crowdstrike.falcon.ngsiem_data_connector_info module – Get information about available NG-SIEM data connectors

Note

This module is part of the crowdstrike.falcon collection (version 4.13.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install crowdstrike.falcon. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: crowdstrike.falcon.ngsiem_data_connector_info.

New in crowdstrike.falcon 4.13.0

Synopsis

• Returns the catalog of available NG-SIEM data connectors.

• Connectors are the templates that data connections are built from. Use this module to discover valid connector_id and parser values for crowdstrike.falcon.ngsiem_data_connection.

• Some of the details returned include connector name, description, supported parsers, vendor, type, and subscription.

Requirements

The below requirements are needed on the host that executes this module.

• CrowdStrike FalconPy >= 1.5.0

• NGSIEM Data Connections [READ] API scope

• crowdstrike-falconpy >= 1.5.0

• python >= 3.8

Parameters

Parameter	Comments
auth dictionary	The registered result of the crowdstrike.falcon.auth module, or a dictionary containing the access_token and cloud keys. If provided, the client_id, client_secret, member_cid, and cloud options are ignored. Useful when needing to make multiple API calls to avoid rate limiting issues.
access_token string	The OAuth2 access token to use for authentication.
cloud string	The CrowdStrike cloud region to use. This can differ from the module’s cloud argument due to autodiscovery.
client_id aliases: falcon_client_id string	The CrowdStrike API client ID to use. See the Falcon documentation for more information about API clients. The FALCON_CLIENT_ID environment variable can also be used.
client_secret aliases: falcon_client_secret string	The CrowdStrike API secret that corresponds to the client ID. See the Falcon documentation for more information about API clients. The FALCON_CLIENT_SECRET environment variable can also be used.
cloud string	The CrowdStrike cloud region to use. All clouds are automatically discovered if not specified, except for the us-gov-1 cloud. The FALCON_CLOUD environment variable can also be used. Choices: "us-1" ← (default) "us-2" "us-gov-1" "eu-1"
ext_headers dictionary	Extended headers that are prepended to the default headers dictionary.
filter string	FQL (Falcon Query Language) filter expression to limit results. Supported fields: name, vendor_name, type, subscription. type accepts: PUSH, PULL. Examples: name:'*S3*', vendor_name:'AWS', type:'PULL'.
limit integer	Maximum number of data connectors to return. Must be between 1 and 500. Default: 100
member_cid string	The CrowdStrike member CID for MSSP authentication. See the Falcon documentation for more information about API clients. The FALCON_MEMBER_CID environment variable can also be used.
offset integer	Starting index for pagination. Use with limit to paginate through large result sets. Default: 0
sort string	Property to sort results by.
user_agent string	Custom User-Agent string to use for requests to the API. The user agent string is prepended to the default user agent string (crowdstrike-ansible/<version>). See RFC 7231 for more information. The FALCON_USER_AGENT environment variable can also be used.

Examples

- name: Get all available data connectors
  crowdstrike.falcon.ngsiem_data_connector_info:

- name: Search connectors by name pattern
  crowdstrike.falcon.ngsiem_data_connector_info:
    filter: "name:'*S3*'"
    limit: 50

- name: Filter connectors by vendor
  crowdstrike.falcon.ngsiem_data_connector_info:
    filter: "vendor_name:'AWS'"

- name: Filter PULL connectors
  crowdstrike.falcon.ngsiem_data_connector_info:
    filter: "type:'PULL'"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
data_connectors list / elements=dictionary	A list of available data connectors that match the search criteria. Returned: success
description string	The description of the connector. Returned: success
id string	The unique identifier of the connector. Returned: success Sample: "a1bfd0c4380f436790cb41afc2b95f38"
name string	The name of the connector. Returned: success Sample: "HTTP Event Connector"
parsers list / elements=string	The parsers supported by the connector. Returned: success
subscription string	The subscription associated with the connector. Returned: success
type string	The connector type (PUSH or PULL). Returned: success Sample: "PUSH"
vendor_name string	The vendor name associated with the connector. Returned: success Sample: "Generic"
vendor_product_name string	The vendor product name associated with the connector. Returned: success
meta dictionary	Metadata about the query results. Returned: success
pagination dictionary	Pagination information. Returned: success
limit integer	The limit used for this query. Returned: success Sample: 100
offset integer	The starting index used for this query. Returned: success Sample: 0
total integer	Total number of data connectors matching the query. Returned: success Sample: 157
query_time float	Time taken to execute the query in seconds. Returned: success Sample: 0.123

Authors

• Carlos Matos (@carlosmmatos)

Collection links

• Issue Tracker
• Repository (Sources)