Repository: demisto/content
Pull request #40009: Ciac 13561 refactoring crowd strike falcon integration
Author: login: lironcohen272
Labels: name: docs-approved
name: ready-for-pipeline-running
description: Whether the pr is ready for running the whole pipeline, including testing on SAAS machines
Created: 2025-05-19T13:23:13Z | Merged: 2025-05-21T08:26:18Z

## Related Issues
fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-13713 https://jira-dc.paloaltonetworks.com/browse/CIAC-13831

## Description
- Create one generic function: _fetch_items()_ for both _"fetch-events"_ and "_fetch-incidents"_ commands
(instead of functions: _fetch_events()_ and _fetch_incidents()_
- Update last_run object structure + Enum indexes + getter and setter functions. 
- New structure validation test for last_run object.
- Update existing tests to run with the new last_object.





Diff:
diff --git a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
index 63dc645ede81..bcc8e58494ce 100644
--- a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
+++ b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
@@ -7,7 +7,7 @@
 import hashlib
 import json
 from collections.abc import Callable
-from enum import Enum
+from enum import Enum, IntEnum
 from threading import Timer
 from typing import Any
 
@@ -26,8 +26,12 @@
 IDP_DETECTION = "IDP detection"
 MOBILE_DETECTION = "MOBILE detection"
 ENDPOINT_DETECTION = "detection"
+DETECTION_FETCH_TYPES = ["Detections", "Endpoint Detection"]
+INCIDENT_FETCH_TYPES = ["Incidents", "Endpoint Incident"]
 IDP_DETECTION_FETCH_TYPE = "IDP Detection"
 MOBILE_DETECTION_FETCH_TYPE = "Mobile Detection"
+IOA_FETCH_TYPE = "Indicator of Attack"
+IOM_FETCH_TYPE = "Indicator of Misconfiguration"
 ON_DEMAND_SCANS_DETECTION_TYPE = "On-Demand Scans Detection"
 ON_DEMAND_SCANS_DETECTION = "On-Demand Scans detection"
 OFP_DETECTION_TYPE = "OFP Detection"
@@ -352,6 +356,31 @@
     "monthly": 30,
 }
 
+TOTAL_FETCH_TYPE_XSOAR = 8
+TOTAL_FETCH_TYPE_XSIAM = 6
+
+
+class LastRunIndex(IntEnum):
+    """
+    The last_run object is defined as a list of dictionaries.
+    Each index in the list represents a different fetch type.
+    The last_run object is supported only in the following scenario:
+    The fetch_incidents command runs on XSOAR (and not on XSIAM),
+    while the fetch_events command runs on XSIAM (and not on XSOAR).
+    """
+
+    # Common fetch types for fetch-incidents and fetch-events.
+    DETECTIONS = 0
+    INCIDENTS = 1
+    IDP_DETECTIONS = 2
+    MOBILE_DETECTIONS = 3
+    ON_DEMAND_DETECTIONS = 4
+    OFP_DETECTION = 5
+
+    # Fetch types only for fetch-incidents
+    IOM = 6
+    IOA = 7
+
 
 class IncidentType(Enum):
     INCIDENT = "inc"
@@ -370,6 +399,14 @@ class IncidentType(Enum):
 """ HELPER FUNCTIONS """
 
 
+def is_detection_fetch_type_selected(selected_types: list):
+    return any(detection_type in selected_types for detection_type in DETECTION_FETCH_TYPES)
+
+
+def is_incident_fetch_type_selected(selected_types: list):
+    return any(incident_type in selected_types for incident_type in INCIDENT_FETCH_TYPES)
+
+
 def disable_for_xsiam():
     """Validates if command is not running on an unsupported Cortex platform.
 
@@ -2915,553 +2952,494 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        current_length = len(result)
+        result.extend([{} for _ in range(last_run_length - current_length)])
+        return result
 
 
-def fetch_incidents():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    iom_incidents: list[dict[str, Any]] = []
-    ioa_incidents: list[dict[str, Any]] = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    iom_last_run: dict = {} if len(last_run) < 4 else last_run[3]
-    ioa_last_run: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 6 else last_run[5]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 7 else last_run[6]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 8 else last_run[7]
-    params = demisto.params()
+def fetch_endpoint_detections(current_fetch_info_detections, look_back, is_fetch_events):
+    """
+    Fetch detections from CrowdStrike Falcon api.
 
-    fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+    Args:
+        current_fetch_info_detections (dict): The last_run for detection fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for detection
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    look_back = int(params.get("look_back") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+    Returns:
+        tuple: A tuple containing a list of detections and the updated fetch information dictionary.
+    """
+    detections = []
+    fetch_limit = MAX_FETCH_DETECTION_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    detections_offset: int = current_fetch_info_detections.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or INCIDENTS_PER_FETCH
+    fetch_limit = current_fetch_info_detections.get("limit") or fetch_limit
+    incident_type = "detection"
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    fetch_query = demisto.params().get("fetch_query")
+    if fetch_query:
+        fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
+        response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
+    else:
+        response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection)
-                detections.append(incident)
+    detections_ids: list[dict] = demisto.get(response, "resources", [])
+    total_detections = demisto.get(response, "meta.pagination.total")
+    detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
+    if detections_offset:
+        if detections_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            detections_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
+    raw_res = get_detections_entities(detections_ids)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+    if raw_res is not None and "resources" in raw_res:
+        full_detections = demisto.get(raw_res, "resources")
+        for detection in full_detections:
+            detection["incident_type"] = incident_type
+            # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
+            detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: Detection {detection_id} "
+                f"was fetched which was created in {detection['created_timestamp']}"
+            )
+            incident = detection_to_incident(detection, is_fetch_events=is_fetch_events)
+            detections.append(incident)
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    detections = filter_incidents_by_duplicates_and_limit(
+        incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
+    )
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    for detection in detections:
+        occurred = dateparser.parse(detection["occurred"])
+        if occurred:
+            detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or INCIDENTS_PER_FETCH
-        incident_type = "incident"
+    current_fetch_info_detections = update_last_run_object(
+        last_run=current_fetch_info_detections,
+        incidents=detections,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DETECTION_DATE_FORMAT,
+        new_offset=detections_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
 
-        fetch_query = params.get("incidents_fetch_query")
+    return detections, current_fetch_info_detections
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+def fetch_endpoint_incidents(current_fetch_info_incidents, look_back, is_fetch_events):
+    """
+    Fetch incidents from CrowdStrike Falcon api.
 
-    if IDP_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        idp_detections, current_fetch_info_idp_detections = fetch_detections_by_product_type(
-            current_fetch_info_idp_detections,
-            look_back=look_back,
-            fetch_query=params.get("idp_detections_fetch_query", ""),
-            detections_type=IDP_DETECTION,
-            product_type="idp",
-            detection_name_prefix=IDP_DETECTION_FETCH_TYPE,
-            start_time_key="created_timestamp",
-        )
+    Args:
+        current_fetch_info_incidents (dict): The last_run of incident fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for incidents
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if MOBILE_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        mobile_detections, current_fetch_info_mobile_detections = fetch_detections_by_product_type(
-            current_fetch_info_mobile_detections,
-            look_back=look_back,
-            fetch_query=params.get("mobile_detections_fetch_query", ""),
-            detections_type=MOBILE_DETECTION,
-            product_type="mobile",
-            detection_name_prefix=MOBILE_DETECTION_FETCH_TYPE,
-            start_time_key="timestamp",
-        )
+    Returns:
+        tuple: A tuple containing a list of incidents and the updated fetch information dictionary.
+    """
+    incidents = []
+    fetch_limit = MAX_FETCH_INCIDENT_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    if "Indicator of Misconfiguration" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Misconfiguration incidents")
-        demisto.debug(f"{iom_last_run=}")
-        fetch_query = params.get("iom_fetch_query", "")
-        validate_iom_fetch_query(iom_fetch_query=fetch_query)
-
-        last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
-            last_run_object=iom_last_run,
-            date_format=IOM_DATE_FORMAT,
-            last_date_key="last_scan_time",
-            next_token_key="iom_next_token",
-            last_fetched_ids_key="last_resource_ids",
-        )
-        filter = create_iom_filter(
-            is_paginating=bool(iom_next_token),
-            last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
-            last_scan_time=last_scan_time,
-            first_fetch_timestamp=first_fetch_timestamp,
-            configured_fetch_query=fetch_query,
-        )
-        demisto.debug(f"IOM {filter=}")
-        iom_resource_ids, iom_new_next_token = iom_ids_pagination(
-            filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
-        )
-        demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
-        iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
-            fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
-            last_date=last_scan_time,
-            last_fetched_ids=last_resource_ids,
-            date_key="scan_time",
-            id_key="id",
-            date_format=IOM_DATE_FORMAT,
-            is_paginating=bool(iom_new_next_token or iom_next_token),
-            to_incident_context=iom_resource_to_incident,
-            incident_type="iom_configurations",
-        )
+    incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
+    )
 
-        iom_last_run = {
-            "iom_next_token": iom_new_next_token,
-            "last_scan_time": new_scan_time,
-            "last_fetch_filter": filter,
-            "last_resource_ids": fetched_resource_ids or last_resource_ids,
-        }
+    fetch_limit = current_fetch_info_incidents.get("limit") or fetch_limit
+    incident_type = "incident"
 
-    if "Indicator of Attack" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Attack incidents")
-        demisto.debug(f"{ioa_last_run=}")
-        fetch_query = params.get("ioa_fetch_query", "")
-        validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
-
-        last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
-            last_run_object=ioa_last_run,
-            date_format=DATE_FORMAT,
-            last_date_key="last_date_time_since",
-            next_token_key="ioa_next_token",
-            last_fetched_ids_key="last_event_ids",
-        )
-        ioa_fetch_query = create_ioa_query(
-            is_paginating=bool(ioa_next_token),
-            configured_fetch_query=fetch_query,
-            last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
-            last_date_time_since=last_date_time_since,
-        )
-        demisto.debug(f"IOA {ioa_fetch_query=}")
-        ioa_events, ioa_new_next_token = ioa_events_pagination(
-            ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
-        )
-        demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
-
-        ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
-            fetched_data=ioa_events,
-            last_date=last_date_time_since,
-            last_fetched_ids=last_fetch_event_ids,
-            date_key="event_created",
-            id_key="event_id",
-            date_format=DATE_FORMAT,
-            is_paginating=bool(ioa_new_next_token or ioa_next_token),
-            to_incident_context=ioa_event_to_incident,
-            incident_type="ioa_events",
-        )
+    fetch_query = demisto.params().get("incidents_fetch_query")
+    if fetch_query:
+        fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
+        response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        ioa_last_run = {
-            "ioa_next_token": ioa_new_next_token,
-            "last_date_time_since": new_date_time_since,
-            "last_fetch_query": ioa_fetch_query,
-            "last_event_ids": ioa_event_ids or last_fetch_event_ids,
-        }
+    else:
+        response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
+    incidents_ids: list[dict] = demisto.get(response, "resources", [])
+    total_incidents = demisto.get(response, "meta.pagination.total")
+    incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
+    if incidents_offset:
+        if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            incidents_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
 
-    if ON_DEMAND_SCANS_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException("On-Demand Scans Detection is not supported in legacy version.")
-        demisto.debug("Fetching On-Demand Scans Detection incidents")
-        demisto.debug(f"on_demand_detections_last_run= {current_fetch_on_demand_detections}")
+    if incidents_ids:
+        raw_res = get_incidents_entities(incidents_ids)
+        if raw_res is not None and "resources" in raw_res:
+            full_incidents = demisto.get(raw_res, "resources")
+            for incident in full_incidents:
+                incident["incident_type"] = incident_type
+                incident_to_context = incident_to_incident_context(incident, is_fetch_events=is_fetch_events)
+                incidents.append(incident_to_context)
+
+    incidents = filter_incidents_by_duplicates_and_limit(
+        incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
+    )
+    for incident in incidents:
+        occurred = dateparser.parse(incident["occurred"])
+        if occurred:
+            incident["occurred"] = occurred.strftime(DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
+
+    current_fetch_info_incidents = update_last_run_object(
+        last_run=current_fetch_info_incidents,
+        incidents=incidents,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DATE_FORMAT,
+        new_offset=incidents_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
 
-        on_demand_detections, current_fetch_on_demand_detections = fetch_detections_by_product_type(
-            current_fetch_on_demand_detections,
-            look_back=look_back,
-            fetch_query=params.get("on_demand_fetch_query", ""),
-            detections_type=ON_DEMAND_SCANS_DETECTION,
-            product_type="ods",
-            detection_name_prefix=ON_DEMAND_SCANS_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+    return incidents, current_fetch_info_incidents
 
-    if OFP_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException(f"{OFP_DETECTION_TYPE} is not supported in legacy version.")
-        demisto.debug(f"Fetching {OFP_DETECTION_TYPE} incidents")
-        demisto.debug(f"ofp_detection_last_run= {current_fetch_ofp_detection}")
 
-        ofp_detections, current_fetch_ofp_detection = fetch_detections_by_product_type(
-            current_fetch_ofp_detection,
-            look_back=look_back,
-            fetch_query=params.get("ofp_detection_fetch_query", ""),
-            detections_type=OFP_DETECTION,
-            product_type="ofp",
-            detection_name_prefix=OFP_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+def fetch_iom_incidents(iom_last_run):
+    demisto.debug("Fetching Indicator of Misconfiguration incidents")
+    demisto.debug(f"{iom_last_run=}")
+    fetch_query = demisto.params().get("iom_fetch_query", "")
+    validate_iom_fetch_query(iom_fetch_query=fetch_query)
 
-    demisto.setLastRun(
-        [
-            current_fetch_info_detections,
-            current_fetch_info_incidents,
-            current_fetch_info_idp_detections,
-            iom_last_run,
-            ioa_last_run,
-            current_fetch_info_mobile_detections,
-            current_fetch_on_demand_detections,
-            current_fetch_ofp_detection,
-        ]
+    last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
+        last_run_object=iom_last_run,
+        date_format=IOM_DATE_FORMAT,
+        last_date_key="last_scan_time",
+        next_token_key="iom_next_token",
+        last_fetched_ids_key="last_resource_ids",
     )
-    return (
-        incidents
-        + detections
-        + idp_detections
-        + iom_incidents
-        + ioa_incidents
-        + mobile_detections
-        + on_demand_detections
-        + ofp_detections
+    filter = create_iom_filter(
+        is_paginating=bool(iom_next_token),
+        last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
+        last_scan_time=last_scan_time,
+        first_fetch_timestamp=first_fetch_timestamp,
+        configured_fetch_query=fetch_query,
+    )
+    demisto.debug(f"IOM {filter=}")
+    iom_resource_ids, iom_new_next_token = iom_ids_pagination(
+        filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
+    )
+    demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
+    iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
+        fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
+        last_date=last_scan_time,
+        last_fetched_ids=last_resource_ids,
+        date_key="scan_time",
+        id_key="id",
+        date_format=IOM_DATE_FORMAT,
+        is_paginating=bool(iom_new_next_token or iom_next_token),
+        to_incident_context=iom_resource_to_incident,
+        incident_type="iom_configurations",
     )
 
+    iom_last_run = {
+        "iom_next_token": iom_new_next_token,
+        "last_scan_time": new_scan_time,
+        "last_fetch_filter": filter,
+        "last_resource_ids": fetched_resource_ids or last_resource_ids,
+    }
 
-def fetch_events():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run, is_fetch_events=True)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 4 else last_run[3]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 6 else last_run[5]
-    params = demisto.params()
+    return iom_incidents, iom_last_run
 
-    fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
 
-    look_back = int(params.get("look_back_xsiam") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+def fetch_ioa_incidents(ioa_last_run):
+    demisto.debug("Fetching Indicator of Attack incidents")
+    demisto.debug(f"{ioa_last_run=}")
+    fetch_query = demisto.params().get("ioa_fetch_query", "")
+    validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
+        last_run_object=ioa_last_run,
+        date_format=DATE_FORMAT,
+        last_date_key="last_date_time_since",
+        next_token_key="ioa_next_token",
+        last_fetched_ids_key="last_event_ids",
+    )
+    ioa_fetch_query = create_ioa_query(
+        is_paginating=bool(ioa_next_token),
+        configured_fetch_query=fetch_query,
+        last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
+        last_date_time_since=last_date_time_since,
+    )
+    demisto.debug(f"IOA {ioa_fetch_query=}")
+    ioa_events, ioa_new_next_token = ioa_events_pagination(
+        ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
+    )
+    demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
+
+    ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
+        fetched_data=ioa_events,
+        last_date=last_date_time_since,
+        last_fetched_ids=last_fetch_event_ids,
+        date_key="event_created",
+        id_key="event_id",
+        date_format=DATE_FORMAT,
+        is_paginating=bool(ioa_new_next_token or ioa_next_token),
+        to_incident_context=ioa_event_to_incident,
+        incident_type="ioa_events",
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or MAX_FETCH_DETECTION_PER_API_CALL
+    ioa_last_run = {
+        "ioa_next_token": ioa_new_next_token,
+        "last_date_time_since": new_date_time_since,
+        "last_fetch_query": ioa_fetch_query,
+        "last_event_ids": ioa_event_ids or last_fetch_event_ids,
+    }
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    return ioa_incidents, ioa_last_run
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection, is_fetch_events=True)
-                detections.append(incident)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+def set_last_run_per_type(last_run: list, index: LastRunIndex, data: dict, is_fetch_events=False) -> None:
+    """
+    Safely set the specific sub last_run dictionary in the main last_run list.
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        data: The data to set for the specified fetch type
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    Returns:
+        The updated last_run list.
+    """
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type1")
+    if not isinstance(data, dict):
+        demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type2")
+        return_error(f"Invalid data type : last_run is a list of dictionary, expected dictionary, got {type(data).__name__}")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type3")
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type4")
+    if index >= last_run_length:
+        return_error(f"Invalid last_run index {index}, cannot exceed {last_run_length - 1}")
+    if index < 0:
+        return_error(f"Invalid last_run index {index}, index cannot be negative")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type5")
+    # Extend the list if necessary to accommodate the fetch_type index
+    while len(last_run) <= index:
+        last_run.append({})
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type6")
+    last_run[index] = data
+    demisto.debug(f"CrowdStrikeFalconMsg: set_last_run_per_type7 {last_run}")
+
+
+def get_last_run_per_type(last_run: list, fetch_type: LastRunIndex) -> dict:
+    """
+    Safely get the specific sub last_run dictionary from the main last_run list.
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or MAX_FETCH_INCIDENT_PER_API_CALL
-        incident_type = "incident"
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        default: Default value if not present (defaults to empty dict)
 
