manifest.yml

title: Collect Alert logs from CrowdStrike.
type: logs
streams:
  - input: cel
    title: Falcon Alerts
    description: Collect Unified Alerts from CrowdStrike Falcon Intelligence.
    enabled: false
    template_path: cel.yml.hbs
    vars:
      - name: initial_interval
        type: text
        title: Initial Interval
        description: How far back to pull the Alert logs from CrowdStrike. Supported units for this parameter are h/m/s.
        multi: false
        required: true
        show_user: true
        default: 24h
      - name: interval
        type: text
        title: Interval
        description: Duration between requests to the CrowdStrike API. Supported units for this parameter are h/m/s.
        default: 5m
        multi: false
        required: true
        show_user: true
      - name: batch_size
        type: integer
        title: Batch Size
        description: Batch size for the response of the CrowdStrike API. It must be between 1 - 10000.
        default: 10000
        multi: false
        required: true
        show_user: false
      - name: http_client_timeout
        type: text
        title: HTTP Client Timeout
        description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.
        multi: false
        required: true
        show_user: false
        default: 30s
      - name: query
        type: text
        title: FQL Query
        description: This is an additional FQL query that may be included in requests to the API. You should not include any reference to the `timestamp` property. See the [FalconPy documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html) for details.
        multi: false
        required: false
        show_user: false
      - name: enable_request_tracer
        type: bool
        title: Enable request tracing
        multi: false
        required: false
        show_user: false
        description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.
      - name: tags
        type: text
        title: Tags
        multi: true
        required: true
        show_user: false
        default:
          - forwarded
          - crowdstrike-alert
      - name: preserve_original_event
        required: true
        show_user: true
        title: Preserve original event
        description: Preserves a raw copy of the original event, added to the field `event.original`.
        type: bool
        multi: false
        default: false
      - name: preserve_duplicate_custom_fields
        required: true
        show_user: false
        title: Preserve duplicate custom fields
        description: Preserve crowdstrike.alert fields that were copied to Elastic Common Schema (ECS) fields.
        type: bool
        multi: false
        default: false
      - name: processors
        type: yaml
        title: Processors
        multi: false
        required: false
        show_user: false
        description: >-
          Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.