crowdstrike-falcon-ngsiem-query

Runs a query on CrowdStrike Falcon NG SIEM and returns the resulting events.

Syntax

crowdstrike-falcon-ngsiem-query [profile=STRING] [repository=STRING] [duration=STRING] [from=DATETIME] [to=DATETIME] [ingested-start=DATETIME] [ingested-end=DATETIME] [NG SIEM QUERY]

Options

profile=STRING: Optional. Connect profile code of CrowdStrike Falcon
repository=STRING: Optional. Repository name. Available values: 'all', 'falcon', 'third party', 'it automation', 'forensics'. Default is 'all'
duration=STRING: Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=DATETIME: Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=DATETIME: Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ingested-start=DATETIME: Optional. Ingested start time. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ingested-end=DATETIME: Optional. Ingested end time. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output fields

Field	Type	Name	Description
profile	String	Connect profile	CrowdStrike Falcon connect profile code
event_id	String	Event ID	Original @id field
event_time	Date	Event time	Original @timestamp field
event_time_nanosec	Long	Event time nanoseconds	Original @timestamp.nanos field
ingested	Date	Ingested time	Original @ingesttimestamp field
event_category	String	Event category	Original #category field
event_repo	String	Repository	Original #repo field
event_repo_cid	String	Repository customer ID	Original #repo.cid field
event_simple_name	String	Event simple name	Original #event_simpleName field
event_type	String	Event type	Original #type field
raw_data	String	Raw data	Original @rawstring field
severity	String	Severity	Original #severity field
source	String	Source	Original @source field
source_type	String	Source type	Original @sourcetype field
timezone	String	Timezone	Original @timezone field
vendor	String	Vendor	Original #Vendor field