-        fetch_query = params.get("incidents_fetch_query")
+    Returns:
+        The last_run dict from the list for the requested type.
+    """
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
+    if len(last_run) <= fetch_type:
+        return {}
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident, is_fetch_events=True)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+    return last_run[fetch_type]
+
+
+def fetch_items(command="fetch-incidents"):
+    """
+    Fetch incidents or events from CrowdStrike Falcon based on configuration.
+
+    Args:
+        command (str): Either 'fetch-incidents' or 'fetch-events'
+
+    Returns:
+        tuple: (last_run, items) where last_run is the updated state and items are the fetched incidents/events
+    """
+
+    is_fetch_events = command == "fetch-events"
+    items = []
+    params = demisto.params()
+
+    # Initialize and migrate last_run
+    last_run = demisto.getLastRun()
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    if not last_run:
+        last_run = [{} for _ in range(last_run_length)]
+    last_run = migrate_last_run(last_run, is_fetch_events)
+
+    # last_run objects - common for fetch_incident and fetch_events
+    detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.DETECTIONS)
+    incidents_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.INCIDENTS)
+    idp_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.IDP_DETECTIONS)
+    mobile_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.MOBILE_DETECTIONS)
+    on_demand_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.ON_DEMAND_DETECTIONS)
+    ofp_detection_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.OFP_DETECTION)
+
+    # last_run objects - fetch types only for fetch-incidents
+    iom_last_run: dict[str, Any] = {}
+    ioa_last_run: dict[str, Any] = {}
+
+    if is_fetch_events:
+        fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
+        look_back = int(params.get("look_back_xsiam") or 2)
+    else:
+        fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+        look_back = int(params.get("look_back") or 2)
+
+        # last_run object - Only for fetch_incident
+        iom_last_run = get_last_run_per_type(last_run, LastRunIndex.IOM)
+        ioa_last_run = get_last_run_per_type(last_run, LastRunIndex.IOA)
+
+    demisto.debug(f"CrowdstrikeFalconMsg: Selected fetch types: {fetch_incidents_or_detections}")
+
+    # Fetch Endpoint Detections
+
+    if is_detection_fetch_type_selected(selected_types=fetch_incidents_or_detections):
+        # if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch Detections")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current detections_last_run object: {detections_last_run}")
+
+        fetched_detections, detections_last_run = fetch_endpoint_detections(detections_last_run, look_back, is_fetch_events)
+        items.extend(fetched_detections)
 
+    # Fetch Endpoint Incidents
+    if is_incident_fetch_type_selected(selected_types=fetch_incidents_or_detections):
+        # if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch Incidents")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current Incidents last_run object: {incidents_last_run}")
+        fetched_incidents, incidents_last_run = fetch_endpoint_incidents(incidents_last_run, look_back, is_fetch_events)
+        items.extend(fetched_incidents)
+
+    # Fetch IDP Detections
     if IDP_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        idp_detections, current_fetch_info_idp_detections = fetch_detections_by_product_type(
-            current_fetch_info_idp_detections,
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch IDP Detection")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current IDP Detection last_run object: {idp_detections_last_run}")
+
+        fetched_idp_detections, idp_detections_last_run = fetch_detections_by_product_type(
+            idp_detections_last_run,
             look_back=look_back,
             fetch_query=params.get("idp_detections_fetch_query", ""),
             detections_type=IDP_DETECTION,
             product_type="idp",
             detection_name_prefix=IDP_DETECTION_FETCH_TYPE,
             start_time_key="created_timestamp",
-            is_fetch_events=True,
+            is_fetch_events=is_fetch_events,
         )
+        items.extend(fetched_idp_detections)
 
+    # Fetch Mobile Detections
     if MOBILE_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        mobile_detections, current_fetch_info_mobile_detections = fetch_detections_by_product_type(
-            current_fetch_info_mobile_detections,
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch Mobile Detection")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current Mobile Detection last_run object: {mobile_detections_last_run}")
+
+        fetched_mobile_detections, mobile_detections_last_run = fetch_detections_by_product_type(
+            mobile_detections_last_run,
             look_back=look_back,
             fetch_query=params.get("mobile_detections_fetch_query", ""),
             detections_type=MOBILE_DETECTION,
             product_type="mobile",
             detection_name_prefix=MOBILE_DETECTION_FETCH_TYPE,
             start_time_key="timestamp",
-            is_fetch_events=True,
+            is_fetch_events=is_fetch_events,
         )
+        items.extend(fetched_mobile_detections)
+
+    # Fetch Indicators of Misconfiguration (IOM) - supported for fetch-incidents command only.
+    if not is_fetch_events and IOM_FETCH_TYPE in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch IOM")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current IOM last_run object: {iom_last_run}")
+
+        fetched_iom_incidents, iom_last_run = fetch_iom_incidents(iom_last_run)
+        items.extend(fetched_iom_incidents)
+
+    # Fetch Indicators of Attack (IOA) - supported for fetch-incidents command only.
+    if IOA_FETCH_TYPE in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch IOA")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current IOA last_run object: {ioa_last_run}")
+
+        fetched_ioa_incidents, ioa_last_run = fetch_ioa_incidents(ioa_last_run)
+        items.extend(fetched_ioa_incidents)
 
+    # Fetch On-Demand Scan Detections
     if ON_DEMAND_SCANS_DETECTION_TYPE in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch ODS Detection")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current ODS Detection last_run object: {on_demand_detections_last_run}")
+
         if LEGACY_VERSION:
             raise DemistoException("On-Demand Scans Detection is not supported in legacy version.")
-        demisto.debug("Fetching On-Demand Scans Detection incidents")
-        demisto.debug(f"on_demand_detections_last_run= {current_fetch_on_demand_detections}")
-
-        on_demand_detections, current_fetch_on_demand_detections = fetch_detections_by_product_type(
-            current_fetch_on_demand_detections,
+        fetched_on_demand_detections, on_demand_detections_last_run = fetch_detections_by_product_type(
+            on_demand_detections_last_run,
             look_back=look_back,
             fetch_query=params.get("on_demand_fetch_query", ""),
             detections_type=ON_DEMAND_SCANS_DETECTION,
             product_type="ods",
             detection_name_prefix=ON_DEMAND_SCANS_DETECTION_TYPE,
             start_time_key="created_timestamp",
-            is_fetch_events=True,
+            is_fetch_events=is_fetch_events,
         )
+        items.extend(fetched_on_demand_detections)
 
+    # Fetch OFP Detections
     if OFP_DETECTION_TYPE in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch OFP Detection")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current OFP Detection last_run object: {ofp_detection_last_run}")
+
         if LEGACY_VERSION:
             raise DemistoException(f"{OFP_DETECTION_TYPE} is not supported in legacy version.")
-        demisto.debug(f"Fetching {OFP_DETECTION_TYPE} incidents")
-        demisto.debug(f"ofp_detection_last_run= {current_fetch_ofp_detection}")
-
-        ofp_detections, current_fetch_ofp_detection = fetch_detections_by_product_type(
-            current_fetch_ofp_detection,
+        fetched_ofp_detections, ofp_detection_last_run = fetch_detections_by_product_type(
+            ofp_detection_last_run,
             look_back=look_back,
             fetch_query=params.get("ofp_detection_fetch_query", ""),
             detections_type=OFP_DETECTION,
             product_type="ofp",
             detection_name_prefix=OFP_DETECTION_TYPE,
             start_time_key="created_timestamp",
-            is_fetch_events=True,
+            is_fetch_events=is_fetch_events,
         )
+        items.extend(fetched_ofp_detections)
 
-    last_run = [
-        current_fetch_info_detections,
-        current_fetch_info_incidents,
-        current_fetch_info_idp_detections,
-        current_fetch_info_mobile_detections,
-        current_fetch_on_demand_detections,
-        current_fetch_ofp_detection,
-    ]
-
-    events = incidents + detections + idp_detections + mobile_detections + on_demand_detections + ofp_detections
+    # Assign each sub last_run info per type at its proper index
+    set_last_run_per_type(last_run, index=LastRunIndex.DETECTIONS, data=detections_last_run, is_fetch_events=is_fetch_events)
+    set_last_run_per_type(last_run, index=LastRunIndex.INCIDENTS, data=incidents_last_run, is_fetch_events=is_fetch_events)
+    set_last_run_per_type(
+        last_run, index=LastRunIndex.IDP_DETECTIONS, data=idp_detections_last_run, is_fetch_events=is_fetch_events
+    )
+    set_last_run_per_type(
+        last_run, index=LastRunIndex.MOBILE_DETECTIONS, data=mobile_detections_last_run, is_fetch_events=is_fetch_events
+    )
+    set_last_run_per_type(
+        last_run, index=LastRunIndex.ON_DEMAND_DETECTIONS, data=on_demand_detections_last_run, is_fetch_events=is_fetch_events
+    )
+    set_last_run_per_type(
+        last_run, index=LastRunIndex.OFP_DETECTION, data=ofp_detection_last_run, is_fetch_events=is_fetch_events
+    )
+    if not is_fetch_events:
+        set_last_run_per_type(last_run, index=LastRunIndex.IOM, data=iom_last_run, is_fetch_events=is_fetch_events)
+        set_last_run_per_type(last_run, index=LastRunIndex.IOA, data=ioa_last_run, is_fetch_events=is_fetch_events)
 
-    return last_run, events
+        demisto.setLastRun(last_run)
+    demisto.debug(f"CrowdStrikeFalconMsg: Updated last_run object after fetch: {last_run}")
+    return last_run, items
 
 
 def fetch_detections_by_product_type(
@@ -3489,14 +3467,13 @@ def fetch_detections_by_product_type(
         tuple[List, dict]: The list of the fetched incidents and the updated last object.
     """
     detections: List = []
+    fetch_limit = MAX_FETCH_DETECTION_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
     offset: int = current_fetch_info.get("offset") or 0
     start_fetch_time, end_fetch_time = get_fetch_run_time_range(
         last_run=current_fetch_info, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
     )
-    if is_fetch_events:
-        fetch_limit = current_fetch_info.get("limit") or MAX_FETCH_DETECTION_PER_API_CALL
-    else:
-        fetch_limit = current_fetch_info.get("limit") or INCIDENTS_PER_FETCH
+
+    fetch_limit = current_fetch_info.get("limit") or fetch_limit
 
     filter = f"product:'{product_type}'+created_timestamp:>'{start_fetch_time}'"
     if product_type in {IncidentType.ON_DEMAND.value, IncidentType.OFP.value}:
@@ -3506,6 +3483,7 @@ def fetch_detections_by_product_type(
         filter += f"+{fetch_query}"
     response = get_detections_ids(filter_arg=filter, limit=fetch_limit, offset=offset, product_type=product_type)
     detections_ids: list[dict] = demisto.get(response, "resources", [])
+    demisto.debug(f"CrowdStrikeFalconMsg: Total fetched detections: {len(detections_ids)}")
     total_detections = demisto.get(response, "meta.pagination.total")
     offset = calculate_new_offset(offset, len(detections_ids), total_detections)
     if offset:
@@ -5625,7 +5603,7 @@ def module_test():
         return "Connection Error: The URL or The API key you entered is probably incorrect, please try again."
     if demisto.params().get("isFetch"):
         try:
-            fetch_incidents()
+            fetch_items(command="fetch-incidents")
         except ValueError:
             return "Error: Something is wrong with the filters you entered for the fetch incident, please try again."
     return "ok"
@@ -7570,9 +7548,10 @@ def main():  # pragma: no cover
             return_results(result)
         elif command == "fetch-incidents":
             disable_for_xsiam()
-            demisto.incidents(fetch_incidents())
+            last_run, incidents = fetch_items(command=command)
+            demisto.incidents(incidents)
         elif command == "fetch-events":
-            last_run, events = fetch_events()
+            last_run, events = fetch_items(command=command)
             send_events_to_xsiam(events, vendor=VENDOR, product=PRODUCT)
             demisto.setLastRun(last_run)
         elif command in ("cs-device-ran-on", "cs-falcon-device-ran-on"):
diff --git a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon_test.py b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon_test.py
index 76ca95fa8c6a..3d753c759c61 100644
--- a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon_test.py
+++ b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon_test.py
@@ -1,6 +1,5 @@
 import json
 import os
-from typing import Any
 from unittest.mock import ANY
 from urllib.parse import unquote
 
@@ -24,6 +23,25 @@
 SERVER_URL = "https://4.4.4.4"
 
 
+def create_empty_last_run(length: int) -> list[dict]:
+    """
+    Creates an empty last_run data structure for fetch operations.
+
+    The last_run object is defined as a list of dictionaries.
+    Each index in the list represents a different fetch type.
+
+    The length parameter varies depending on the platform:
+    - XSOAR length constant - TOTAL_FETCH_TYPE_XSOAR
+    - XSIAM length constant - TOTAL_FETCH_TYPE_XSIAM
+    Args:
+        length (int): Number of fetch types to initialize
+
+    Returns:
+        list[dict]: A list of empty dictionaries representing the last_run state
+    """
+    return [{} for _ in range(length)]
+
+
 def load_json(file: str):
     with open(file) as f:
         return json.load(f)
@@ -1872,7 +1890,7 @@ def test_old_fetch_to_new_fetch(self, set_up_mocks, mocker):
             The `first_behavior_time` doesn't change and an `offset` of 2 is added.
 
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items
 
         mocker.patch.object(demisto, "params", return_value={})
         mocker.patch.object(
@@ -1886,7 +1904,7 @@ def test_old_fetch_to_new_fetch(self, set_up_mocks, mocker):
                 "incident_offset": 4,
             },
         )
-        fetch_incidents()
+        fetch_items()
         assert demisto.setLastRun.mock_calls[0][1][0] == [
             {"time": "2020-09-04T09:16:10Z"},
             {"time": "2020-09-04T09:22:10Z"},
@@ -1909,8 +1927,17 @@ def test_new_fetch(self, set_up_mocks, mocker, requests_mock):
         Then:
             The `first_behavior_time` changes and no `offset` is added.
         """
+
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
+
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
-        mocker.patch.object(demisto, "getLastRun", return_value=[{"time": "2020-09-04T09:16:10.000000Z", "offset": 2}, {}, {}])
+
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object, index=LastRunIndex.DETECTIONS, data={"time": "2020-09-04T09:16:10.000000Z", "offset": 2}
+        )
+
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         # Override post to have 1 results so FETCH_LIMIT won't be reached
         requests_mock.post(
             f"{SERVER_URL}/detects/entities/summaries/GET/v1",
@@ -1924,10 +1951,9 @@ def test_new_fetch(self, set_up_mocks, mocker, requests_mock):
                 ],
             },
         )
-        from CrowdStrikeFalcon import fetch_incidents
 
-        fetch_incidents()
-        assert demisto.setLastRun.mock_calls[0][1][0][0] == {
+        fetch_items()
+        assert demisto.setLastRun.mock_calls[0][1][0][LastRunIndex.DETECTIONS] == {
             "time": "2020-09-04T09:16:11.000000Z",
             "limit": 2,
             "offset": 0,
@@ -1947,6 +1973,8 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             - In the next call, the offset will be reset to 0 and the last time will be the latest detection time
 
         """
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
+
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
         # mock the total number of detections to be 4, so offset will be set
         requests_mock.get(
@@ -1954,7 +1982,12 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             json={"resources": ["ldt:1", "ldt:2"], "meta": {"pagination": {"total": 4}}},
         )
 
-        mocker.patch.object(demisto, "getLastRun", return_value=[{"time": "2020-09-04T09:16:10.000000Z", "offset": 0}, {}, {}])
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object, index=LastRunIndex.DETECTIONS, data={"time": "2020-09-04T09:16:10.000000Z", "offset": 0}
+        )
+
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         # Override post to have 1 results so FETCH_LIMIT won't be reached
         requests_mock.post(
             f"{SERVER_URL}/detects/entities/summaries/GET/v1",
@@ -1968,9 +2001,8 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
                 ],
             },
         )
-        from CrowdStrikeFalcon import fetch_incidents
 
-        fetch_incidents()
+        fetch_items()
         # the offset should be increased to 2, and the time should be stay the same
         expected_last_run = {
             "time": "2020-09-04T09:16:10.000000Z",
@@ -1978,14 +2010,17 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             "offset": 2,
             "found_incident_ids": {"Detection ID: ldt:1": 1599210970},
         }
-        assert demisto.setLastRun.mock_calls[0][1][0][0] == expected_last_run
+        assert demisto.setLastRun.mock_calls[0][1][0][LastRunIndex.DETECTIONS] == expected_last_run
 
         requests_mock.get(
             f"{SERVER_URL}/detects/queries/detects/v1",
             json={"resources": ["ldt:3", "ldt:4"], "meta": {"pagination": {"total": 4}}},
         )
 
-        mocker.patch.object(demisto, "getLastRun", return_value=[expected_last_run, {}, {}])
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.DETECTIONS, data=expected_last_run)
+
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
 
         requests_mock.post(
             f"{SERVER_URL}/detects/entities/summaries/GET/v1",
@@ -2000,9 +2035,9 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             },
         )
 
-        fetch_incidents()
+        fetch_items()
         # the offset should be 0 because all detections were fetched, and the time should update to the latest detection
-        assert demisto.setLastRun.mock_calls[1][1][0][0] == {
+        assert demisto.setLastRun.mock_calls[1][1][0][LastRunIndex.DETECTIONS] == {
             "time": "2020-09-04T09:16:13.000000Z",
             "limit": 2,
             "offset": 0,
@@ -2021,20 +2056,18 @@ def test_fetch_incident_type(self, set_up_mocks, mocker):
 
         """
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
-        from CrowdStrikeFalcon import fetch_incidents
-
-        mocker.patch.object(
-            demisto,
-            "getLastRun",
-            return_value=[
-                {
-                    "time": "2020-09-04T09:16:10Z",
-                },
-                {},
-                {},
-            ],
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
+
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.DETECTIONS,
+            data={
+                "time": "2020-09-04T09:16:10Z",
+            },
         )
-        incidents = fetch_incidents()
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
+        _, incidents = fetch_items()
         for incident in incidents:
             assert '"incident_type": "detection"' in incident.get("rawJSON", "")
 
@@ -2073,9 +2106,11 @@ def test_fetch_returns_all_types(
 
         """
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        mocker.patch.object(demisto, "getLastRun", return_value=[{"time": "2020-09-04T09:16:10Z"}, {}, {}])
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.DETECTIONS, data={"time": "2020-09-04T09:16:10Z"})
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
 
         requests_mock.get(
             f"{SERVER_URL}/incidents/queries/incidents/v1",
@@ -2121,17 +2156,18 @@ def test_fetch_returns_all_types(
             },
         )
 
-        incidents = fetch_incidents()
-        assert len(incidents) == incidents_len
+        _, items = fetch_items()
+        assert len(items) == incidents_len
 
+        # Detection type stored before Incidents in the list
         if incidents_len == 4:
-            assert "Incident ID:" in incidents[0]["name"]
-            assert "Incident ID:" in incidents[1]["name"]
-            assert "Detection ID:" in incidents[2]["name"]
-            assert "Detection ID:" in incidents[3]["name"]
+            assert "Detection ID:" in items[0]["name"]
+            assert "Detection ID:" in items[1]["name"]
+            assert "Incident ID:" in items[2]["name"]
+            assert "Incident ID:" in items[3]["name"]
         else:
-            assert expected_name in incidents[0]["name"]
-            assert expected_name in incidents[1]["name"]
+            assert expected_name in items[0]["name"]
+            assert expected_name in items[1]["name"]
 
 
 class TestIncidentFetch:
@@ -2168,7 +2204,7 @@ def delete_offset_test(self, set_up_mocks, mocker):
             The offset is deleted from the lastRun
         """
 
