crowdstrike.falcon.ngsiem_parser_info module – Get information about NG-SIEM parsers

Note

This module is part of the crowdstrike.falcon collection (version 4.13.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install crowdstrike.falcon. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: crowdstrike.falcon.ngsiem_parser_info.

New in crowdstrike.falcon 4.13.0

Synopsis

• Returns detailed information for one or more NG-SIEM parsers in the CrowdStrike Falcon platform.

• Parsers transform raw log data into normalized events for Next-Gen SIEM. They come in two types - built-in ootb (out-of-the-box) parsers shipped by CrowdStrike, and custom parsers created in your tenant.

• By default the full parser definition (including the script, fields_to_tag, and test_cases) is returned for each parser. Set definitions=false to return only the lightweight list metadata.

• Use crowdstrike.falcon.ngsiem_parser to create, update, clone, or delete parsers.

Requirements

The below requirements are needed on the host that executes this module.

• CrowdStrike FalconPy >= 1.6.3

• NGSIEM Parsers [READ] API scope

• crowdstrike-falconpy >= 1.5.0

• python >= 3.8

Parameters

Parameter	Comments
auth dictionary	The registered result of the crowdstrike.falcon.auth module, or a dictionary containing the access_token and cloud keys. If provided, the client_id, client_secret, member_cid, and cloud options are ignored. Useful when needing to make multiple API calls to avoid rate limiting issues.
access_token string	The OAuth2 access token to use for authentication.
cloud string	The CrowdStrike cloud region to use. This can differ from the module’s cloud argument due to autodiscovery.
client_id aliases: falcon_client_id string	The CrowdStrike API client ID to use. See the Falcon documentation for more information about API clients. The FALCON_CLIENT_ID environment variable can also be used.
client_secret aliases: falcon_client_secret string	The CrowdStrike API secret that corresponds to the client ID. See the Falcon documentation for more information about API clients. The FALCON_CLIENT_SECRET environment variable can also be used.
cloud string	The CrowdStrike cloud region to use. All clouds are automatically discovered if not specified, except for the us-gov-1 cloud. The FALCON_CLOUD environment variable can also be used. Choices: "us-1" ← (default) "us-2" "us-gov-1" "eu-1"
definitions boolean	Whether to fetch the full definition for each parser. When true (default), an additional API call is made per parser to return its script, fields_to_tag, test_cases, and other definition fields. When false, only the lightweight list metadata is returned. Choices: false true ← (default)
ext_headers dictionary	Extended headers that are prepended to the default headers dictionary.
limit integer	Maximum number of parsers to return. Must be between 1 and 500. Default: 100
member_cid string	The CrowdStrike member CID for MSSP authentication. See the Falcon documentation for more information about API clients. The FALCON_MEMBER_CID environment variable can also be used.
name string	Substring to match against parser names. This maps to the only supported parser query filter (name:~'value'), which performs a case-insensitive substring match.
offset integer	Starting index for pagination. Use with limit to paginate through large result sets. Default: 0
parser_ids list / elements=string	A list of parser IDs to get information about. Parser IDs are version-suffixed (e.g. abc123:1.0.0). When provided, name, parser_type, and update_available filters are ignored.
parser_type string	Filter parsers by type. ootb returns only built-in (out-of-the-box) parsers. custom returns only custom parsers created in your tenant. Choices: "ootb" "custom"
repository string	The name of the repository to query. Default: "parsers-repository"
update_available boolean	Filter parsers by whether a newer version is available. Choices: false true
user_agent string	Custom User-Agent string to use for requests to the API. The user agent string is prepended to the default user agent string (crowdstrike-ansible/<version>). See RFC 7231 for more information. The FALCON_USER_AGENT environment variable can also be used.

Notes

Note

• Filtering: Only substring matching on name is supported by the API. General FQL expressions are not supported. Non-name filters (parser_type, update_available) are applied as dedicated query parameters.

Examples

- name: Get all parsers with full definitions
  crowdstrike.falcon.ngsiem_parser_info:

- name: Get only custom parsers
  crowdstrike.falcon.ngsiem_parser_info:
    parser_type: custom

- name: Get parsers whose name contains 'watchguard'
  crowdstrike.falcon.ngsiem_parser_info:
    name: watchguard

- name: Get specific parsers by ID
  crowdstrike.falcon.ngsiem_parser_info:
    parser_ids:
      - "10f55deaa2893f60b87af305f44f80bf:1.0.0"

- name: List parsers that have an update available (metadata only)
  crowdstrike.falcon.ngsiem_parser_info:
    update_available: true
    definitions: false

- name: Get custom parsers using metadata only for a quick inventory
  crowdstrike.falcon.ngsiem_parser_info:
    parser_type: custom
    definitions: false
    limit: 50

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
meta dictionary	Metadata about the query results. Returned: success
pagination dictionary	Pagination information. Returned: success
limit integer	The limit used for this query. Returned: success Sample: 100
offset integer	The starting index used for this query. Returned: success Sample: 0
total integer	Total number of parsers matching the query. Returned: success Sample: 42
query_time float	Time taken to execute the query in seconds. Returned: success Sample: 0.123
parsers list / elements=dictionary	A list of parsers that match the search criteria. When definitions=true (default), each entry includes the full parser definition merged with its list metadata. Returned: success
current_version string	The currently installed version of the parser. Returned: success Sample: "1.0.0"
description string	The description of the parser. Returned: when definitions=true
fields_to_tag list / elements=string	The list of fields to tag on parsed events. Returned: when definitions=true
id string	The version-suffixed unique identifier of the parser. Returned: success Sample: "10f55deaa2893f60b87af305f44f80bf:1.0.0"
is_built_in boolean	Whether the parser is a built-in (out-of-the-box) parser. Returned: when definitions=true
latest_version string	The latest available version of the parser. Returned: success Sample: "1.0.0"
name string	The name of the parser. Returned: success Sample: "redhat-insights"
parser_type string	The type of the parser (ootb or custom). Returned: success Sample: "custom"
script string	The LogScale/CQL parsing script. Returned: when definitions=true
test_cases list / elements=string	The list of test cases associated with the parser. Returned: when definitions=true
update_available boolean	Whether a newer version of the parser is available. Returned: success Sample: false

Authors

• Carlos Matos (@carlosmmatos)

Collection links

• Issue Tracker
• Repository (Sources)