crowdstrike-falcon-scheduled-search
Reads the result content of a scheduled search execution by its id.
Syntax
crowdstrike-falcon-scheduled-search [profile=STRING] id=STRING
Options
- profile=STRING
- Optional. Connect profile code of CrowdStrike Falcon
- id=STRING
- Required. Scheduled search ID to retrieve data
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | CrowdStrike Falcon connect profile code |
| event_id | String | Event ID | Original @id field |
| event_time | Date | Event time | Original @timestamp field |
| event_time_nanosec | Long | Event time nanoseconds | Original @timestamp.nanos field |
| ingested | Date | Ingested time | Original @ingesttimestamp field |
| event_category | String | Event category | Original #category field |
| event_repo | String | Repository | Original #repo field |
| event_repo_cid | String | Repository customer ID | Original #repo.cid field |
| event_simple_name | String | Event simple name | Original #event_simpleName field |
| event_type | String | Event type | Original #type field |
| raw_data | String | Raw data | Original @rawstring field |
| severity | String | Severity | Original #severity field |
| source | String | Source | Original @source field |
| source_type | String | Source type | Original @sourcetype field |
| timezone | String | Timezone | Original @timezone field |
| vendor | String | Vendor | Original #Vendor field |
| execution_id | String | Execution ID | The execution id that was read |
| _line_number | Int | Line number | CSV format only. The line after the header is 2 |
| _error | String | Error | Why the result could not be read |