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items
 
         mocker.patch.object(demisto, "params", return_value={})
         mocker.patch.object(
@@ -2176,22 +2212,26 @@ def delete_offset_test(self, set_up_mocks, mocker):
             "getLastRun",
             return_value=[{"time": "2020-09-04T09:16:10Z", "offset": 2}, {"time": "2020-09-04T09:22:10Z", "offset": 4}],
         )
-        fetch_incidents()
+        fetch_items()
         assert demisto.setLastRun.mock_calls[0][1][0] == [{"time": "2020-09-04T09:16:10Z"}, {"time": "2020-09-04T09:22:10Z"}]
 
     @freeze_time("2020-08-26 17:22:13 UTC")
     def test_new_fetch(self, set_up_mocks, mocker, requests_mock):
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
+
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
-        mocker.patch.object(demisto, "getLastRun", return_value=[{}, {"time": "2020-09-04T09:16:10Z", "offset": 2}, {}])
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.INCIDENTS, data={"time": "2020-09-04T09:16:10Z", "offset": 2})
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
+
         # Override post to have 1 results so FETCH_LIMIT won't be reached
         requests_mock.post(
             f"{SERVER_URL}/incidents/entities/incidents/GET/v1",
             json={"resources": [{"incident_id": "ldt:1", "start": "2020-09-04T09:16:11Z"}]},
         )
-        from CrowdStrikeFalcon import fetch_incidents
 
-        fetch_incidents()
-        assert demisto.setLastRun.mock_calls[0][1][0][1] == {
+        fetch_items()
+        assert demisto.setLastRun.mock_calls[0][1][0][LastRunIndex.INCIDENTS] == {
             "time": "2020-09-04T09:16:11Z",
             "limit": 2,
             "offset": 0,
@@ -2211,14 +2251,17 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             - In the next call, the offset will be reset to 0 and the last time will be the latest detection time
 
         """
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
+
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
         # mock the total number of detections to be 4, so offset will be set
         requests_mock.get(
             f"{SERVER_URL}/incidents/queries/incidents/v1",
             json={"resources": ["ldt:1", "ldt:2"], "pagination": {"meta": {"total": 4}}},
         )
-
-        mocker.patch.object(demisto, "getLastRun", return_value=[{}, {"time": "2020-09-04T09:16:10Z", "offset": 0}, {}])
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.INCIDENTS, data={"time": "2020-09-04T09:16:10Z", "offset": 0})
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         # Override post to have 1 results so FETCH_LIMIT won't be reached
         requests_mock.post(
             f"{SERVER_URL}/incidents/entities/incidents/GET/v1",
@@ -2226,9 +2269,8 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
                 "resources": [{"incident_id": "ldt:1", "start": "2020-09-04T09:16:11Z", "max_severity_displayname": "Low"}],
             },
         )
-        from CrowdStrikeFalcon import fetch_incidents
 
-        fetch_incidents()
+        fetch_items()
         # the offset should be increased to 2, and the time should be stay the same
         expected_last_run = {
             "time": "2020-09-04T09:16:10Z",
@@ -2236,14 +2278,17 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             "offset": 2,
             "found_incident_ids": {"Incident ID: ldt:1": 1599210970},
         }
-        assert demisto.setLastRun.mock_calls[0][1][0][1] == expected_last_run
+        assert demisto.setLastRun.mock_calls[0][1][0][LastRunIndex.INCIDENTS] == expected_last_run
 
         requests_mock.get(
             f"{SERVER_URL}/incidents/queries/incidents/v1",
             json={"resources": ["ldt:3", "ldt:4"], "meta": {"pagination": {"total": 4}}},
         )
 
-        mocker.patch.object(demisto, "getLastRun", return_value=[{}, expected_last_run, {}])
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.INCIDENTS, data=expected_last_run)
+
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
 
         requests_mock.post(
             f"{SERVER_URL}/incidents/entities/incidents/GET/v1",
@@ -2252,9 +2297,9 @@ def test_fetch_with_offset(self, set_up_mocks, mocker, requests_mock):
             },
         )
 
-        fetch_incidents()
+        fetch_items()
         # the offset should be 0 because all detections were fetched, and the time should update to the latest detection
-        assert demisto.setLastRun.mock_calls[1][1][0][1] == {
+        assert demisto.setLastRun.mock_calls[1][1][0][LastRunIndex.INCIDENTS] == {
             "time": "2020-09-04T09:16:13Z",
             "limit": 2,
             "offset": 0,
@@ -2270,20 +2315,20 @@ def test_incident_type_in_fetch(self, set_up_mocks, mocker):
         Then:
             "incident_type": "incident" is in raw result returned by the indicator
         """
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
+
         mocker.patch("CrowdStrikeFalcon.LEGACY_VERSION", True)
-        mocker.patch.object(
-            demisto,
-            "getLastRun",
-            return_value=[
-                {},
-                {
-                    "time": "2020-09-04T09:16:10Z",
-                },
-            ],
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.INCIDENTS,
+            data={
+                "time": "2020-09-04T09:16:10Z",
+            },
         )
-        from CrowdStrikeFalcon import fetch_incidents
+        mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
 
-        incidents = fetch_incidents()
+        _, incidents = fetch_items()
         for incident in incidents:
             assert '"incident_type": "incident"' in incident.get("rawJSON", "")
 
@@ -6221,22 +6266,22 @@ def test_fetch_query_with_paginating(self, mocker: MockerFixture):
         Then
             - Validate that the last fetch query is used in the current run, and the next token is added to the API call.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
         fetch_query = "cloud_provider=aws"
         last_fetch_query = f"{fetch_query}&date_time_since=some_time"
         ioa_next_token = "dummy_token"
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {},
-            {
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOA,
+            data={
                 "ioa_next_token": ioa_next_token,
                 "last_fetch_query": last_fetch_query,
                 "last_date_time_since": "2023-01-01T00:00:00Z",
             },
-        ]
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6244,7 +6289,7 @@ def test_fetch_query_with_paginating(self, mocker: MockerFixture):
         )
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         http_request_mocker = mocker.patch("CrowdStrikeFalcon.http_request")
-        fetch_incidents()
+        fetch_items()
         assert last_fetch_query in http_request_mocker.call_args_list[0][1].get("url_suffix")
         assert f"next_token={ioa_next_token}" in http_request_mocker.call_args_list[0][1].get("url_suffix")
 
@@ -6257,15 +6302,14 @@ def test_fetch_query_with_paginating_empty_last_filter_error(self, mocker: Mocke
         Then
             - Validate that an error is thrown if the last fetch filter is an empty string.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {},
-            {"ioa_next_token": "dummy_token", "last_fetch_query": "", "last_date_time_since": "2023-01-01T00:00:00Z"},
-        ]
+        last_run_object = [{} for _ in range(TOTAL_FETCH_TYPE_XSOAR)]
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOA,
+            data={"ioa_next_token": "dummy_token", "last_fetch_query": "", "last_date_time_since": "2023-01-01T00:00:00Z"},
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6274,7 +6318,7 @@ def test_fetch_query_with_paginating_empty_last_filter_error(self, mocker: Mocke
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         mocker.patch("CrowdStrikeFalcon.http_request")
         with pytest.raises(DemistoException) as e:
-            fetch_incidents()
+            fetch_items()
         assert "Last fetch query must not be empty when doing pagination" in str(e)
 
     def test_fetch_query_without_pagination(self, mocker: MockerFixture):
@@ -6286,11 +6330,12 @@ def test_fetch_query_without_pagination(self, mocker: MockerFixture):
         Then
             - Validate that the passed date_date_since date is appended to the supplied fetch query.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
         last_date_time_since = "2023-01-01T00:00:00Z"
         fetch_query = "cloud_provider=aws"
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {}, {"last_date_time_since": last_date_time_since}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.IOA, data={"last_date_time_since": last_date_time_since})
         mocker.patch.object(
             demisto,
             "params",
@@ -6298,7 +6343,7 @@ def test_fetch_query_without_pagination(self, mocker: MockerFixture):
         )
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         http_request_mocker = mocker.patch("CrowdStrikeFalcon.http_request")
-        fetch_incidents()
+        fetch_items()
         assert fetch_query in http_request_mocker.call_args_list[0][1].get("url_suffix")
         assert f"date_time_since={last_date_time_since}" in http_request_mocker.call_args_list[0][1].get("url_suffix")
 
@@ -6375,9 +6420,10 @@ def test_no_ioa_events_added_if_found_in_last_run(self, mocker: MockerFixture):
         # and once we enter the for loop to go over the fetched events, '2' will not get picked up, since it
         # was already fetched, therfore, we check that in the returned incidents object, only the event with id '3'
         # was added as an incident
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {}, {"last_event_ids": ["1", "2"]}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.IOA, data={"last_event_ids": ["1", "2"]})
         mocker.patch.object(
             demisto,
             "params",
@@ -6396,7 +6442,7 @@ def test_no_ioa_events_added_if_found_in_last_run(self, mocker: MockerFixture):
             ),
         )
         mocker.patch("CrowdStrikeFalcon.reformat_timestamp", return_value="2023-01-01T00:00:00Z")
-        fetched_incidents = fetch_incidents()
+        _, fetched_incidents = fetch_items()
         assert len(fetched_incidents) == 1
         rawJSON = json.loads(fetched_incidents[0].get("rawJSON"))
         assert rawJSON.get("incident_type") == "ioa_events"
@@ -6416,9 +6462,10 @@ def test_save_fetched_events_when_paginating(self, mocker: MockerFixture):
         # which can span on many fetches. We will have ids in last_event_ids (['1']), and configure that we are
         # doing pagination, and that we fetched event '2', and in the new returned last run, the key last_event_ids
         # has a value of ['1', '2']
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {}, {"last_event_ids": ["1"]}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.IOA, data={"last_event_ids": ["1"]})
         mocker.patch.object(
             demisto,
             "params",
@@ -6431,8 +6478,8 @@ def test_save_fetched_events_when_paginating(self, mocker: MockerFixture):
         )
         mocker.patch("CrowdStrikeFalcon.reformat_timestamp", return_value="2023-01-01T00:00:00Z")
         set_last_run_mocker = mocker.patch.object(demisto, "setLastRun", side_effect=demisto.setLastRun)
-        fetch_incidents()
-        assert set_last_run_mocker.call_args_list[0][0][0][4].get("last_event_ids") == ["2", "1"]
+        fetch_items()
+        assert set_last_run_mocker.call_args_list[0][0][0][LastRunIndex.IOA].get("last_event_ids") == ["2", "1"]
 
     def test_save_fetched_events_when_starting_pagination(self, mocker: MockerFixture):
         """
@@ -6447,15 +6494,14 @@ def test_save_fetched_events_when_starting_pagination(self, mocker: MockerFixtur
         # Make sure that we save all the events that have been fetched before when starting the pagination process.
         # We will have ids in last_event_ids (['1']), and configure that we are, doing pagination, and that we fetched event '2',
         # and in the new returned last run, the key last_event_ids has a value of ['1', '2']
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {},
-            {"last_event_ids": ["1"], "ioa_next_token": "next_token", "last_fetch_query": "cloud_provider=aws"},
-        ]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOA,
+            data={"last_event_ids": ["1"], "ioa_next_token": "next_token", "last_fetch_query": "cloud_provider=aws"},
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6468,8 +6514,8 @@ def test_save_fetched_events_when_starting_pagination(self, mocker: MockerFixtur
         )
         mocker.patch("CrowdStrikeFalcon.reformat_timestamp", return_value="2023-01-01T00:00:00Z")
         set_last_run_mocker = mocker.patch.object(demisto, "setLastRun", side_effect=demisto.setLastRun)
-        fetch_incidents()
-        assert set_last_run_mocker.call_args_list[0][0][0][4].get("last_event_ids") == ["2", "1"]
+        fetch_items()
+        assert set_last_run_mocker.call_args_list[0][0][0][LastRunIndex.IOA].get("last_event_ids") == ["2", "1"]
 
     def test_fetch_ioa_events(self, mocker: MockerFixture):
         """
@@ -6485,20 +6531,19 @@ def test_fetch_ioa_events(self, mocker: MockerFixture):
                 4. The fetched event ids are saved.
         """
         # A successful fetch of incidents
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {},
-            {
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOA,
+            data={
                 "last_event_ids": ["1"],
                 "ioa_next_token": "next_token",
                 "last_fetch_query": "last_dummy_query",
                 "last_date_time_since": "2022-01-01T00:00:00Z",
             },
-        ]
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6516,8 +6561,8 @@ def test_fetch_ioa_events(self, mocker: MockerFixture):
             ),
         )
         set_last_run_mocker = mocker.patch.object(demisto, "setLastRun", side_effect=demisto.setLastRun)
-        fetched_incidents = fetch_incidents()
-        assert set_last_run_mocker.call_args_list[0][0][0][4] == {
+        _, fetched_incidents = fetch_items()
+        assert set_last_run_mocker.call_args_list[0][0][0][LastRunIndex.IOA] == {
             "ioa_next_token": "new_next_token",
             "last_date_time_since": "2024-01-01T00:00:00Z",
             "last_fetch_query": "last_dummy_query",
@@ -6553,22 +6598,22 @@ def test_fetch_query_with_paginating(self, mocker: MockerFixture):
         Then
             - Validate that the last fetch query is used in the current run, and the next token is added to the API call.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
         fetch_filter = "cloud_provider: 'aws'"
         last_fetch_filter = f"scan_time: some_time+{fetch_filter}"
         iom_next_token = "dummy_token"
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {
+
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOM,
+            data={
                 "iom_next_token": iom_next_token,
                 "last_fetch_filter": last_fetch_filter,
                 "last_scan_time": "2023-01-01T00:00:00.000000Z",
             },
-            {},
-        ]
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6576,7 +6621,7 @@ def test_fetch_query_with_paginating(self, mocker: MockerFixture):
         )
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         http_request_mocker = mocker.patch("CrowdStrikeFalcon.http_request")
-        fetch_incidents()
+        fetch_items()
         assert http_request_mocker.call_args_list[0][1].get("params").get("filter") == last_fetch_filter
         assert http_request_mocker.call_args_list[0][1].get("params").get("next_token") == iom_next_token
 
@@ -6589,15 +6634,14 @@ def test_fetch_query_with_paginating_empty_last_filter_error(self, mocker: Mocke
         Then
             - Validate that an error is thrown if the last fetch filter is an empty string.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {"iom_next_token": "dummy_token", "last_fetch_filter": "", "last_scan_time": "2023-01-01T00:00:00.000000Z"},
-            {},
-        ]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOM,
+            data={"iom_next_token": "dummy_token", "last_fetch_filter": "", "last_scan_time": "2023-01-01T00:00:00.000000Z"},
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6609,7 +6653,7 @@ def test_fetch_query_with_paginating_empty_last_filter_error(self, mocker: Mocke
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         mocker.patch("CrowdStrikeFalcon.http_request")
         with pytest.raises(DemistoException) as e:
-            fetch_incidents()
+            fetch_items()
         assert "Last fetch filter must not be empty when doing pagination" in str(e)
 
     def test_fetch_query_without_pagination_and_not_first_run(self, mocker: MockerFixture):
@@ -6621,11 +6665,12 @@ def test_fetch_query_without_pagination_and_not_first_run(self, mocker: MockerFi
         Then
             - Validate that we append the last_scan_time date, while using '>' in the fetch query.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
         last_scan_time = "2023-01-01T00:00:00.000000Z"
         fetch_filter = "cloud_provider: 'aws'"
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {"last_scan_time": last_scan_time}, {}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.IOM, data={"last_scan_time": last_scan_time})
         mocker.patch.object(
             demisto,
             "params",
@@ -6633,7 +6678,7 @@ def test_fetch_query_without_pagination_and_not_first_run(self, mocker: MockerFi
         )
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         http_request_mocker = mocker.patch("CrowdStrikeFalcon.http_request")
-        fetch_incidents()
+        fetch_items()
         assert f"scan_time: >'{last_scan_time}'+{fetch_filter}" == http_request_mocker.call_args_list[0][1].get("params").get(
             "filter"
         )
@@ -6648,12 +6693,12 @@ def test_fetch_query_without_pagination_and_first_run(self, mocker: MockerFixtur
         Then
             - Validate that we append the last_scan_time date, while using '>=' in the fetch query.
         """
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR
 
         # The date configured in @freeze_time minues 3 days, which is the default FETCH_TIME
         last_scan_time = "2023-01-01T00:00:00.000000Z"
         fetch_filter = "cloud_provider: 'aws'"
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {}, {}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
         mocker.patch.object(
             demisto,
             "params",
@@ -6661,7 +6706,7 @@ def test_fetch_query_without_pagination_and_first_run(self, mocker: MockerFixtur
         )
         mocker.patch.object(demisto, "getLastRun", return_value=last_run_object)
         http_request_mocker = mocker.patch("CrowdStrikeFalcon.http_request")
-        fetch_incidents()
+        fetch_items()
         assert f"scan_time: >='{last_scan_time}'+{fetch_filter}" == http_request_mocker.call_args_list[0][1].get("params").get(
             "filter"
         )
@@ -6737,9 +6782,10 @@ def test_no_iom_resources_added_if_found_in_last_run(self, mocker: MockerFixture
         # and once we enter the for loop to go over the fetched resources, '2' will not get picked up, since it
         # was already fetched, therfore, we check that in the returned incidents object, only the resource with id '3'
         # was added as an incident
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {"last_resource_ids": ["1", "2"]}, {}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.IOM, data={"last_resource_ids": ["1", "2"]})
         mocker.patch.object(
             demisto,
             "params",
@@ -6760,7 +6806,7 @@ def test_no_iom_resources_added_if_found_in_last_run(self, mocker: MockerFixture
             ],
         )
         mocker.patch("CrowdStrikeFalcon.reformat_timestamp", return_value="2023-01-01T00:00:00.00Z")
-        fetched_incidents = fetch_incidents()
+        _, fetched_incidents = fetch_items()
         assert len(fetched_incidents) == 1
         rawJSON = json.loads(fetched_incidents[0].get("rawJSON"))
         assert rawJSON.get("incident_type") == "iom_configurations"
@@ -6780,9 +6826,10 @@ def test_save_fetched_resources_when_paginating(self, mocker: MockerFixture):
         # which can span on many fetches. We will have ids in last_resource_ids (['1']), and configure that we are
         # doing pagination, and that we fetched resource '2', and in the new returned last run, the key last_resource_ids
         # has a value of ['1', '2']
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, LastRunIndex, TOTAL_FETCH_TYPE_XSOAR, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [{}, {}, {}, {"last_resource_ids": ["1"]}, {}]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(last_run_object, index=LastRunIndex.IOM, data={"last_resource_ids": ["1"]})
         mocker.patch.object(
             demisto,
             "params",
@@ -6796,8 +6843,8 @@ def test_save_fetched_resources_when_paginating(self, mocker: MockerFixture):
         mocker.patch("CrowdStrikeFalcon.get_iom_resources", return_value=[{"id": "2", "scan_time": "2023-01-01T00:00:00.00Z"}])
         mocker.patch("CrowdStrikeFalcon.reformat_timestamp", return_value="2023-01-01T00:00:00.00Z")
         set_last_run_mocker = mocker.patch.object(demisto, "setLastRun", side_effect=demisto.setLastRun)
-        fetch_incidents()
-        assert set_last_run_mocker.call_args_list[0][0][0][3].get("last_resource_ids") == ["2", "1"]
+        fetch_items()
+        assert set_last_run_mocker.call_args_list[0][0][0][LastRunIndex.IOM].get("last_resource_ids") == ["2", "1"]
 
     def test_save_fetched_resources_when_starting_pagination(self, mocker: MockerFixture):
         """
@@ -6812,15 +6859,14 @@ def test_save_fetched_resources_when_starting_pagination(self, mocker: MockerFix
         # Make sure that we save all the resources that have been fetched before when starting the pagination process.
         # We will have ids in last_resource_ids (['1']), and configure that we are, doing pagination, and that we fetched
         # resource '2', and in the new returned last run, the key last_resource_ids has a value of ['1', '2']
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {"last_resource_ids": ["1"], "iom_next_token": "next_token", "last_fetch_filter": "previous_filter"},
-            {},
-        ]
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOM,
+            data={"last_resource_ids": ["1"], "iom_next_token": "next_token", "last_fetch_filter": "previous_filter"},
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6834,8 +6880,8 @@ def test_save_fetched_resources_when_starting_pagination(self, mocker: MockerFix
         mocker.patch("CrowdStrikeFalcon.get_iom_resources", return_value=[{"id": "2", "scan_time": "2023-01-01T00:00:00.00Z"}])
         mocker.patch("CrowdStrikeFalcon.reformat_timestamp", return_value="2023-01-01T00:00:00.00Z")
         set_last_run_mocker = mocker.patch.object(demisto, "setLastRun", side_effect=demisto.setLastRun)
-        fetch_incidents()
-        assert set_last_run_mocker.call_args_list[0][0][0][3].get("last_resource_ids") == ["2", "1"]
+        fetch_items()
+        assert set_last_run_mocker.call_args_list[0][0][0][LastRunIndex.IOM].get("last_resource_ids") == ["2", "1"]
 
     def test_fetch_iom_events(self, mocker: MockerFixture):
         """
@@ -6851,20 +6897,19 @@ def test_fetch_iom_events(self, mocker: MockerFixture):
                 4. The fetched resource ids are saved.
         """
         # A successful fetch of incidents
-        from CrowdStrikeFalcon import fetch_incidents
+        from CrowdStrikeFalcon import fetch_items, TOTAL_FETCH_TYPE_XSOAR, LastRunIndex, set_last_run_per_type
 
