it_automation_tasks

This data source provides information about IT Automation tasks in CrowdStrike Falcon.

API Scopes

The following API scopes are required:

• IT Automation - Tasks: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

# Get all IT Automation tasks
data "crowdstrike_it_automation_tasks" "all" {
  sort = "name|asc"
}

# Get tasks by ID
data "crowdstrike_it_automation_tasks" "specific" {
  ids = [
    "task-id-one",
    "task-id-two",
  ]
}

# Get tasks by name using the convenience attribute
data "crowdstrike_it_automation_tasks" "by_name" {
  name = "Collect System Info"
}

# Get all query tasks
data "crowdstrike_it_automation_tasks" "queries" {
  type = "query"
  sort = "modified_time|desc"
}

# Get all shared action tasks
data "crowdstrike_it_automation_tasks" "shared_actions" {
  type        = "action"
  access_type = "Shared"
}

# Get tasks using an FQL filter
data "crowdstrike_it_automation_tasks" "recent" {
  filter = "modified_time:>'2025-01-01'"
  sort   = "modified_time|desc"
}

# Filter tasks created by a specific user
data "crowdstrike_it_automation_tasks" "admin_tasks" {
  filter = "created_by:'admin@example.com'"
}

Schema

Optional

• access_type (String) Filter tasks by access type. One of: Public, Shared. Cannot be used together with filter or ids.
• filter (String) FQL filter to apply to the tasks query. Allowed filter fields: access_type, created_by, created_time, last_run_time, modified_by, modified_time, name, runs, task_type. The task_type field accepts query or remediation (note: the type attribute on this data source and the crowdstrike_it_automation_task resource exposes remediation as action). Cannot be used together with ids or individual filter attributes.
• ids (List of String) List of task IDs to retrieve. Cannot be used together with filter or individual filter attributes.
• name (String) Filter tasks by name. Supports FQL wildcard matching. Cannot be used together with filter or ids.
• sort (String) Sort expression for the results. Allowed sort fields: access_type, created_by, created_time, last_run_time, modified_by, modified_time, name, runs, task_type. Example: name|asc.
• type (String) Filter tasks by type. One of: query, action. Cannot be used together with filter or ids.

Read-Only

• tasks (Attributes List) The list of IT Automation tasks. (see below for nested schema)

Nested Schema for tasks

Read-Only:

• access_type (String) Access type of the task (Public or Shared).
• additional_file_ids (List of String) Additional RTR Response file IDs available for the task.
• assigned_user_group_ids (List of String) Assigned user group IDs of the task.
• assigned_user_ids (List of String) Assigned user IDs of the task.
• created_by (String) User who created the task.
• created_time (String) Timestamp when the task was created, in RFC3339 format.
• description (String) Description of the task.
• has_task_parameters (Boolean) Whether the task has parameters.
• id (String) Identifier for the task.
• last_run_time (String) Timestamp of the last execution, in RFC3339 format.
• linux_script_content (String) Linux script content.
• linux_script_file_id (String) Linux RTR Response script ID.
• linux_script_language (String) Linux script language.
• mac_script_content (String) Mac script content.
• mac_script_file_id (String) Mac RTR Response script ID.
• mac_script_language (String) Mac script language.
• modified_by (String) User who last modified the task.
• modified_time (String) Timestamp when the task was last modified, in RFC3339 format.
• name (String) Name of the task.
• os_query (String) OSQuery string to execute.
• runs (Number) Number of times the task has been executed.
• script_columns (Attributes) Column configuration for the script output. (see below for nested schema)
• supported_os (List of String) List of supported operating systems.
• target (String) Target filter in FQL format.
• task_group_id (String) The ID of the task group this task belongs to, if any.
• type (String) Type of task (query or action).
• verification_condition (Attributes List) Verification conditions for action tasks. (see below for nested schema)
• windows_script_content (String) Windows script content.
• windows_script_file_id (String) Windows RTR Response script ID.
• windows_script_language (String) Windows script language.

Nested Schema for tasks.script_columns

Read-Only:

• columns (Attributes List) List of column definitions. (see below for nested schema)
• delimiter (String) Delimiter character for script columns.
• group_results (Boolean) Whether to group results by column values.

Nested Schema for tasks.script_columns.columns

Read-Only:

• name (String) Name of the column.

Nested Schema for tasks.verification_condition

Read-Only:

• operator (String) Logical operator for the statements (AND or OR).
• statements (Attributes List) List of verification statements. (see below for nested schema)

Nested Schema for tasks.verification_condition.statements

Read-Only:

• data_comparator (String) Comparison operator for verification.
• data_type (String) Type of data being compared.
• key (String) Key to compare.
• task_id (String) ID of the task to query for results.
• value (String) Value to compare against.