Use case

The CrowdStrike connector currently uses a bad approach to model malware in reports. In fact, it parses the tags field to "guess" malware names through the "report_guess_malware" option. This method continuously queries the OpenCTI platform to check if each tag corresponds to a known malware. This approach is ineffective and may omit information.

The CrowdStrike API now appears to provide a dedicated field for “malware” in report modeling.
We should:

• Use the new "malware" field to model malware families mentioned in a report
• Completely remove the "report_guess_malware" option and all associated code. No need to deprecate it.