-        last_run_object: list[dict[str, Any]] = [
-            {},
-            {},
-            {},
-            {
+        last_run_object = create_empty_last_run(TOTAL_FETCH_TYPE_XSOAR)
+        set_last_run_per_type(
+            last_run_object,
+            index=LastRunIndex.IOM,
+            data={
                 "last_resource_ids": ["1"],
                 "iom_next_token": "next_token",
                 "last_fetch_filter": "last_dummy_filter",
                 "last_scan_time": "2022-01-01T00:00:00.00Z",
             },
-            {},
-        ]
+        )
         mocker.patch.object(
             demisto,
             "params",
@@ -6884,8 +6929,8 @@ def test_fetch_iom_events(self, mocker: MockerFixture):
             ],
         )
         set_last_run_mocker = mocker.patch.object(demisto, "setLastRun", side_effect=demisto.setLastRun)
-        fetched_incidents = fetch_incidents()
-        assert set_last_run_mocker.call_args_list[0][0][0][3] == {
+        _, fetched_incidents = fetch_items()
+        assert set_last_run_mocker.call_args_list[0][0][0][LastRunIndex.IOM] == {
             "iom_next_token": "new_next_token",
             "last_scan_time": "2024-01-01T00:00:00.000000Z",
             "last_fetch_filter": "last_dummy_filter",
@@ -7665,7 +7710,8 @@ def test_enrich_groups_no_resources(mocker):
     assert CrowdStrikeFalcon.enrich_groups(group_ids) == {}
 
 
-def test_fetch_events_reads_last_run_indexes_correctly(mocker):
+@pytest.mark.parametrize("command", ["fetch-events", "fetch-incidents"])
+def test_fetch_items_reads_last_run_indexes_correctly(mocker, command):
     """
     Ensure that fetch_events correctly accesses each index of last_run based on its data type.
 
@@ -7673,14 +7719,31 @@ def test_fetch_events_reads_last_run_indexes_correctly(mocker):
     The test verifies that these identifiers appear in the same order in the last_run output,
     indicating correct index usage within the function.
     """
-    from CrowdStrikeFalcon import fetch_events
+    from CrowdStrikeFalcon import fetch_items, LastRunIndex, TOTAL_FETCH_TYPE_XSIAM, TOTAL_FETCH_TYPE_XSOAR, set_last_run_per_type
+
+    last_run_size = TOTAL_FETCH_TYPE_XSIAM if command == "fetch-events" else TOTAL_FETCH_TYPE_XSOAR
+    last_run_identifiers = create_empty_last_run(last_run_size)
+
+    set_last_run_per_type(last_run_identifiers, index=LastRunIndex.DETECTIONS, data={"Detection ID:": 1})
+    set_last_run_per_type(last_run_identifiers, index=LastRunIndex.INCIDENTS, data={"Incident ID:": 2})
+    set_last_run_per_type(last_run_identifiers, index=LastRunIndex.IDP_DETECTIONS, data={"IDP ID:": 3})
+    set_last_run_per_type(last_run_identifiers, index=LastRunIndex.MOBILE_DETECTIONS, data={"Mobile ID:": 4})
+    set_last_run_per_type(last_run_identifiers, index=LastRunIndex.ON_DEMAND_DETECTIONS, data={"ODS ID:": 5})
+    set_last_run_per_type(last_run_identifiers, index=LastRunIndex.OFP_DETECTION, data={"OFP ID:": 6})
+
+    if command == "fetch-incidents":
+        set_last_run_per_type(last_run_identifiers, index=LastRunIndex.IOM, data={"IOM ID:": 7})
+        set_last_run_per_type(last_run_identifiers, index=LastRunIndex.IOA, data={"IOA ID:": 8})
+
+    # Create a copy to avoid reference issues
+    last_run_identifiers_copy = list(last_run_identifiers)
 
-    last_run_identifiers = ["Detection", "Incident", "IDP", "Mobile", "ODS", "OFP"]
+    # last_run_identifiers = ["Detection", "Incident", "IDP", "Mobile", "ODS", "OFP"]
 
-    mocker.patch("CrowdStrikeFalcon.demisto.getLastRun", return_value=last_run_identifiers)
+    mocker.patch("CrowdStrikeFalcon.demisto.getLastRun", return_value=last_run_identifiers_copy)
     mocker.patch("CrowdStrikeFalcon.demisto.params", return_value={})
 
-    last_run_identifiers_result, _ = fetch_events()
+    last_run_identifiers_result, _ = fetch_items(command=command)
 
     # Verify that fetch_events refers to the correctly indexes for each type by last_run object.
     assert last_run_identifiers_result == last_run_identifiers
diff --git a/Packs/CrowdStrikeFalcon/ReleaseNotes/2_1_22.md b/Packs/CrowdStrikeFalcon/ReleaseNotes/2_1_22.md
new file mode 100644
index 000000000000..515f859eb04e
--- /dev/null
+++ b/Packs/CrowdStrikeFalcon/ReleaseNotes/2_1_22.md
@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### CrowdStrike Falcon
+
+Documentation and Metadata improvements.
diff --git a/Packs/CrowdStrikeFalcon/pack_metadata.json b/Packs/CrowdStrikeFalcon/pack_metadata.json
index b63e6608ab19..1d0cda515342 100644
--- a/Packs/CrowdStrikeFalcon/pack_metadata.json
+++ b/Packs/CrowdStrikeFalcon/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "CrowdStrike Falcon",
     "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.",
     "support": "xsoar",
-    "currentVersion": "2.1.21",
+    "currentVersion": "2.1.22",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",


Reviews:
user: login: thefrieddan1
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T07:01:38Z
user: login: thefrieddan1
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T07:13:07Z
user: login: thefrieddan1
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T07:15:24Z
user: login: lironcohen272
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T08:20:46Z
user: login: lironcohen272
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T08:23:20Z
user: login: lironcohen272
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T08:26:32Z
user: login: thefrieddan1
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T09:02:15Z

Review comments:
diff_hunk: @@ -2915,553 +2940,490 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        result.extend([{} for _ in range(last_run_length - 2)])
path: Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
user: login: thefrieddan1
body: what is the -2 here?

created_at: 2025-05-20T07:01:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2915,553 +2940,490 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        result.extend([{} for _ in range(last_run_length - 2)])
+        return result
 
 
-def fetch_incidents():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    iom_incidents: list[dict[str, Any]] = []
-    ioa_incidents: list[dict[str, Any]] = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    iom_last_run: dict = {} if len(last_run) < 4 else last_run[3]
-    ioa_last_run: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 6 else last_run[5]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 7 else last_run[6]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 8 else last_run[7]
-    params = demisto.params()
+def fetch_endpoint_detections(current_fetch_info_detections, look_back, is_fetch_events):
+    """
+    Fetch detections from CrowdStrike Falcon api.
 
-    fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+    Args:
+        current_fetch_info_detections (dict): The last_run for detection fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for detection
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    look_back = int(params.get("look_back") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+    Returns:
+        tuple: A tuple containing a list of detections and the updated fetch information dictionary.
+    """
+    detections = []
+    fetch_limit = MAX_FETCH_DETECTION_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    detections_offset: int = current_fetch_info_detections.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or INCIDENTS_PER_FETCH
+    fetch_limit = current_fetch_info_detections.get("limit") or fetch_limit
+    incident_type = "detection"
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    fetch_query = demisto.params().get("fetch_query")
+    if fetch_query:
+        fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
+        response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
+    else:
+        response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection)
-                detections.append(incident)
+    detections_ids: list[dict] = demisto.get(response, "resources", [])
+    total_detections = demisto.get(response, "meta.pagination.total")
+    detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
+    if detections_offset:
+        if detections_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            detections_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
+    raw_res = get_detections_entities(detections_ids)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+    if raw_res is not None and "resources" in raw_res:
+        full_detections = demisto.get(raw_res, "resources")
+        for detection in full_detections:
+            detection["incident_type"] = incident_type
+            # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
+            detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: Detection {detection_id} "
+                f"was fetched which was created in {detection['created_timestamp']}"
+            )
+            incident = detection_to_incident(detection, is_fetch_events=is_fetch_events)
+            detections.append(incident)
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    detections = filter_incidents_by_duplicates_and_limit(
+        incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
+    )
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    for detection in detections:
+        occurred = dateparser.parse(detection["occurred"])
+        if occurred:
+            detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or INCIDENTS_PER_FETCH
-        incident_type = "incident"
+    current_fetch_info_detections = update_last_run_object(
+        last_run=current_fetch_info_detections,
+        incidents=detections,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DETECTION_DATE_FORMAT,
+        new_offset=detections_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
 
-        fetch_query = params.get("incidents_fetch_query")
+    return detections, current_fetch_info_detections
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+def fetch_endpoint_incidents(current_fetch_info_incidents, look_back, is_fetch_events):
+    """
+    Fetch incidents from CrowdStrike Falcon api.
 
-    if IDP_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        idp_detections, current_fetch_info_idp_detections = fetch_detections_by_product_type(
-            current_fetch_info_idp_detections,
-            look_back=look_back,
-            fetch_query=params.get("idp_detections_fetch_query", ""),
-            detections_type=IDP_DETECTION,
-            product_type="idp",
-            detection_name_prefix=IDP_DETECTION_FETCH_TYPE,
-            start_time_key="created_timestamp",
-        )
+    Args:
+        current_fetch_info_incidents (dict): The last_run of incident fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for incidents
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if MOBILE_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        mobile_detections, current_fetch_info_mobile_detections = fetch_detections_by_product_type(
-            current_fetch_info_mobile_detections,
-            look_back=look_back,
-            fetch_query=params.get("mobile_detections_fetch_query", ""),
-            detections_type=MOBILE_DETECTION,
-            product_type="mobile",
-            detection_name_prefix=MOBILE_DETECTION_FETCH_TYPE,
-            start_time_key="timestamp",
-        )
+    Returns:
+        tuple: A tuple containing a list of incidents and the updated fetch information dictionary.
+    """
+    incidents = []
+    fetch_limit = MAX_FETCH_INCIDENT_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    if "Indicator of Misconfiguration" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Misconfiguration incidents")
-        demisto.debug(f"{iom_last_run=}")
-        fetch_query = params.get("iom_fetch_query", "")
-        validate_iom_fetch_query(iom_fetch_query=fetch_query)
-
-        last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
-            last_run_object=iom_last_run,
-            date_format=IOM_DATE_FORMAT,
-            last_date_key="last_scan_time",
-            next_token_key="iom_next_token",
-            last_fetched_ids_key="last_resource_ids",
-        )
-        filter = create_iom_filter(
-            is_paginating=bool(iom_next_token),
-            last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
-            last_scan_time=last_scan_time,
-            first_fetch_timestamp=first_fetch_timestamp,
-            configured_fetch_query=fetch_query,
-        )
-        demisto.debug(f"IOM {filter=}")
-        iom_resource_ids, iom_new_next_token = iom_ids_pagination(
-            filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
-        )
-        demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
-        iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
-            fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
-            last_date=last_scan_time,
-            last_fetched_ids=last_resource_ids,
-            date_key="scan_time",
-            id_key="id",
-            date_format=IOM_DATE_FORMAT,
-            is_paginating=bool(iom_new_next_token or iom_next_token),
-            to_incident_context=iom_resource_to_incident,
-            incident_type="iom_configurations",
-        )
+    incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
+    )
 
-        iom_last_run = {
-            "iom_next_token": iom_new_next_token,
-            "last_scan_time": new_scan_time,
-            "last_fetch_filter": filter,
-            "last_resource_ids": fetched_resource_ids or last_resource_ids,
-        }
+    fetch_limit = current_fetch_info_incidents.get("limit") or fetch_limit
+    incident_type = "incident"
 
-    if "Indicator of Attack" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Attack incidents")
-        demisto.debug(f"{ioa_last_run=}")
-        fetch_query = params.get("ioa_fetch_query", "")
-        validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
-
-        last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
-            last_run_object=ioa_last_run,
-            date_format=DATE_FORMAT,
-            last_date_key="last_date_time_since",
-            next_token_key="ioa_next_token",
-            last_fetched_ids_key="last_event_ids",
-        )
-        ioa_fetch_query = create_ioa_query(
-            is_paginating=bool(ioa_next_token),
-            configured_fetch_query=fetch_query,
-            last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
-            last_date_time_since=last_date_time_since,
-        )
-        demisto.debug(f"IOA {ioa_fetch_query=}")
-        ioa_events, ioa_new_next_token = ioa_events_pagination(
-            ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
-        )
-        demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
-
-        ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
-            fetched_data=ioa_events,
-            last_date=last_date_time_since,
-            last_fetched_ids=last_fetch_event_ids,
-            date_key="event_created",
-            id_key="event_id",
-            date_format=DATE_FORMAT,
-            is_paginating=bool(ioa_new_next_token or ioa_next_token),
-            to_incident_context=ioa_event_to_incident,
-            incident_type="ioa_events",
-        )
+    fetch_query = demisto.params().get("incidents_fetch_query")
+    if fetch_query:
+        fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
+        response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        ioa_last_run = {
-            "ioa_next_token": ioa_new_next_token,
-            "last_date_time_since": new_date_time_since,
-            "last_fetch_query": ioa_fetch_query,
-            "last_event_ids": ioa_event_ids or last_fetch_event_ids,
-        }
+    else:
+        response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
+    incidents_ids: list[dict] = demisto.get(response, "resources", [])
+    total_incidents = demisto.get(response, "meta.pagination.total")
+    incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
+    if incidents_offset:
+        if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            incidents_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
 
-    if ON_DEMAND_SCANS_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException("On-Demand Scans Detection is not supported in legacy version.")
-        demisto.debug("Fetching On-Demand Scans Detection incidents")
-        demisto.debug(f"on_demand_detections_last_run= {current_fetch_on_demand_detections}")
+    if incidents_ids:
+        raw_res = get_incidents_entities(incidents_ids)
+        if raw_res is not None and "resources" in raw_res:
+            full_incidents = demisto.get(raw_res, "resources")
+            for incident in full_incidents:
+                incident["incident_type"] = incident_type
+                incident_to_context = incident_to_incident_context(incident, is_fetch_events=is_fetch_events)
+                incidents.append(incident_to_context)
+
+    incidents = filter_incidents_by_duplicates_and_limit(
+        incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
+    )
+    for incident in incidents:
+        occurred = dateparser.parse(incident["occurred"])
+        if occurred:
+            incident["occurred"] = occurred.strftime(DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
+
+    current_fetch_info_incidents = update_last_run_object(
+        last_run=current_fetch_info_incidents,
+        incidents=incidents,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DATE_FORMAT,
+        new_offset=incidents_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
 
-        on_demand_detections, current_fetch_on_demand_detections = fetch_detections_by_product_type(
-            current_fetch_on_demand_detections,
-            look_back=look_back,
-            fetch_query=params.get("on_demand_fetch_query", ""),
-            detections_type=ON_DEMAND_SCANS_DETECTION,
-            product_type="ods",
-            detection_name_prefix=ON_DEMAND_SCANS_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+    return incidents, current_fetch_info_incidents
 
-    if OFP_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException(f"{OFP_DETECTION_TYPE} is not supported in legacy version.")
-        demisto.debug(f"Fetching {OFP_DETECTION_TYPE} incidents")
-        demisto.debug(f"ofp_detection_last_run= {current_fetch_ofp_detection}")
 
-        ofp_detections, current_fetch_ofp_detection = fetch_detections_by_product_type(
-            current_fetch_ofp_detection,
-            look_back=look_back,
-            fetch_query=params.get("ofp_detection_fetch_query", ""),
-            detections_type=OFP_DETECTION,
-            product_type="ofp",
-            detection_name_prefix=OFP_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+def fetch_iom_incidents(iom_last_run):
+    demisto.debug("Fetching Indicator of Misconfiguration incidents")
+    demisto.debug(f"{iom_last_run=}")
+    fetch_query = demisto.params().get("iom_fetch_query", "")
+    validate_iom_fetch_query(iom_fetch_query=fetch_query)
 
-    demisto.setLastRun(
-        [
-            current_fetch_info_detections,
-            current_fetch_info_incidents,
-            current_fetch_info_idp_detections,
-            iom_last_run,
-            ioa_last_run,
-            current_fetch_info_mobile_detections,
-            current_fetch_on_demand_detections,
-            current_fetch_ofp_detection,
-        ]
+    last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
+        last_run_object=iom_last_run,
+        date_format=IOM_DATE_FORMAT,
+        last_date_key="last_scan_time",
+        next_token_key="iom_next_token",
+        last_fetched_ids_key="last_resource_ids",
     )
-    return (
-        incidents
-        + detections
-        + idp_detections
-        + iom_incidents
-        + ioa_incidents
-        + mobile_detections
-        + on_demand_detections
-        + ofp_detections
+    filter = create_iom_filter(
+        is_paginating=bool(iom_next_token),
+        last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
+        last_scan_time=last_scan_time,
+        first_fetch_timestamp=first_fetch_timestamp,
+        configured_fetch_query=fetch_query,
+    )
+    demisto.debug(f"IOM {filter=}")
+    iom_resource_ids, iom_new_next_token = iom_ids_pagination(
+        filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
+    )
+    demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
+    iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
+        fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
+        last_date=last_scan_time,
+        last_fetched_ids=last_resource_ids,
+        date_key="scan_time",
+        id_key="id",
+        date_format=IOM_DATE_FORMAT,
+        is_paginating=bool(iom_new_next_token or iom_next_token),
+        to_incident_context=iom_resource_to_incident,
+        incident_type="iom_configurations",
     )
 
