34cc4fa38b074f35933a35f33f48b0b45bbd640611e3482e30eb19564f5b3ef",
      "size": 13367
    },
    "skills/workflows-development/scripts/action_search.py": {
      "sha256": "410551258500301b94923a01f7a2ed78a1b0da7a981f2645811f5543cdc7fa15",
      "size": 3694
    },
    "use-cases/README.md": {
      "sha256": "5ac2b974aef907b81c0df2b569639348e27f6ea3996619c208d20dc8b8ebe37e",
      "size": 2018
    },
    "use-cases/api-pagination.md": {
      "sha256": "927f7e35486da78f5d9b384dc09d4e882a3e391d5efdad18b80a50ae267d404b",
      "size": 6162
    },
    "use-cases/collections.md": {
      "sha256": "6f44951bd8754c07270bbbeaba31a2040d00950e79bb9c9b8a65f10672912c70",
      "size": 5363
    },
    "use-cases/custom-soar-actions.md": {
      "sha256": "a1250afd03a9f665cd09e567264e648e3359e861d6f94d544028256b8b47c158",
      "size": 4213
    },
    "use-cases/detection-enrichment.md": {
      "sha256": "2416897b34397a27168778982b3ac2f23ff8a9c59809a1335a098af71148dc4b",
      "size": 4741
    },
    "use-cases/first-app.md": {
      "sha256": "8d1a207066aee61812acfd472bbed99a08710b409d0040bf18548b91b66386db",
      "size": 4013
    },
    "use-cases/graphql-apis.md": {
      "sha256": "33f52462cf116d99b9adea48dde9263e301be486bda81f10f62945826b7ad6fe",
      "size": 3252
    },
    "use-cases/greynoise-deep-dive.md": {
      "sha256": "e6d56b2c2224ce344fc9eda34a37e972e07274cacb8e8494287db512085c4bfa",
      "size": 5725
    },
    "use-cases/http-actions.md": {
      "sha256": "c621435694a80ab089c2841b2f61320cfad8eb65e11a033733f4ca6069211072",
      "size": 5155
    },
    "use-cases/logscale-ingestion.md": {
      "sha256": "99374e07c6618c0163c9601de2b92f47b3016644264582491bc84b301aa8eb29",
      "size": 4195
    },
    "use-cases/lookup-table-enrichment.md": {
      "sha256": "93cc6c50d79f4cbd7f2591a34c326688a4150ecc58e1979a88e44db60b7f03c2",
      "size": 4052
    },
    "use-cases/ngsiem-query-export.md": {
      "sha256": "d8c12f51870ca5c5a7d8a3d867257a8115805da1e8fe04d6e7fafd7a0cdfdf01",
      "size": 6827
    },
    "use-cases/publishing-certified-apps.md": {
      "sha256": "37fcee6fc88764ae502353bd9c01d77e3242a2ce0e382254dd59ed1f22eb62f3",
      "size": 4031
    },
    "use-cases/python-functions.md": {
      "sha256": "26fb1556eb9a83ba2b756d4eec1693256208e5a74702347150b0d8fe1901cc8b",
      "size": 5607
    },
    "use-cases/schemaless-queries.md": {
      "sha256": "142ab5a55fc17e6664e99fdc51f485e7ab0d960109c2a62d77fefd970c316fda",
      "size": 4687
    }
  }
}

SHA-256 of public snapshot: e932b6004d915748dd77837b3c9b4c5505ee0f37b61dcf9b836ae614a9ecac4f