crowdstrike.falcon.ngsiem_data_connection_info module – Get information about NG-SIEM data connections

Note

This module is part of the crowdstrike.falcon collection (version 4.13.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install crowdstrike.falcon. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: crowdstrike.falcon.ngsiem_data_connection_info.

New in crowdstrike.falcon 4.13.0

Synopsis

• Returns detailed information for one or more NG-SIEM data connections.

• Some of the details returned include connection name, vendor, parser, status, source type, and ingest URL.

• Can retrieve specific connections by ID or search for connections using FQL filters.

• Optionally enriches each result with its current provisioning status.

Requirements

The below requirements are needed on the host that executes this module.

• CrowdStrike FalconPy >= 1.5.0

• NGSIEM Data Connections [READ] API scope

• crowdstrike-falconpy >= 1.5.0

• python >= 3.8

Parameters

Parameter	Comments
auth dictionary	The registered result of the crowdstrike.falcon.auth module, or a dictionary containing the access_token and cloud keys. If provided, the client_id, client_secret, member_cid, and cloud options are ignored. Useful when needing to make multiple API calls to avoid rate limiting issues.
access_token string	The OAuth2 access token to use for authentication.
cloud string	The CrowdStrike cloud region to use. This can differ from the module’s cloud argument due to autodiscovery.
client_id aliases: falcon_client_id string	The CrowdStrike API client ID to use. See the Falcon documentation for more information about API clients. The FALCON_CLIENT_ID environment variable can also be used.
client_secret aliases: falcon_client_secret string	The CrowdStrike API secret that corresponds to the client ID. See the Falcon documentation for more information about API clients. The FALCON_CLIENT_SECRET environment variable can also be used.
cloud string	The CrowdStrike cloud region to use. All clouds are automatically discovered if not specified, except for the us-gov-1 cloud. The FALCON_CLOUD environment variable can also be used. Choices: "us-1" ← (default) "us-2" "us-gov-1" "eu-1"
connection_ids list / elements=string	A list of data connection IDs to get information about. If not provided, connections will be returned based on filter and pagination settings. Cannot be used together with filter.
ext_headers dictionary	Extended headers that are prepended to the default headers dictionary.
filter string	FQL (Falcon Query Language) filter expression to limit results. Supported fields: name, id, vendor_name, vendor_product_name, status, type. status accepts: Pending, Active, Disconnected, Error, Idle, Paused. type accepts: PUSH, PULL. Examples: name:'*edge*', status:'Active', type:'PUSH'. Cannot be used together with connection_ids.
include_status boolean	Whether to enrich each connection with its current provisioning status. When enabled, adds a provisioning_status field to each connection. This requires an additional API call per connection. Choices: false ← (default) true
limit integer	Maximum number of data connections to return. Must be between 1 and 500. Default: 100
member_cid string	The CrowdStrike member CID for MSSP authentication. See the Falcon documentation for more information about API clients. The FALCON_MEMBER_CID environment variable can also be used.
offset integer	Starting index for pagination. Use with limit to paginate through large result sets. Default: 0
sort string	Property to sort results by. Note: Only name.asc is supported by the API. Other sort values are rejected.
user_agent string	Custom User-Agent string to use for requests to the API. The user agent string is prepended to the default user agent string (crowdstrike-ansible/<version>). See RFC 7231 for more information. The FALCON_USER_AGENT environment variable can also be used.

Examples

- name: Get all data connections
  crowdstrike.falcon.ngsiem_data_connection_info:

- name: Get specific data connections by ID
  crowdstrike.falcon.ngsiem_data_connection_info:
    connection_ids:
      - "abcdef1234567890abcdef1234567890"
      - "1234567890abcdef1234567890abcdef"

- name: Search connections by name pattern
  crowdstrike.falcon.ngsiem_data_connection_info:
    filter: "name:'*edge*'"
    limit: 50

- name: Filter connections by status
  crowdstrike.falcon.ngsiem_data_connection_info:
    filter: "status:'Active'"
    sort: "name.asc"

- name: Filter PUSH connections and include provisioning status
  crowdstrike.falcon.ngsiem_data_connection_info:
    filter: "type:'PUSH'"
    include_status: true

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
data_connections list / elements=dictionary	A list of data connections that match the search criteria. Returned: success
id string	The unique identifier of the data connection. Returned: success Sample: "abcdef1234567890abcdef1234567890"
ingest_url string	The URL to push logs to (PUSH connections only, after provisioning). Returned: when available
last_ingested_volume_one_day integer	The volume ingested in the last day. Returned: success
name string	The name of the data connection. Returned: success Sample: "Edge browser logs"
parser_name string	The parser applied to the connection’s data. Returned: success Sample: "microsoft-edge"
provisioning_status dictionary	The current provisioning status (only when include_status=true). Returned: when include_status=true
source_type string	The source type of the connection. Returned: success
status string	The current status of the connection. Returned: success Sample: "Active"
vendor_name string	The vendor name associated with the connection. Returned: success Sample: "Microsoft"
vendor_product_name string	The vendor product name associated with the connection. Returned: success Sample: "Edge"
meta dictionary	Metadata about the query results. Returned: success
pagination dictionary	Pagination information. Returned: success
limit integer	The limit used for this query. Returned: success Sample: 100
offset integer	The starting index used for this query. Returned: success Sample: 0
total integer	Total number of data connections matching the query. Returned: success Sample: 42
query_time float	Time taken to execute the query in seconds. Returned: success Sample: 0.123

Authors

• Carlos Matos (@carlosmmatos)

Collection links

• Issue Tracker
• Repository (Sources)