+    iom_last_run = {
+        "iom_next_token": iom_new_next_token,
+        "last_scan_time": new_scan_time,
+        "last_fetch_filter": filter,
+        "last_resource_ids": fetched_resource_ids or last_resource_ids,
+    }
 
-def fetch_events():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run, is_fetch_events=True)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 4 else last_run[3]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 6 else last_run[5]
-    params = demisto.params()
+    return iom_incidents, iom_last_run
 
-    fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
 
-    look_back = int(params.get("look_back_xsiam") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+def fetch_ioa_incidents(ioa_last_run):
+    demisto.debug("Fetching Indicator of Attack incidents")
+    demisto.debug(f"{ioa_last_run=}")
+    fetch_query = demisto.params().get("ioa_fetch_query", "")
+    validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
+        last_run_object=ioa_last_run,
+        date_format=DATE_FORMAT,
+        last_date_key="last_date_time_since",
+        next_token_key="ioa_next_token",
+        last_fetched_ids_key="last_event_ids",
+    )
+    ioa_fetch_query = create_ioa_query(
+        is_paginating=bool(ioa_next_token),
+        configured_fetch_query=fetch_query,
+        last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
+        last_date_time_since=last_date_time_since,
+    )
+    demisto.debug(f"IOA {ioa_fetch_query=}")
+    ioa_events, ioa_new_next_token = ioa_events_pagination(
+        ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
+    )
+    demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
+
+    ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
+        fetched_data=ioa_events,
+        last_date=last_date_time_since,
+        last_fetched_ids=last_fetch_event_ids,
+        date_key="event_created",
+        id_key="event_id",
+        date_format=DATE_FORMAT,
+        is_paginating=bool(ioa_new_next_token or ioa_next_token),
+        to_incident_context=ioa_event_to_incident,
+        incident_type="ioa_events",
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or MAX_FETCH_DETECTION_PER_API_CALL
+    ioa_last_run = {
+        "ioa_next_token": ioa_new_next_token,
+        "last_date_time_since": new_date_time_since,
+        "last_fetch_query": ioa_fetch_query,
+        "last_event_ids": ioa_event_ids or last_fetch_event_ids,
+    }
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    return ioa_incidents, ioa_last_run
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection, is_fetch_events=True)
-                detections.append(incident)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+def set_last_run_per_type(last_run: list, index: LastRunIndex, data: dict, is_fetch_events=False) -> None:
+    """
+    Safely set the specific sub last_run dictionary in the main last_run list.
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        data: The data to set for the specified fetch type
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    Returns:
+        The updated last_run list.
+    """
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type1")
+    if not isinstance(data, dict):
+        demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type2")
+        return_error(f"Invalid data type : last_run is a list of dictionary, expected dictionary, got {type(data).__name__}")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type3")
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type4")
+    if index >= last_run_length:
+        return_error(f"Invalid last_run index {index}, cannot exceed {last_run_length - 1}")
+    if index < 0:
+        return_error(f"Invalid last_run index {index}, index cannot be negative")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type5")
+    # Extend the list if necessary to accommodate the fetch_type index
+    while len(last_run) <= index:
+        last_run.append({})
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type6")
+    last_run[index] = data
+    demisto.debug(f"CrowdStrikeFalconMsg: set_last_run_per_type7 {last_run}")
+
+
+def get_last_run_per_type(last_run: list, fetch_type: LastRunIndex) -> dict:
+    """
+    Safely get the specific sub last_run dictionary from the main last_run list.
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or MAX_FETCH_INCIDENT_PER_API_CALL
-        incident_type = "incident"
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        default: Default value if not present (defaults to empty dict)
 
-        fetch_query = params.get("incidents_fetch_query")
+    Returns:
+        The last_run dict from the list for the requested type.
+    """
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
+    if len(last_run) <= fetch_type:
+        return {}
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident, is_fetch_events=True)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+    return last_run[fetch_type]
+
+
+def fetch_items(command="fetch-incidents"):
+    """
+    Fetch incidents or events from CrowdStrike Falcon based on configuration.
+
+    Args:
+        command (str): Either 'fetch-incidents' or 'fetch-events'
+
+    Returns:
+        tuple: (last_run, items) where last_run is the updated state and items are the fetched incidents/events
+    """
+
+    is_fetch_events = command == "fetch-events"
+    items = []
+    params = demisto.params()
+
+    # Initialize and migrate last_run
+    last_run = demisto.getLastRun()
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    if not last_run:
+        last_run = [{} for _ in range(last_run_length)]
+    last_run = migrate_last_run(last_run, is_fetch_events)
+
+    # last_run objects - common for fetch_incident and fetch_events
+    detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.DETECTIONS)
+    incidents_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.INCIDENTS)
+    idp_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.IDP_DETECTIONS)
+    mobile_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.MOBILE_DETECTIONS)
+    on_demand_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.ON_DEMAND_DETECTIONS)
+    ofp_detection_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.OFP_DETECTION)
+
+    # last_run objects - fetch types only for fetch-incidents
+    iom_last_run: dict[str, Any] = {}
+    ioa_last_run: dict[str, Any] = {}
+
+    if is_fetch_events:
+        fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
+        look_back = int(params.get("look_back_xsiam") or 2)
+    else:
+        fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+        look_back = int(params.get("look_back") or 2)
path: Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
user: login: thefrieddan1
body: look_back = int(params.get("look_back") or 2)
can be once outside the if else scope
created_at: 2025-05-20T07:13:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2915,553 +2940,490 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        result.extend([{} for _ in range(last_run_length - 2)])
+        return result
 
 
-def fetch_incidents():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    iom_incidents: list[dict[str, Any]] = []
-    ioa_incidents: list[dict[str, Any]] = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    iom_last_run: dict = {} if len(last_run) < 4 else last_run[3]
-    ioa_last_run: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 6 else last_run[5]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 7 else last_run[6]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 8 else last_run[7]
-    params = demisto.params()
+def fetch_endpoint_detections(current_fetch_info_detections, look_back, is_fetch_events):
+    """
+    Fetch detections from CrowdStrike Falcon api.
 
-    fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+    Args:
+        current_fetch_info_detections (dict): The last_run for detection fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for detection
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    look_back = int(params.get("look_back") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+    Returns:
+        tuple: A tuple containing a list of detections and the updated fetch information dictionary.
+    """
+    detections = []
+    fetch_limit = MAX_FETCH_DETECTION_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    detections_offset: int = current_fetch_info_detections.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or INCIDENTS_PER_FETCH
+    fetch_limit = current_fetch_info_detections.get("limit") or fetch_limit
+    incident_type = "detection"
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    fetch_query = demisto.params().get("fetch_query")
+    if fetch_query:
+        fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
+        response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
+    else:
+        response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection)
-                detections.append(incident)
+    detections_ids: list[dict] = demisto.get(response, "resources", [])
+    total_detections = demisto.get(response, "meta.pagination.total")
+    detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
+    if detections_offset:
+        if detections_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            detections_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
+    raw_res = get_detections_entities(detections_ids)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+    if raw_res is not None and "resources" in raw_res:
+        full_detections = demisto.get(raw_res, "resources")
+        for detection in full_detections:
+            detection["incident_type"] = incident_type
+            # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
+            detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: Detection {detection_id} "
+                f"was fetched which was created in {detection['created_timestamp']}"
+            )
+            incident = detection_to_incident(detection, is_fetch_events=is_fetch_events)
+            detections.append(incident)
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    detections = filter_incidents_by_duplicates_and_limit(
+        incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
+    )
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    for detection in detections:
+        occurred = dateparser.parse(detection["occurred"])
+        if occurred:
+            detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or INCIDENTS_PER_FETCH
-        incident_type = "incident"
+    current_fetch_info_detections = update_last_run_object(
+        last_run=current_fetch_info_detections,
+        incidents=detections,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DETECTION_DATE_FORMAT,
+        new_offset=detections_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
 
-        fetch_query = params.get("incidents_fetch_query")
+    return detections, current_fetch_info_detections
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+def fetch_endpoint_incidents(current_fetch_info_incidents, look_back, is_fetch_events):
+    """
+    Fetch incidents from CrowdStrike Falcon api.
 
-    if IDP_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        idp_detections, current_fetch_info_idp_detections = fetch_detections_by_product_type(
-            current_fetch_info_idp_detections,
-            look_back=look_back,
-            fetch_query=params.get("idp_detections_fetch_query", ""),
-            detections_type=IDP_DETECTION,
-            product_type="idp",
-            detection_name_prefix=IDP_DETECTION_FETCH_TYPE,
-            start_time_key="created_timestamp",
-        )
+    Args:
+        current_fetch_info_incidents (dict): The last_run of incident fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for incidents
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if MOBILE_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        mobile_detections, current_fetch_info_mobile_detections = fetch_detections_by_product_type(
-            current_fetch_info_mobile_detections,
-            look_back=look_back,
-            fetch_query=params.get("mobile_detections_fetch_query", ""),
-            detections_type=MOBILE_DETECTION,
-            product_type="mobile",
-            detection_name_prefix=MOBILE_DETECTION_FETCH_TYPE,
-            start_time_key="timestamp",
-        )
+    Returns:
+        tuple: A tuple containing a list of incidents and the updated fetch information dictionary.
+    """
+    incidents = []
+    fetch_limit = MAX_FETCH_INCIDENT_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    if "Indicator of Misconfiguration" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Misconfiguration incidents")
-        demisto.debug(f"{iom_last_run=}")
-        fetch_query = params.get("iom_fetch_query", "")
-        validate_iom_fetch_query(iom_fetch_query=fetch_query)
-
-        last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
-            last_run_object=iom_last_run,
-            date_format=IOM_DATE_FORMAT,
-            last_date_key="last_scan_time",
-            next_token_key="iom_next_token",
-            last_fetched_ids_key="last_resource_ids",
-        )
-        filter = create_iom_filter(
-            is_paginating=bool(iom_next_token),
-            last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
-            last_scan_time=last_scan_time,
-            first_fetch_timestamp=first_fetch_timestamp,
-            configured_fetch_query=fetch_query,
-        )
-        demisto.debug(f"IOM {filter=}")
-        iom_resource_ids, iom_new_next_token = iom_ids_pagination(
-            filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
-        )
-        demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
-        iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
-            fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
-            last_date=last_scan_time,
-            last_fetched_ids=last_resource_ids,
-            date_key="scan_time",
-            id_key="id",
-            date_format=IOM_DATE_FORMAT,
-            is_paginating=bool(iom_new_next_token or iom_next_token),
-            to_incident_context=iom_resource_to_incident,
-            incident_type="iom_configurations",
-        )
+    incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
+    )
 
-        iom_last_run = {
-            "iom_next_token": iom_new_next_token,
-            "last_scan_time": new_scan_time,
-            "last_fetch_filter": filter,
-            "last_resource_ids": fetched_resource_ids or last_resource_ids,
-        }
+    fetch_limit = current_fetch_info_incidents.get("limit") or fetch_limit
+    incident_type = "incident"
 
-    if "Indicator of Attack" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Attack incidents")
-        demisto.debug(f"{ioa_last_run=}")
-        fetch_query = params.get("ioa_fetch_query", "")
-        validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
-
-        last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
-            last_run_object=ioa_last_run,
-            date_format=DATE_FORMAT,
-            last_date_key="last_date_time_since",
-            next_token_key="ioa_next_token",
-            last_fetched_ids_key="last_event_ids",
-        )
-        ioa_fetch_query = create_ioa_query(
-            is_paginating=bool(ioa_next_token),
-            configured_fetch_query=fetch_query,
-            last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
-            last_date_time_since=last_date_time_since,
-        )
-        demisto.debug(f"IOA {ioa_fetch_query=}")
-        ioa_events, ioa_new_next_token = ioa_events_pagination(
-            ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
-        )
-        demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
-
-        ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
-            fetched_data=ioa_events,
-            last_date=last_date_time_since,
-            last_fetched_ids=last_fetch_event_ids,
-            date_key="event_created",
-            id_key="event_id",
-            date_format=DATE_FORMAT,
-            is_paginating=bool(ioa_new_next_token or ioa_next_token),
-            to_incident_context=ioa_event_to_incident,
-            incident_type="ioa_events",
-        )
+    fetch_query = demisto.params().get("incidents_fetch_query")
+    if fetch_query:
+        fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
+        response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        ioa_last_run = {
-            "ioa_next_token": ioa_new_next_token,
-            "last_date_time_since": new_date_time_since,
-            "last_fetch_query": ioa_fetch_query,
-            "last_event_ids": ioa_event_ids or last_fetch_event_ids,
-        }
+    else:
+        response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
+    incidents_ids: list[dict] = demisto.get(response, "resources", [])
+    total_incidents = demisto.get(response, "meta.pagination.total")
+    incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
+    if incidents_offset:
+        if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            incidents_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
 
-    if ON_DEMAND_SCANS_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException("On-Demand Scans Detection is not supported in legacy version.")
-        demisto.debug("Fetching On-Demand Scans Detection incidents")
-        demisto.debug(f"on_demand_detections_last_run= {current_fetch_on_demand_detections}")
+    if incidents_ids:
+        raw_res = get_incidents_entities(incidents_ids)
+        if raw_res is not None and "resources" in raw_res:
+            full_incidents = demisto.get(raw_res, "resources")
+            for incident in full_incidents:
+                incident["incident_type"] = incident_type
+                incident_to_context = incident_to_incident_context(incident, is_fetch_events=is_fetch_events)
+                incidents.append(incident_to_context)
+
+    incidents = filter_incidents_by_duplicates_and_limit(
+        incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
+    )
+    for incident in incidents:
+        occurred = dateparser.parse(incident["occurred"])
+        if occurred:
+            incident["occurred"] = occurred.strftime(DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
+
+    current_fetch_info_incidents = update_last_run_object(
+        last_run=current_fetch_info_incidents,
+        incidents=incidents,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DATE_FORMAT,
+        new_offset=incidents_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
 
-        on_demand_detections, current_fetch_on_demand_detections = fetch_detections_by_product_type(
-            current_fetch_on_demand_detections,
-            look_back=look_back,
-            fetch_query=params.get("on_demand_fetch_query", ""),
-            detections_type=ON_DEMAND_SCANS_DETECTION,
-            product_type="ods",
-            detection_name_prefix=ON_DEMAND_SCANS_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+    return incidents, current_fetch_info_incidents
 
-    if OFP_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException(f"{OFP_DETECTION_TYPE} is not supported in legacy version.")
-        demisto.debug(f"Fetching {OFP_DETECTION_TYPE} incidents")
-        demisto.debug(f"ofp_detection_last_run= {current_fetch_ofp_detection}")
 
-        ofp_detections, current_fetch_ofp_detection = fetch_detections_by_product_type(
-            current_fetch_ofp_detection,
-            look_back=look_back,
-            fetch_query=params.get("ofp_detection_fetch_query", ""),
-            detections_type=OFP_DETECTION,
-            product_type="ofp",
-            detection_name_prefix=OFP_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+def fetch_iom_incidents(iom_last_run):
+    demisto.debug("Fetching Indicator of Misconfiguration incidents")
+    demisto.debug(f"{iom_last_run=}")
+    fetch_query = demisto.params().get("iom_fetch_query", "")
+    validate_iom_fetch_query(iom_fetch_query=fetch_query)
 
-    demisto.setLastRun(
-        [
-            current_fetch_info_detections,
-            current_fetch_info_incidents,
-            current_fetch_info_idp_detections,
-            iom_last_run,
-            ioa_last_run,
-            current_fetch_info_mobile_detections,
-            current_fetch_on_demand_detections,
-            current_fetch_ofp_detection,
-        ]
+    last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
+        last_run_object=iom_last_run,
+        date_format=IOM_DATE_FORMAT,
+        last_date_key="last_scan_time",
+        next_token_key="iom_next_token",
+        last_fetched_ids_key="last_resource_ids",
     )
-    return (
-        incidents
-        + detections
-        + idp_detections
-        + iom_incidents
-        + ioa_incidents
-        + mobile_detections
-        + on_demand_detections
-        + ofp_detections
+    filter = create_iom_filter(
+        is_paginating=bool(iom_next_token),
+        last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
+        last_scan_time=last_scan_time,
+        first_fetch_timestamp=first_fetch_timestamp,
+        configured_fetch_query=fetch_query,
+    )
+    demisto.debug(f"IOM {filter=}")
+    iom_resource_ids, iom_new_next_token = iom_ids_pagination(
+        filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
+    )
+    demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
+    iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
+        fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
+        last_date=last_scan_time,
+        last_fetched_ids=last_resource_ids,
+        date_key="scan_time",
+        id_key="id",
+        date_format=IOM_DATE_FORMAT,
+        is_paginating=bool(iom_new_next_token or iom_next_token),
+        to_incident_context=iom_resource_to_incident,
+        incident_type="iom_configurations",
     )
 
+    iom_last_run = {
+        "iom_next_token": iom_new_next_token,
+        "last_scan_time": new_scan_time,
+        "last_fetch_filter": filter,
+        "last_resource_ids": fetched_resource_ids or last_resource_ids,
+    }
 
-def fetch_events():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run, is_fetch_events=True)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 4 else last_run[3]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 6 else last_run[5]
-    params = demisto.params()
+    return iom_incidents, iom_last_run
 
-    fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
 
-    look_back = int(params.get("look_back_xsiam") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+def fetch_ioa_incidents(ioa_last_run):
+    demisto.debug("Fetching Indicator of Attack incidents")
+    demisto.debug(f"{ioa_last_run=}")
+    fetch_query = demisto.params().get("ioa_fetch_query", "")
+    validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
+        last_run_object=ioa_last_run,
+        date_format=DATE_FORMAT,
+        last_date_key="last_date_time_since",
+        next_token_key="ioa_next_token",
+        last_fetched_ids_key="last_event_ids",
+    )
+    ioa_fetch_query = create_ioa_query(
+        is_paginating=bool(ioa_next_token),
+        configured_fetch_query=fetch_query,
+        last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
+        last_date_time_since=last_date_time_since,
+    )
+    demisto.debug(f"IOA {ioa_fetch_query=}")
+    ioa_events, ioa_new_next_token = ioa_events_pagination(
+        ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
+    )
+    demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
+
+    ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
+        fetched_data=ioa_events,
+        last_date=last_date_time_since,
+        last_fetched_ids=last_fetch_event_ids,
+        date_key="event_created",
+        id_key="event_id",
+        date_format=DATE_FORMAT,
+        is_paginating=bool(ioa_new_next_token or ioa_next_token),
+        to_incident_context=ioa_event_to_incident,
+        incident_type="ioa_events",
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or MAX_FETCH_DETECTION_PER_API_CALL
+    ioa_last_run = {
+        "ioa_next_token": ioa_new_next_token,
+        "last_date_time_since": new_date_time_since,
+        "last_fetch_query": ioa_fetch_query,
+        "last_event_ids": ioa_event_ids or last_fetch_event_ids,
+    }
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    return ioa_incidents, ioa_last_run
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection, is_fetch_events=True)
-                detections.append(incident)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+def set_last_run_per_type(last_run: list, index: LastRunIndex, data: dict, is_fetch_events=False) -> None:
+    """
+    Safely set the specific sub last_run dictionary in the main last_run list.
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        data: The data to set for the specified fetch type
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    Returns:
+        The updated last_run list.
+    """
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type1")
+    if not isinstance(data, dict):
+        demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type2")
+        return_error(f"Invalid data type : last_run is a list of dictionary, expected dictionary, got {type(data).__name__}")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type3")
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type4")
+    if index >= last_run_length:
+        return_error(f"Invalid last_run index {index}, cannot exceed {last_run_length - 1}")
+    if index < 0:
+        return_error(f"Invalid last_run index {index}, index cannot be negative")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type5")
+    # Extend the list if necessary to accommodate the fetch_type index
+    while len(last_run) <= index:
+        last_run.append({})
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type6")
+    last_run[index] = data
+    demisto.debug(f"CrowdStrikeFalconMsg: set_last_run_per_type7 {last_run}")
+
+
+def get_last_run_per_type(last_run: list, fetch_type: LastRunIndex) -> dict:
+    """
+    Safely get the specific sub last_run dictionary from the main last_run list.
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or MAX_FETCH_INCIDENT_PER_API_CALL
-        incident_type = "incident"
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        default: Default value if not present (defaults to empty dict)
 
-        fetch_query = params.get("incidents_fetch_query")
+    Returns:
+        The last_run dict from the list for the requested type.
+    """
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
+    if len(last_run) <= fetch_type:
+        return {}
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident, is_fetch_events=True)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+    return last_run[fetch_type]
+
+
+def fetch_items(command="fetch-incidents"):
+    """
+    Fetch incidents or events from CrowdStrike Falcon based on configuration.
+
+    Args:
+        command (str): Either 'fetch-incidents' or 'fetch-events'
+
+    Returns:
+        tuple: (last_run, items) where last_run is the updated state and items are the fetched incidents/events
+    """
+
+    is_fetch_events = command == "fetch-events"
+    items = []
+    params = demisto.params()
+
+    # Initialize and migrate last_run
+    last_run = demisto.getLastRun()
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    if not last_run:
+        last_run = [{} for _ in range(last_run_length)]
+    last_run = migrate_last_run(last_run, is_fetch_events)
+
+    # last_run objects - common for fetch_incident and fetch_events
+    detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.DETECTIONS)
+    incidents_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.INCIDENTS)
+    idp_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.IDP_DETECTIONS)
+    mobile_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.MOBILE_DETECTIONS)
+    on_demand_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.ON_DEMAND_DETECTIONS)
+    ofp_detection_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.OFP_DETECTION)
+
+    # last_run objects - fetch types only for fetch-incidents
+    iom_last_run: dict[str, Any] = {}
+    ioa_last_run: dict[str, Any] = {}
+
+    if is_fetch_events:
+        fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
+        look_back = int(params.get("look_back_xsiam") or 2)
+    else:
+        fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+        look_back = int(params.get("look_back") or 2)
 
+        # last_run object - Only for fetch_incident
+        iom_last_run = get_last_run_per_type(last_run, LastRunIndex.IOM)
+        ioa_last_run = get_last_run_per_type(last_run, LastRunIndex.IOA)
+
+    demisto.debug(f"CrowdstrikeFalconMsg: Selected fetch types: {fetch_incidents_or_detections}")
+
+    # Fetch Endpoint Detections
+    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch Detections")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current detections_last_run object: {detections_last_run}")
+
+        fetched_detections, detections_last_run = fetch_endpoint_detections(detections_last_run, look_back, is_fetch_events)
+        items.extend(fetched_detections)
+
+    # Fetch Endpoint Incidents
+    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
path: Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
user: login: thefrieddan1
body: replace "Incidents" "Detections" "Endpoint Incident" with consts
created_at: 2025-05-20T07:15:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2915,553 +2940,490 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        result.extend([{} for _ in range(last_run_length - 2)])
path: Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
user: login: lironcohen272
body: 2 is the length of:
_result = [updated_last_run_detections, updated_last_run_incidents]_

I will change it to variable instead of magic number. 
created_at: 2025-05-20T08:20:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2915,553 +2940,490 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        result.extend([{} for _ in range(last_run_length - 2)])
+        return result
 
 
-def fetch_incidents():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    iom_incidents: list[dict[str, Any]] = []
-    ioa_incidents: list[dict[str, Any]] = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    iom_last_run: dict = {} if len(last_run) < 4 else last_run[3]
-    ioa_last_run: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 6 else last_run[5]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 7 else last_run[6]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 8 else last_run[7]
-    params = demisto.params()
+def fetch_endpoint_detections(current_fetch_info_detections, look_back, is_fetch_events):
+    """
+    Fetch detections from CrowdStrike Falcon api.
 
-    fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+    Args:
+        current_fetch_info_detections (dict): The last_run for detection fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for detection
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    look_back = int(params.get("look_back") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+    Returns:
+        tuple: A tuple containing a list of detections and the updated fetch information dictionary.
+    """
+    detections = []
+    fetch_limit = MAX_FETCH_DETECTION_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    detections_offset: int = current_fetch_info_detections.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or INCIDENTS_PER_FETCH
+    fetch_limit = current_fetch_info_detections.get("limit") or fetch_limit
+    incident_type = "detection"
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    fetch_query = demisto.params().get("fetch_query")
+    if fetch_query:
+        fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
+        response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
+    else:
+        response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection)
-                detections.append(incident)
+    detections_ids: list[dict] = demisto.get(response, "resources", [])
+    total_detections = demisto.get(response, "meta.pagination.total")
+    detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
+    if detections_offset:
+        if detections_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            detections_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
+    raw_res = get_detections_entities(detections_ids)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+    if raw_res is not None and "resources" in raw_res:
+        full_detections = demisto.get(raw_res, "resources")
+        for detection in full_detections:
+            detection["incident_type"] = incident_type
+            # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
+            detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: Detection {detection_id} "
+                f"was fetched which was created in {detection['created_timestamp']}"
+            )
+            incident = detection_to_incident(detection, is_fetch_events=is_fetch_events)
+            detections.append(incident)
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    detections = filter_incidents_by_duplicates_and_limit(
+        incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
+    )
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    for detection in detections:
+        occurred = dateparser.parse(detection["occurred"])
+        if occurred:
+            detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or INCIDENTS_PER_FETCH
-        incident_type = "incident"
+    current_fetch_info_detections = update_last_run_object(
+        last_run=current_fetch_info_detections,
+        incidents=detections,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DETECTION_DATE_FORMAT,
+        new_offset=detections_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
 
-        fetch_query = params.get("incidents_fetch_query")
+    return detections, current_fetch_info_detections
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+def fetch_endpoint_incidents(current_fetch_info_incidents, look_back, is_fetch_events):
+    """
+    Fetch incidents from CrowdStrike Falcon api.
 
-    if IDP_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        idp_detections, current_fetch_info_idp_detections = fetch_detections_by_product_type(
-            current_fetch_info_idp_detections,
-            look_back=look_back,
-            fetch_query=params.get("idp_detections_fetch_query", ""),
-            detections_type=IDP_DETECTION,
-            product_type="idp",
-            detection_name_prefix=IDP_DETECTION_FETCH_TYPE,
-            start_time_key="created_timestamp",
-        )
+    Args:
+        current_fetch_info_incidents (dict): The last_run of incident fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for incidents
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if MOBILE_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        mobile_detections, current_fetch_info_mobile_detections = fetch_detections_by_product_type(
-            current_fetch_info_mobile_detections,
-            look_back=look_back,
-            fetch_query=params.get("mobile_detections_fetch_query", ""),
-            detections_type=MOBILE_DETECTION,
-            product_type="mobile",
-            detection_name_prefix=MOBILE_DETECTION_FETCH_TYPE,
-            start_time_key="timestamp",
-        )
+    Returns:
+        tuple: A tuple containing a list of incidents and the updated fetch information dictionary.
+    """
+    incidents = []
+    fetch_limit = MAX_FETCH_INCIDENT_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    if "Indicator of Misconfiguration" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Misconfiguration incidents")
-        demisto.debug(f"{iom_last_run=}")
-        fetch_query = params.get("iom_fetch_query", "")
-        validate_iom_fetch_query(iom_fetch_query=fetch_query)
-
-        last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
-            last_run_object=iom_last_run,
-            date_format=IOM_DATE_FORMAT,
-            last_date_key="last_scan_time",
-            next_token_key="iom_next_token",
-            last_fetched_ids_key="last_resource_ids",
-        )
-        filter = create_iom_filter(
-            is_paginating=bool(iom_next_token),
-            last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
-            last_scan_time=last_scan_time,
-            first_fetch_timestamp=first_fetch_timestamp,
-            configured_fetch_query=fetch_query,
-        )
-        demisto.debug(f"IOM {filter=}")
-        iom_resource_ids, iom_new_next_token = iom_ids_pagination(
-            filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
-        )
-        demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
-        iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
-            fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
-            last_date=last_scan_time,
-            last_fetched_ids=last_resource_ids,
-            date_key="scan_time",
-            id_key="id",
-            date_format=IOM_DATE_FORMAT,
-            is_paginating=bool(iom_new_next_token or iom_next_token),
-            to_incident_context=iom_resource_to_incident,
-            incident_type="iom_configurations",
-        )
+    incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
+    )
 
-        iom_last_run = {
-            "iom_next_token": iom_new_next_token,
-            "last_scan_time": new_scan_time,
-            "last_fetch_filter": filter,
-            "last_resource_ids": fetched_resource_ids or last_resource_ids,
-        }
+    fetch_limit = current_fetch_info_incidents.get("limit") or fetch_limit
+    incident_type = "incident"
 
-    if "Indicator of Attack" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Attack incidents")
-        demisto.debug(f"{ioa_last_run=}")
-        fetch_query = params.get("ioa_fetch_query", "")
-        validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
-
-        last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
-            last_run_object=ioa_last_run,
-            date_format=DATE_FORMAT,
-            last_date_key="last_date_time_since",
-            next_token_key="ioa_next_token",
-            last_fetched_ids_key="last_event_ids",
-        )
-        ioa_fetch_query = create_ioa_query(
-            is_paginating=bool(ioa_next_token),
-            configured_fetch_query=fetch_query,
-            last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
-            last_date_time_since=last_date_time_since,
-        )
-        demisto.debug(f"IOA {ioa_fetch_query=}")
-        ioa_events, ioa_new_next_token = ioa_events_pagination(
-            ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
-        )
-        demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
-
-        ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
-            fetched_data=ioa_events,
-            last_date=last_date_time_since,
-            last_fetched_ids=last_fetch_event_ids,
-            date_key="event_created",
-            id_key="event_id",
-            date_format=DATE_FORMAT,
-            is_paginating=bool(ioa_new_next_token or ioa_next_token),
-            to_incident_context=ioa_event_to_incident,
-            incident_type="ioa_events",
-        )
+    fetch_query = demisto.params().get("incidents_fetch_query")
+    if fetch_query:
+        fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
+        response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        ioa_last_run = {
-            "ioa_next_token": ioa_new_next_token,
-            "last_date_time_since": new_date_time_since,
-            "last_fetch_query": ioa_fetch_query,
-            "last_event_ids": ioa_event_ids or last_fetch_event_ids,
-        }
+    else:
+        response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
+    incidents_ids: list[dict] = demisto.get(response, "resources", [])
+    total_incidents = demisto.get(response, "meta.pagination.total")
+    incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
+    if incidents_offset:
+        if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            incidents_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
 
-    if ON_DEMAND_SCANS_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException("On-Demand Scans Detection is not supported in legacy version.")
-        demisto.debug("Fetching On-Demand Scans Detection incidents")
-        demisto.debug(f"on_demand_detections_last_run= {current_fetch_on_demand_detections}")
+    if incidents_ids:
+        raw_res = get_incidents_entities(incidents_ids)
+        if raw_res is not None and "resources" in raw_res:
+            full_incidents = demisto.get(raw_res, "resources")
+            for incident in full_incidents:
+                incident["incident_type"] = incident_type
+                incident_to_context = incident_to_incident_context(incident, is_fetch_events=is_fetch_events)
+                incidents.append(incident_to_context)
+
+    incidents = filter_incidents_by_duplicates_and_limit(
+        incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
+    )
+    for incident in incidents:
+        occurred = dateparser.parse(incident["occurred"])
+        if occurred:
+            incident["occurred"] = occurred.strftime(DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
+
+    current_fetch_info_incidents = update_last_run_object(
+        last_run=current_fetch_info_incidents,
+        incidents=incidents,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DATE_FORMAT,
+        new_offset=incidents_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
 
-        on_demand_detections, current_fetch_on_demand_detections = fetch_detections_by_product_type(
-            current_fetch_on_demand_detections,
-            look_back=look_back,
-            fetch_query=params.get("on_demand_fetch_query", ""),
-            detections_type=ON_DEMAND_SCANS_DETECTION,
-            product_type="ods",
-            detection_name_prefix=ON_DEMAND_SCANS_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+    return incidents, current_fetch_info_incidents
 
-    if OFP_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException(f"{OFP_DETECTION_TYPE} is not supported in legacy version.")
-        demisto.debug(f"Fetching {OFP_DETECTION_TYPE} incidents")
-        demisto.debug(f"ofp_detection_last_run= {current_fetch_ofp_detection}")
 
-        ofp_detections, current_fetch_ofp_detection = fetch_detections_by_product_type(
-            current_fetch_ofp_detection,
-            look_back=look_back,
-            fetch_query=params.get("ofp_detection_fetch_query", ""),
-            detections_type=OFP_DETECTION,
-            product_type="ofp",
-            detection_name_prefix=OFP_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+def fetch_iom_incidents(iom_last_run):
+    demisto.debug("Fetching Indicator of Misconfiguration incidents")
+    demisto.debug(f"{iom_last_run=}")
+    fetch_query = demisto.params().get("iom_fetch_query", "")
+    validate_iom_fetch_query(iom_fetch_query=fetch_query)
 
-    demisto.setLastRun(
-        [
-            current_fetch_info_detections,
-            current_fetch_info_incidents,
-            current_fetch_info_idp_detections,
-            iom_last_run,
-            ioa_last_run,
-            current_fetch_info_mobile_detections,
-            current_fetch_on_demand_detections,
-            current_fetch_ofp_detection,
-        ]
+    last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
+        last_run_object=iom_last_run,
+        date_format=IOM_DATE_FORMAT,
+        last_date_key="last_scan_time",
+        next_token_key="iom_next_token",
+        last_fetched_ids_key="last_resource_ids",
     )
-    return (
-        incidents
-        + detections
-        + idp_detections
-        + iom_incidents
-        + ioa_incidents
-        + mobile_detections
-        + on_demand_detections
-        + ofp_detections
+    filter = create_iom_filter(
+        is_paginating=bool(iom_next_token),
+        last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
+        last_scan_time=last_scan_time,
+        first_fetch_timestamp=first_fetch_timestamp,
+        configured_fetch_query=fetch_query,
+    )
+    demisto.debug(f"IOM {filter=}")
+    iom_resource_ids, iom_new_next_token = iom_ids_pagination(
+        filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
+    )
+    demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
+    iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
+        fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
+        last_date=last_scan_time,
+        last_fetched_ids=last_resource_ids,
+        date_key="scan_time",
+        id_key="id",
+        date_format=IOM_DATE_FORMAT,
+        is_paginating=bool(iom_new_next_token or iom_next_token),
+        to_incident_context=iom_resource_to_incident,
+        incident_type="iom_configurations",
     )
 
+    iom_last_run = {
+        "iom_next_token": iom_new_next_token,
+        "last_scan_time": new_scan_time,
+        "last_fetch_filter": filter,
+        "last_resource_ids": fetched_resource_ids or last_resource_ids,
+    }
 
-def fetch_events():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run, is_fetch_events=True)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 4 else last_run[3]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 6 else last_run[5]
-    params = demisto.params()
+    return iom_incidents, iom_last_run
 
-    fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
 
-    look_back = int(params.get("look_back_xsiam") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+def fetch_ioa_incidents(ioa_last_run):
+    demisto.debug("Fetching Indicator of Attack incidents")
+    demisto.debug(f"{ioa_last_run=}")
+    fetch_query = demisto.params().get("ioa_fetch_query", "")
+    validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
+        last_run_object=ioa_last_run,
+        date_format=DATE_FORMAT,
+        last_date_key="last_date_time_since",
+        next_token_key="ioa_next_token",
+        last_fetched_ids_key="last_event_ids",
+    )
+    ioa_fetch_query = create_ioa_query(
+        is_paginating=bool(ioa_next_token),
+        configured_fetch_query=fetch_query,
+        last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
+        last_date_time_since=last_date_time_since,
+    )
+    demisto.debug(f"IOA {ioa_fetch_query=}")
+    ioa_events, ioa_new_next_token = ioa_events_pagination(
+        ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
+    )
+    demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
+
+    ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
+        fetched_data=ioa_events,
+        last_date=last_date_time_since,
+        last_fetched_ids=last_fetch_event_ids,
+        date_key="event_created",
+        id_key="event_id",
+        date_format=DATE_FORMAT,
+        is_paginating=bool(ioa_new_next_token or ioa_next_token),
+        to_incident_context=ioa_event_to_incident,
+        incident_type="ioa_events",
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or MAX_FETCH_DETECTION_PER_API_CALL
+    ioa_last_run = {
+        "ioa_next_token": ioa_new_next_token,
+        "last_date_time_since": new_date_time_since,
+        "last_fetch_query": ioa_fetch_query,
+        "last_event_ids": ioa_event_ids or last_fetch_event_ids,
+    }
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    return ioa_incidents, ioa_last_run
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection, is_fetch_events=True)
-                detections.append(incident)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+def set_last_run_per_type(last_run: list, index: LastRunIndex, data: dict, is_fetch_events=False) -> None:
+    """
+    Safely set the specific sub last_run dictionary in the main last_run list.
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        data: The data to set for the specified fetch type
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    Returns:
+        The updated last_run list.
+    """
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type1")
+    if not isinstance(data, dict):
+        demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type2")
+        return_error(f"Invalid data type : last_run is a list of dictionary, expected dictionary, got {type(data).__name__}")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type3")
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type4")
+    if index >= last_run_length:
+        return_error(f"Invalid last_run index {index}, cannot exceed {last_run_length - 1}")
+    if index < 0:
+        return_error(f"Invalid last_run index {index}, index cannot be negative")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type5")
+    # Extend the list if necessary to accommodate the fetch_type index
+    while len(last_run) <= index:
+        last_run.append({})
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type6")
+    last_run[index] = data
+    demisto.debug(f"CrowdStrikeFalconMsg: set_last_run_per_type7 {last_run}")
+
+
+def get_last_run_per_type(last_run: list, fetch_type: LastRunIndex) -> dict:
+    """
+    Safely get the specific sub last_run dictionary from the main last_run list.
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or MAX_FETCH_INCIDENT_PER_API_CALL
-        incident_type = "incident"
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        default: Default value if not present (defaults to empty dict)
 
-        fetch_query = params.get("incidents_fetch_query")
+    Returns:
+        The last_run dict from the list for the requested type.
+    """
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
+    if len(last_run) <= fetch_type:
+        return {}
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident, is_fetch_events=True)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+    return last_run[fetch_type]
+
+
+def fetch_items(command="fetch-incidents"):
+    """
+    Fetch incidents or events from CrowdStrike Falcon based on configuration.
+
+    Args:
+        command (str): Either 'fetch-incidents' or 'fetch-events'
+
+    Returns:
+        tuple: (last_run, items) where last_run is the updated state and items are the fetched incidents/events
+    """
+
+    is_fetch_events = command == "fetch-events"
+    items = []
+    params = demisto.params()
+
+    # Initialize and migrate last_run
+    last_run = demisto.getLastRun()
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    if not last_run:
+        last_run = [{} for _ in range(last_run_length)]
+    last_run = migrate_last_run(last_run, is_fetch_events)
+
+    # last_run objects - common for fetch_incident and fetch_events
+    detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.DETECTIONS)
+    incidents_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.INCIDENTS)
+    idp_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.IDP_DETECTIONS)
+    mobile_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.MOBILE_DETECTIONS)
+    on_demand_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.ON_DEMAND_DETECTIONS)
+    ofp_detection_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.OFP_DETECTION)
+
+    # last_run objects - fetch types only for fetch-incidents
+    iom_last_run: dict[str, Any] = {}
+    ioa_last_run: dict[str, Any] = {}
+
+    if is_fetch_events:
+        fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
+        look_back = int(params.get("look_back_xsiam") or 2)
+    else:
+        fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+        look_back = int(params.get("look_back") or 2)
path: Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
user: login: lironcohen272
body: I put it inside the condition because the parameter name in the yml is different for XSIAN and XSOAR.
_XSIAM:   look_back = int(params.get("look_back_**xsiam**") or 2)
XSOAR:  look_back = int(params.get("look_back") or 2)_
created_at: 2025-05-20T08:23:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2915,553 +2940,490 @@ def migrate_last_run(last_run: dict[str, str] | list[dict], is_fetch_events: boo
         ):
             updated_last_run_incidents["time"] = incident_time_date.strftime(DATE_FORMAT)
 
-        if is_fetch_events:
-            return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}, {}]
-        return [updated_last_run_detections, updated_last_run_incidents, {}, {}, {}]
+        last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+        result = [updated_last_run_detections, updated_last_run_incidents]
+        result.extend([{} for _ in range(last_run_length - 2)])
+        return result
 
 
-def fetch_incidents():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    iom_incidents: list[dict[str, Any]] = []
-    ioa_incidents: list[dict[str, Any]] = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    iom_last_run: dict = {} if len(last_run) < 4 else last_run[3]
-    ioa_last_run: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 6 else last_run[5]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 7 else last_run[6]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 8 else last_run[7]
-    params = demisto.params()
+def fetch_endpoint_detections(current_fetch_info_detections, look_back, is_fetch_events):
+    """
+    Fetch detections from CrowdStrike Falcon api.
 
-    fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+    Args:
+        current_fetch_info_detections (dict): The last_run for detection fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for detection
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    look_back = int(params.get("look_back") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+    Returns:
+        tuple: A tuple containing a list of detections and the updated fetch information dictionary.
+    """
+    detections = []
+    fetch_limit = MAX_FETCH_DETECTION_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    detections_offset: int = current_fetch_info_detections.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or INCIDENTS_PER_FETCH
+    fetch_limit = current_fetch_info_detections.get("limit") or fetch_limit
+    incident_type = "detection"
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    fetch_query = demisto.params().get("fetch_query")
+    if fetch_query:
+        fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
+        response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
+    else:
+        response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection)
-                detections.append(incident)
+    detections_ids: list[dict] = demisto.get(response, "resources", [])
+    total_detections = demisto.get(response, "meta.pagination.total")
+    detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
+    if detections_offset:
+        if detections_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            detections_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
+    raw_res = get_detections_entities(detections_ids)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+    if raw_res is not None and "resources" in raw_res:
+        full_detections = demisto.get(raw_res, "resources")
+        for detection in full_detections:
+            detection["incident_type"] = incident_type
+            # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
+            detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: Detection {detection_id} "
+                f"was fetched which was created in {detection['created_timestamp']}"
+            )
+            incident = detection_to_incident(detection, is_fetch_events=is_fetch_events)
+            detections.append(incident)
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    detections = filter_incidents_by_duplicates_and_limit(
+        incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
+    )
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    for detection in detections:
+        occurred = dateparser.parse(detection["occurred"])
+        if occurred:
+            detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or INCIDENTS_PER_FETCH
-        incident_type = "incident"
+    current_fetch_info_detections = update_last_run_object(
+        last_run=current_fetch_info_detections,
+        incidents=detections,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DETECTION_DATE_FORMAT,
+        new_offset=detections_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
 
-        fetch_query = params.get("incidents_fetch_query")
+    return detections, current_fetch_info_detections
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+def fetch_endpoint_incidents(current_fetch_info_incidents, look_back, is_fetch_events):
+    """
+    Fetch incidents from CrowdStrike Falcon api.
 
-    if IDP_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        idp_detections, current_fetch_info_idp_detections = fetch_detections_by_product_type(
-            current_fetch_info_idp_detections,
-            look_back=look_back,
-            fetch_query=params.get("idp_detections_fetch_query", ""),
-            detections_type=IDP_DETECTION,
-            product_type="idp",
-            detection_name_prefix=IDP_DETECTION_FETCH_TYPE,
-            start_time_key="created_timestamp",
-        )
+    Args:
+        current_fetch_info_incidents (dict): The last_run of incident fetch type, Contains information about the last fetch run
+        look_back (int): Number of days to look back for incidents
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if MOBILE_DETECTION_FETCH_TYPE in fetch_incidents_or_detections:
-        mobile_detections, current_fetch_info_mobile_detections = fetch_detections_by_product_type(
-            current_fetch_info_mobile_detections,
-            look_back=look_back,
-            fetch_query=params.get("mobile_detections_fetch_query", ""),
-            detections_type=MOBILE_DETECTION,
-            product_type="mobile",
-            detection_name_prefix=MOBILE_DETECTION_FETCH_TYPE,
-            start_time_key="timestamp",
-        )
+    Returns:
+        tuple: A tuple containing a list of incidents and the updated fetch information dictionary.
+    """
+    incidents = []
+    fetch_limit = MAX_FETCH_INCIDENT_PER_API_CALL if is_fetch_events else INCIDENTS_PER_FETCH
 
-    if "Indicator of Misconfiguration" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Misconfiguration incidents")
-        demisto.debug(f"{iom_last_run=}")
-        fetch_query = params.get("iom_fetch_query", "")
-        validate_iom_fetch_query(iom_fetch_query=fetch_query)
-
-        last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
-            last_run_object=iom_last_run,
-            date_format=IOM_DATE_FORMAT,
-            last_date_key="last_scan_time",
-            next_token_key="iom_next_token",
-            last_fetched_ids_key="last_resource_ids",
-        )
-        filter = create_iom_filter(
-            is_paginating=bool(iom_next_token),
-            last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
-            last_scan_time=last_scan_time,
-            first_fetch_timestamp=first_fetch_timestamp,
-            configured_fetch_query=fetch_query,
-        )
-        demisto.debug(f"IOM {filter=}")
-        iom_resource_ids, iom_new_next_token = iom_ids_pagination(
-            filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
-        )
-        demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
-        iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
-            fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
-            last_date=last_scan_time,
-            last_fetched_ids=last_resource_ids,
-            date_key="scan_time",
-            id_key="id",
-            date_format=IOM_DATE_FORMAT,
-            is_paginating=bool(iom_new_next_token or iom_next_token),
-            to_incident_context=iom_resource_to_incident,
-            incident_type="iom_configurations",
-        )
+    incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
+    start_fetch_time, end_fetch_time = get_fetch_run_time_range(
+        last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
+    )
 
-        iom_last_run = {
-            "iom_next_token": iom_new_next_token,
-            "last_scan_time": new_scan_time,
-            "last_fetch_filter": filter,
-            "last_resource_ids": fetched_resource_ids or last_resource_ids,
-        }
+    fetch_limit = current_fetch_info_incidents.get("limit") or fetch_limit
+    incident_type = "incident"
 
-    if "Indicator of Attack" in fetch_incidents_or_detections:
-        demisto.debug("Fetching Indicator of Attack incidents")
-        demisto.debug(f"{ioa_last_run=}")
-        fetch_query = params.get("ioa_fetch_query", "")
-        validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
-
-        last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
-            last_run_object=ioa_last_run,
-            date_format=DATE_FORMAT,
-            last_date_key="last_date_time_since",
-            next_token_key="ioa_next_token",
-            last_fetched_ids_key="last_event_ids",
-        )
-        ioa_fetch_query = create_ioa_query(
-            is_paginating=bool(ioa_next_token),
-            configured_fetch_query=fetch_query,
-            last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
-            last_date_time_since=last_date_time_since,
-        )
-        demisto.debug(f"IOA {ioa_fetch_query=}")
-        ioa_events, ioa_new_next_token = ioa_events_pagination(
-            ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
-        )
-        demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
-
-        ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
-            fetched_data=ioa_events,
-            last_date=last_date_time_since,
-            last_fetched_ids=last_fetch_event_ids,
-            date_key="event_created",
-            id_key="event_id",
-            date_format=DATE_FORMAT,
-            is_paginating=bool(ioa_new_next_token or ioa_next_token),
-            to_incident_context=ioa_event_to_incident,
-            incident_type="ioa_events",
-        )
+    fetch_query = demisto.params().get("incidents_fetch_query")
+    if fetch_query:
+        fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
+        response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
 
-        ioa_last_run = {
-            "ioa_next_token": ioa_new_next_token,
-            "last_date_time_since": new_date_time_since,
-            "last_fetch_query": ioa_fetch_query,
-            "last_event_ids": ioa_event_ids or last_fetch_event_ids,
-        }
+    else:
+        response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
+    incidents_ids: list[dict] = demisto.get(response, "resources", [])
+    total_incidents = demisto.get(response, "meta.pagination.total")
+    incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
+    if incidents_offset:
+        if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
+            demisto.debug(
+                f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
+                f"{MAX_FETCH_SIZE}, resetting the offset to 0"
+            )
+            incidents_offset = 0
+        demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
 
-    if ON_DEMAND_SCANS_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException("On-Demand Scans Detection is not supported in legacy version.")
-        demisto.debug("Fetching On-Demand Scans Detection incidents")
-        demisto.debug(f"on_demand_detections_last_run= {current_fetch_on_demand_detections}")
+    if incidents_ids:
+        raw_res = get_incidents_entities(incidents_ids)
+        if raw_res is not None and "resources" in raw_res:
+            full_incidents = demisto.get(raw_res, "resources")
+            for incident in full_incidents:
+                incident["incident_type"] = incident_type
+                incident_to_context = incident_to_incident_context(incident, is_fetch_events=is_fetch_events)
+                incidents.append(incident_to_context)
+
+    incidents = filter_incidents_by_duplicates_and_limit(
+        incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
+    )
+    for incident in incidents:
+        occurred = dateparser.parse(incident["occurred"])
+        if occurred:
+            incident["occurred"] = occurred.strftime(DATE_FORMAT)
+            demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
+
+    current_fetch_info_incidents = update_last_run_object(
+        last_run=current_fetch_info_incidents,
+        incidents=incidents,
+        fetch_limit=fetch_limit,
+        start_fetch_time=start_fetch_time,
+        end_fetch_time=end_fetch_time,
+        look_back=look_back,
+        created_time_field="occurred",
+        id_field="name",
+        date_format=DATE_FORMAT,
+        new_offset=incidents_offset,
+    )
+    demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
 
-        on_demand_detections, current_fetch_on_demand_detections = fetch_detections_by_product_type(
-            current_fetch_on_demand_detections,
-            look_back=look_back,
-            fetch_query=params.get("on_demand_fetch_query", ""),
-            detections_type=ON_DEMAND_SCANS_DETECTION,
-            product_type="ods",
-            detection_name_prefix=ON_DEMAND_SCANS_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+    return incidents, current_fetch_info_incidents
 
-    if OFP_DETECTION_TYPE in fetch_incidents_or_detections:
-        if LEGACY_VERSION:
-            raise DemistoException(f"{OFP_DETECTION_TYPE} is not supported in legacy version.")
-        demisto.debug(f"Fetching {OFP_DETECTION_TYPE} incidents")
-        demisto.debug(f"ofp_detection_last_run= {current_fetch_ofp_detection}")
 
-        ofp_detections, current_fetch_ofp_detection = fetch_detections_by_product_type(
-            current_fetch_ofp_detection,
-            look_back=look_back,
-            fetch_query=params.get("ofp_detection_fetch_query", ""),
-            detections_type=OFP_DETECTION,
-            product_type="ofp",
-            detection_name_prefix=OFP_DETECTION_TYPE,
-            start_time_key="created_timestamp",
-        )
+def fetch_iom_incidents(iom_last_run):
+    demisto.debug("Fetching Indicator of Misconfiguration incidents")
+    demisto.debug(f"{iom_last_run=}")
+    fetch_query = demisto.params().get("iom_fetch_query", "")
+    validate_iom_fetch_query(iom_fetch_query=fetch_query)
 
-    demisto.setLastRun(
-        [
-            current_fetch_info_detections,
-            current_fetch_info_incidents,
-            current_fetch_info_idp_detections,
-            iom_last_run,
-            ioa_last_run,
-            current_fetch_info_mobile_detections,
-            current_fetch_on_demand_detections,
-            current_fetch_ofp_detection,
-        ]
+    last_resource_ids, iom_next_token, last_scan_time, first_fetch_timestamp = get_current_fetch_data(
+        last_run_object=iom_last_run,
+        date_format=IOM_DATE_FORMAT,
+        last_date_key="last_scan_time",
+        next_token_key="iom_next_token",
+        last_fetched_ids_key="last_resource_ids",
     )
-    return (
-        incidents
-        + detections
-        + idp_detections
-        + iom_incidents
-        + ioa_incidents
-        + mobile_detections
-        + on_demand_detections
-        + ofp_detections
+    filter = create_iom_filter(
+        is_paginating=bool(iom_next_token),
+        last_fetch_filter=iom_last_run.get("last_fetch_filter", ""),
+        last_scan_time=last_scan_time,
+        first_fetch_timestamp=first_fetch_timestamp,
+        configured_fetch_query=fetch_query,
+    )
+    demisto.debug(f"IOM {filter=}")
+    iom_resource_ids, iom_new_next_token = iom_ids_pagination(
+        filter=filter, iom_next_token=iom_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=500
+    )
+    demisto.debug(f'Fetched the following IOM resource IDS: {", ".join(iom_resource_ids)}')
+    iom_incidents, fetched_resource_ids, new_scan_time = parse_ioa_iom_incidents(
+        fetched_data=get_iom_resources(iom_resource_ids=iom_resource_ids),
+        last_date=last_scan_time,
+        last_fetched_ids=last_resource_ids,
+        date_key="scan_time",
+        id_key="id",
+        date_format=IOM_DATE_FORMAT,
+        is_paginating=bool(iom_new_next_token or iom_next_token),
+        to_incident_context=iom_resource_to_incident,
+        incident_type="iom_configurations",
     )
 
+    iom_last_run = {
+        "iom_next_token": iom_new_next_token,
+        "last_scan_time": new_scan_time,
+        "last_fetch_filter": filter,
+        "last_resource_ids": fetched_resource_ids or last_resource_ids,
+    }
 
-def fetch_events():
-    incidents: list = []
-    detections: list = []
-    idp_detections: list = []
-    mobile_detections: list[dict[str, Any]] = []
-    on_demand_detections: list[dict[str, Any]] = []
-    ofp_detections: list[dict[str, Any]] = []
-    last_run = demisto.getLastRun()
-    demisto.debug(f"CrowdStrikeFalconMsg: Current last run object is {last_run}")
-    if not last_run:
-        last_run = [{}, {}, {}, {}, {}, {}]
-    last_run = migrate_last_run(last_run, is_fetch_events=True)
-    current_fetch_info_detections: dict = last_run[0]
-    current_fetch_info_incidents: dict = last_run[1]
-    current_fetch_info_idp_detections: dict = {} if len(last_run) < 3 else last_run[2]
-    current_fetch_info_mobile_detections: dict = {} if len(last_run) < 4 else last_run[3]
-    current_fetch_on_demand_detections: dict = {} if len(last_run) < 5 else last_run[4]
-    current_fetch_ofp_detection: dict = {} if len(last_run) < 6 else last_run[5]
-    params = demisto.params()
+    return iom_incidents, iom_last_run
 
-    fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
 
-    look_back = int(params.get("look_back_xsiam") or 2)
-    fetch_limit = INCIDENTS_PER_FETCH
+def fetch_ioa_incidents(ioa_last_run):
+    demisto.debug("Fetching Indicator of Attack incidents")
+    demisto.debug(f"{ioa_last_run=}")
+    fetch_query = demisto.params().get("ioa_fetch_query", "")
+    validate_ioa_fetch_query(ioa_fetch_query=fetch_query)
 
-    demisto.debug(f"CrowdstrikeFalconMsg: Starting fetch incidents with {fetch_incidents_or_detections}")
-    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
-        detections_offset: int = current_fetch_info_detections.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_detections, first_fetch=FETCH_TIME, look_back=look_back, date_format=DETECTION_DATE_FORMAT
-        )
+    last_fetch_event_ids, ioa_next_token, last_date_time_since, _ = get_current_fetch_data(
+        last_run_object=ioa_last_run,
+        date_format=DATE_FORMAT,
+        last_date_key="last_date_time_since",
+        next_token_key="ioa_next_token",
+        last_fetched_ids_key="last_event_ids",
+    )
+    ioa_fetch_query = create_ioa_query(
+        is_paginating=bool(ioa_next_token),
+        configured_fetch_query=fetch_query,
+        last_fetch_query=ioa_last_run.get("last_fetch_query", ""),
+        last_date_time_since=last_date_time_since,
+    )
+    demisto.debug(f"IOA {ioa_fetch_query=}")
+    ioa_events, ioa_new_next_token = ioa_events_pagination(
+        ioa_fetch_query=ioa_fetch_query, ioa_next_token=ioa_next_token, fetch_limit=INCIDENTS_PER_FETCH, api_limit=1000
+    )
+    demisto.debug(f'Fetched the following IOA event IDs: {[event.get("event_id") for event in ioa_events]}')
+
+    ioa_incidents, ioa_event_ids, new_date_time_since = parse_ioa_iom_incidents(
+        fetched_data=ioa_events,
+        last_date=last_date_time_since,
+        last_fetched_ids=last_fetch_event_ids,
+        date_key="event_created",
+        id_key="event_id",
+        date_format=DATE_FORMAT,
+        is_paginating=bool(ioa_new_next_token or ioa_next_token),
+        to_incident_context=ioa_event_to_incident,
+        incident_type="ioa_events",
+    )
 
-        fetch_limit = current_fetch_info_detections.get("limit") or MAX_FETCH_DETECTION_PER_API_CALL
+    ioa_last_run = {
+        "ioa_next_token": ioa_new_next_token,
+        "last_date_time_since": new_date_time_since,
+        "last_fetch_query": ioa_fetch_query,
+        "last_event_ids": ioa_event_ids or last_fetch_event_ids,
+    }
 
-        incident_type = "detection"
-        fetch_query = params.get("fetch_query")
-        if fetch_query:
-            fetch_query = f"created_timestamp:>'{start_fetch_time}'+{fetch_query}"
-            response = get_fetch_detections(filter_arg=fetch_query, limit=fetch_limit, offset=detections_offset)
-        else:
-            response = get_fetch_detections(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=detections_offset)
-        detections_ids: list[dict] = demisto.get(response, "resources", [])
-        total_detections = demisto.get(response, "meta.pagination.total")
-        detections_offset = calculate_new_offset(detections_offset, len(detections_ids), total_detections)
-        if detections_offset:
-            if detections_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {detections_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                detections_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new detections offset is {detections_offset}")
-        raw_res = get_detections_entities(detections_ids)
+    return ioa_incidents, ioa_last_run
 
-        if raw_res is not None and "resources" in raw_res:
-            full_detections = demisto.get(raw_res, "resources")
-            for detection in full_detections:
-                detection["incident_type"] = incident_type
-                # detection_id is for the old version of the API, composite_id is for the new version (Raptor)
-                detection_id = detection.get("detection_id") if LEGACY_VERSION else detection.get("composite_id")
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: Detection {detection_id} "
-                    f"was fetched which was created in {detection['created_timestamp']}"
-                )
-                incident = detection_to_incident(detection, is_fetch_events=True)
-                detections.append(incident)
 
-        detections = filter_incidents_by_duplicates_and_limit(
-            incidents_res=detections, last_run=current_fetch_info_detections, fetch_limit=fetch_limit, id_field="name"
-        )
+def set_last_run_per_type(last_run: list, index: LastRunIndex, data: dict, is_fetch_events=False) -> None:
+    """
+    Safely set the specific sub last_run dictionary in the main last_run list.
 
-        for detection in detections:
-            occurred = dateparser.parse(detection["occurred"])
-            if occurred:
-                detection["occurred"] = occurred.strftime(DETECTION_DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Detection {detection['name']} occurred at {detection['occurred']}")
-        current_fetch_info_detections = update_last_run_object(
-            last_run=current_fetch_info_detections,
-            incidents=detections,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DETECTION_DATE_FORMAT,
-            new_offset=detections_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch endpoint_detections. Fetched {len(detections) if detections else 0}")
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        data: The data to set for the specified fetch type
+        is_fetch_events: Flag to determine whether it's for fetch-events command (XSIAM) or fetch-incidents command (XSOAR).
 
-    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
-        incidents_offset: int = current_fetch_info_incidents.get("offset") or 0
-        start_fetch_time, end_fetch_time = get_fetch_run_time_range(
-            last_run=current_fetch_info_incidents, first_fetch=FETCH_TIME, look_back=look_back, date_format=DATE_FORMAT
-        )
+    Returns:
+        The updated last_run list.
+    """
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type1")
+    if not isinstance(data, dict):
+        demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type2")
+        return_error(f"Invalid data type : last_run is a list of dictionary, expected dictionary, got {type(data).__name__}")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type3")
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type4")
+    if index >= last_run_length:
+        return_error(f"Invalid last_run index {index}, cannot exceed {last_run_length - 1}")
+    if index < 0:
+        return_error(f"Invalid last_run index {index}, index cannot be negative")
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type5")
+    # Extend the list if necessary to accommodate the fetch_type index
+    while len(last_run) <= index:
+        last_run.append({})
+    demisto.debug("CrowdStrikeFalconMsg: set_last_run_per_type6")
+    last_run[index] = data
+    demisto.debug(f"CrowdStrikeFalconMsg: set_last_run_per_type7 {last_run}")
+
+
+def get_last_run_per_type(last_run: list, fetch_type: LastRunIndex) -> dict:
+    """
+    Safely get the specific sub last_run dictionary from the main last_run list.
 
-        fetch_limit = current_fetch_info_incidents.get("limit") or MAX_FETCH_INCIDENT_PER_API_CALL
-        incident_type = "incident"
+    Args:
+        last_run: The last_run list of dictionaries, where each index represents a last_run object for different fetch type.
+        fetch_type: The fetch type index enum
+        default: Default value if not present (defaults to empty dict)
 
-        fetch_query = params.get("incidents_fetch_query")
+    Returns:
+        The last_run dict from the list for the requested type.
+    """
 
-        if fetch_query:
-            fetch_query = f"start:>'{start_fetch_time}'+{fetch_query}"
-            response = get_incidents_ids(filter_arg=fetch_query, limit=fetch_limit, offset=incidents_offset)
+    if len(last_run) <= fetch_type:
+        return {}
 
-        else:
-            response = get_incidents_ids(last_created_timestamp=start_fetch_time, limit=fetch_limit, offset=incidents_offset)
-        incidents_ids: list[dict] = demisto.get(response, "resources", [])
-        total_incidents = demisto.get(response, "meta.pagination.total")
-        incidents_offset = calculate_new_offset(incidents_offset, len(incidents_ids), total_incidents)
-        if incidents_offset:
-            if incidents_offset + fetch_limit > MAX_FETCH_SIZE:
-                demisto.debug(
-                    f"CrowdStrikeFalconMsg: The new offset: {incidents_offset} + limit: {fetch_limit} reached "
-                    f"{MAX_FETCH_SIZE}, resetting the offset to 0"
-                )
-                incidents_offset = 0
-            demisto.debug(f"CrowdStrikeFalconMsg: The new incidents offset is {incidents_offset}")
-
-        if incidents_ids:
-            raw_res = get_incidents_entities(incidents_ids)
-            if raw_res is not None and "resources" in raw_res:
-                full_incidents = demisto.get(raw_res, "resources")
-                for incident in full_incidents:
-                    incident["incident_type"] = incident_type
-                    incident_to_context = incident_to_incident_context(incident, is_fetch_events=True)
-                    incidents.append(incident_to_context)
-
-        incidents = filter_incidents_by_duplicates_and_limit(
-            incidents_res=incidents, last_run=current_fetch_info_incidents, fetch_limit=fetch_limit, id_field="name"
-        )
-        for incident in incidents:
-            occurred = dateparser.parse(incident["occurred"])
-            if occurred:
-                incident["occurred"] = occurred.strftime(DATE_FORMAT)
-                demisto.debug(f"CrowdStrikeFalconMsg: Incident {incident['name']} occurred at {incident['occurred']}")
-
-        current_fetch_info_incidents = update_last_run_object(
-            last_run=current_fetch_info_incidents,
-            incidents=incidents,
-            fetch_limit=fetch_limit,
-            start_fetch_time=start_fetch_time,
-            end_fetch_time=end_fetch_time,
-            look_back=look_back,
-            created_time_field="occurred",
-            id_field="name",
-            date_format=DATE_FORMAT,
-            new_offset=incidents_offset,
-        )
-        demisto.debug(f"CrowdstrikeFalconMsg: Ending fetch Incidents. Fetched {len(incidents)}")
+    return last_run[fetch_type]
+
+
+def fetch_items(command="fetch-incidents"):
+    """
+    Fetch incidents or events from CrowdStrike Falcon based on configuration.
+
+    Args:
+        command (str): Either 'fetch-incidents' or 'fetch-events'
+
+    Returns:
+        tuple: (last_run, items) where last_run is the updated state and items are the fetched incidents/events
+    """
+
+    is_fetch_events = command == "fetch-events"
+    items = []
+    params = demisto.params()
+
+    # Initialize and migrate last_run
+    last_run = demisto.getLastRun()
+    last_run_length = TOTAL_FETCH_TYPE_XSIAM if is_fetch_events else TOTAL_FETCH_TYPE_XSOAR
+    if not last_run:
+        last_run = [{} for _ in range(last_run_length)]
+    last_run = migrate_last_run(last_run, is_fetch_events)
+
+    # last_run objects - common for fetch_incident and fetch_events
+    detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.DETECTIONS)
+    incidents_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.INCIDENTS)
+    idp_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.IDP_DETECTIONS)
+    mobile_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.MOBILE_DETECTIONS)
+    on_demand_detections_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.ON_DEMAND_DETECTIONS)
+    ofp_detection_last_run: dict = get_last_run_per_type(last_run, LastRunIndex.OFP_DETECTION)
+
+    # last_run objects - fetch types only for fetch-incidents
+    iom_last_run: dict[str, Any] = {}
+    ioa_last_run: dict[str, Any] = {}
+
+    if is_fetch_events:
+        fetch_incidents_or_detections = params.get("fetch_events_or_detections", "")
+        look_back = int(params.get("look_back_xsiam") or 2)
+    else:
+        fetch_incidents_or_detections = params.get("fetch_incidents_or_detections", "")
+        look_back = int(params.get("look_back") or 2)
 
+        # last_run object - Only for fetch_incident
+        iom_last_run = get_last_run_per_type(last_run, LastRunIndex.IOM)
+        ioa_last_run = get_last_run_per_type(last_run, LastRunIndex.IOA)
+
+    demisto.debug(f"CrowdstrikeFalconMsg: Selected fetch types: {fetch_incidents_or_detections}")
+
+    # Fetch Endpoint Detections
+    if "Detections" in fetch_incidents_or_detections or "Endpoint Detection" in fetch_incidents_or_detections:
+        demisto.debug("CrowdStrikeFalconMsg: Start fetch Detections")
+        demisto.debug(f"CrowdStrikeFalconMsg: Current detections_last_run object: {detections_last_run}")
+
+        fetched_detections, detections_last_run = fetch_endpoint_detections(detections_last_run, look_back, is_fetch_events)
+        items.extend(fetched_detections)
+
+    # Fetch Endpoint Incidents
+    if "Incidents" in fetch_incidents_or_detections or "Endpoint Incident" in fetch_incidents_or_detections:
path: Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
user: login: lironcohen272
body: I wrote some additional notes for myself about changes to implement, such as renaming variables and adding constants, etc.
I will make this specific change now, and come back to update the rest later.
created_at: 2025-05-20T08:26:32Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-05-19T13:31:15Z
body: <!-- Pytest Coverage Comment: pre-commit -->
<a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/README.md"><img alt="Coverage" src="https://img.shields.io/badge/Coverage-80%25-green.svg" /></a><details><summary>Coverage Report </summary><table><tr><th>File</th><th>Stmts</th><th>Miss</th><th>Cover</th><th>Missing</th></tr><tbody><tr><td colspan="5"><b>Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon</b></td></tr><tr><td>&nbsp; &nbsp;<a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py">CrowdStrikeFalcon.py</a></td><td>2918</td><td>577</td><td>80%</td><td><a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L416-L417">416&ndash;417</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L555">555</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L580">580</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L620">620</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L631">631</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L671-L672">671&ndash;672</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L674-L675">674&ndash;675</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L693">693</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L805-L808">805&ndash;808</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L832-L833">832&ndash;833</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L835-L837">835&ndash;837</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L840-L841">840&ndash;841</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L866-L867">866&ndash;867</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L869-L871">869&ndash;871</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L874-L875">874&ndash;875</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L920-L922">920&ndash;922</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L925-L926">925&ndash;926</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L928-L930">928&ndash;930</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L933-L934">933&ndash;934</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L949">949</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L952">952</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L980-L989">980&ndash;989</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1010">1010</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1084">1084</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1117-L1118">1117&ndash;1118</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1120-L1123">1120&ndash;1123</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1160">1160</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1185">1185</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1249-L1250">1249&ndash;1250</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1252-L1255">1252&ndash;1255</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1269-L1274">1269&ndash;1274</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1288-L1289">1288&ndash;1289</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1291-L1294">1291&ndash;1294</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1319">1319</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1321">1321</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1323-L1324">1323&ndash;1324</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1334">1334</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1336">1336</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1338-L1339">1338&ndash;1339</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1434">1434</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1539">1539</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1543">1543</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1571">1571</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1573">1573</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1593-L1596">1593&ndash;1596</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1637">1637</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1689">1689</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1693">1693</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1783">1783</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1793-L1794">1793&ndash;1794</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1796-L1797">1796&ndash;1797</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1800">1800</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1802">1802</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1804-L1805">1804&ndash;1805</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1839">1839</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1848">1848</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1850">1850</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1890">1890</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1892">1892</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1918-L1919">1918&ndash;1919</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1951">1951</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L1953">1953</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2082">2082</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2088">2088</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2099-L2102">2099&ndash;2102</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2111-L2115">2111&ndash;2115</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2166-L2169">2166&ndash;2169</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2178-L2181">2178&ndash;2181</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2197">2197</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2233">2233</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2237-L2241">2237&ndash;2241</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2244">2244</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2281-L2282">2281&ndash;2282</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2285">2285</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2289-L2291">2289&ndash;2291</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2295-L2297">2295&ndash;2297</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2310">2310</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2483-L2487">2483&ndash;2487</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2493">2493</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2496">2496</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2499-L2500">2499&ndash;2500</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2505-L2507">2505&ndash;2507</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2509">2509</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2518">2518</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2520">2520</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2600-L2602">2600&ndash;2602</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2604-L2606">2604&ndash;2606</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2718">2718</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2723">2723</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2727">2727</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2731">2731</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2771-L2774">2771&ndash;2774</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2777">2777</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2780">2780</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2782-L2783">2782&ndash;2783</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2828-L2830">2828&ndash;2830</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2833-L2835">2833&ndash;2835</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2837">2837</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2858">2858</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2987-L2988">2987&ndash;2988</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L2997">2997</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3001">3001</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3070-L3071">3070&ndash;3071</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3080">3080</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3084">3084</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3231-L3232">3231&ndash;3232</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3237">3237</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3239">3239</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3243">3243</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3263">3263</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3287">3287</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3352-L3353">3352&ndash;3353</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3355">3355</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3365">3365</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3385-L3386">3385&ndash;3386</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3388-L3390">3388&ndash;3390</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3400">3400</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3404-L3405">3404&ndash;3405</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3407-L3409">3407&ndash;3409</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3419">3419</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3480">3480</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3483">3483</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3491">3491</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3495">3495</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3686-L3687">3686&ndash;3687</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3887">3887</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L3987-L3989">3987&ndash;3989</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4032-L4037">4032&ndash;4037</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4111-L4114">4111&ndash;4114</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4187">4187</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4194">4194</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4232">4232</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4335">4335</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4370">4370</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4389">4389</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4403">4403</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4417-L4420">4417&ndash;4420</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4435-L4439">4435&ndash;4439</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4441-L4442">4441&ndash;4442</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4444-L4445">4444&ndash;4445</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4457-L4460">4457&ndash;4460</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4483">4483</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4528">4528</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4534">4534</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4565-L4573">4565&ndash;4573</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4575-L4576">4575&ndash;4576</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4584-L4597">4584&ndash;4597</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4599-L4600">4599&ndash;4600</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4602-L4604">4602&ndash;4604</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4606-L4608">4606&ndash;4608</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4610-L4613">4610&ndash;4613</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4615">4615</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4617">4617</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4619">4619</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4629-L4637">4629&ndash;4637</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4639-L4652">4639&ndash;4652</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4660-L4663">4660&ndash;4663</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4671-L4674">4671&ndash;4674</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4710-L4713">4710&ndash;4713</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4730-L4735">4730&ndash;4735</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4737-L4738">4737&ndash;4738</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4740-L4747">4740&ndash;4747</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4759-L4761">4759&ndash;4761</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4964-L4966">4964&ndash;4966</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4974">4974</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L4996-L4999">4996&ndash;4999</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5013">5013</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5040-L5043">5040&ndash;5043</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5064">5064</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5094-L5097">5094&ndash;5097</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5121-L5122">5121&ndash;5122</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5132">5132</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5145-L5146">5145&ndash;5146</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5148">5148</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5157-L5160">5157&ndash;5160</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5201-L5202">5201&ndash;5202</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5220-L5223">5220&ndash;5223</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5270-L5273">5270&ndash;5273</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5306">5306</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5311-L5312">5311&ndash;5312</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5354">5354</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5356-L5357">5356&ndash;5357</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5402-L5403">5402&ndash;5403</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5409">5409</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5427-L5428">5427&ndash;5428</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5443-L5444">5443&ndash;5444</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5463">5463</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5476-L5478">5476&ndash;5478</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5488-L5490">5488&ndash;5490</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5509">5509</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5515">5515</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5552-L5554">5552&ndash;5554</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5564-L5566">5564&ndash;5566</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5571">5571</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5600-L5609">5600&ndash;5609</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5646">5646</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5724-L5727">5724&ndash;5727</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5731-L5732">5731&ndash;5732</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5736-L5739">5736&ndash;5739</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5743-L5744">5743&ndash;5744</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5759-L5761">5759&ndash;5761</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5763-L5764">5763&ndash;5764</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5766-L5768">5766&ndash;5768</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5779">5779</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5793-L5797">5793&ndash;5797</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5861-L5863">5861&ndash;5863</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5865">5865</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5868">5868</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5870">5870</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5873">5873</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5875-L5877">5875&ndash;5877</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5879">5879</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5881-L5882">5881&ndash;5882</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5886-L5890">5886&ndash;5890</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5893">5893</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5896-L5897">5896&ndash;5897</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5901-L5902">5901&ndash;5902</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5904-L5909">5904&ndash;5909</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L5988">5988</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6115">6115</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6448">6448</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6488">6488</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6501">6501</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6579">6579</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6581">6581</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6590">6590</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6596">6596</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6657">6657</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6663">6663</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6667">6667</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6669">6669</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6681">6681</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6687">6687</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6692">6692</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6694-L6695">6694&ndash;6695</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6697-L6699">6697&ndash;6699</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6701">6701</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6709">6709</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6725">6725</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6734">6734</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6740">6740</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6757">6757</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6763">6763</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6767">6767</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6769-L6770">6769&ndash;6770</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6772-L6774">6772&ndash;6774</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6776">6776</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6784">6784</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6812">6812</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6818">6818</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6822">6822</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6824">6824</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6833">6833</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6839">6839</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6844">6844</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6846-L6847">6846&ndash;6847</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6849-L6851">6849&ndash;6851</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6853">6853</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6861">6861</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6911">6911</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6913-L6914">6913&ndash;6914</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6916-L6917">6916&ndash;6917</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6919">6919</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6960-L6961">6960&ndash;6961</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6963-L6964">6963&ndash;6964</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6971">6971</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6973">6973</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L6978">6978</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7057">7057</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7096-L7097">7096&ndash;7097</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7103-L7104">7103&ndash;7104</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7108">7108</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7185">7185</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7247">7247</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7300">7300</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7432">7432</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7519-L7520">7519&ndash;7520</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7522">7522</a>, <a href="https://github.com/demisto/content/blob/fa55b77eaac936562da7b2fc8b83aa75fec25ff4/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py#L7524">7524</a></td></tr><tr><td><b>TOTAL</b></td><td><b>2918</b></td><td><b>577</b></td><td><b>80%</b></td><td>&nbsp;</td></tr></tbody></table></details>

| Tests | Skipped | Failures | Errors | Time |
| ----- | ------- | -------- | -------- | ------------------ |
| 356 | 0 :zzz: | 0 :x: | 0 :fire: | 6.909s :stopwatch: |

author_association: NONE
user: login: content-bot
created_at: 2025-05-20T08:25:37Z
body: Validate summary

Verdict: PR can be force merged from validate perspective? ✅
author_association: CONTRIBUTOR