it_automation_scheduled_task

This resource allows management of IT Automation scheduled tasks in the CrowdStrike Falcon platform. A scheduled task ties an existing IT Automation task to a recurring or one-time schedule with host targeting and optional query-result-based filtering.

API Scopes

The following API scopes are required:

• IT Automation - Policies: READ
• IT Automation - Policies: WRITE
• IT Automation - Task Executions: READ
• IT Automation - Task Executions: WRITE
• IT Automation - Tasks: READ
• IT Automation - Tasks: WRITE
• IT Automation - User Groups: READ
• IT Automation - User Groups: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

# Daily scheduled task targeting Linux production hosts.
resource "crowdstrike_it_automation_scheduled_task" "daily_example" {
  task_id       = "005e5b946b1e4320bffb7c71427c0a00"
  schedule_name = "Daily Inventory Run"
  enabled       = true
  target        = "platform_name:'Linux'+tags:'production'"

  discover_new_hosts     = true
  queue_offline_hosts    = false
  distribute_execution   = true
  expiration_period      = "1d"
  run_time_limit_minutes = 30

  schedule = {
    frequency  = "Daily"
    start_time = "2026-06-01T09:00:00-05:00"
    end_time   = "2026-12-31T09:00:00-05:00"
  }
}

# Weekly scheduled task gated by a trigger condition on a query task result.
resource "crowdstrike_it_automation_scheduled_task" "weekly_example" {
  task_id       = "005e5b946b1e4320bffb7c71427c0a00"
  schedule_name = "Weekly Compliance Check"
  enabled       = true
  target        = "platform_name:'Windows'"

  schedule = {
    frequency   = "Weekly"
    start_time  = "2026-06-01T08:00:00Z"
    day_of_week = "Monday"
  }

  trigger_condition = [{
    operator = "AND"
    statements = [{
      task_id         = "bdb7d0283ff8428f9332c5dfeb00a3aa"
      key             = "compliance_status"
      data_type       = "StringType"
      data_comparator = "Equals"
      value           = "non_compliant"
    }]
  }]
}

Schema

Required

• enabled (Boolean) Whether the schedule is active.
• schedule (Attributes) Schedule details for task execution. (see below for nested schema)
• target (String) Target of the scheduled task in FQL string syntax filtering hosts by attributes (e.g. platform_name:'Linux'+tags:'production'). See https://falconpy.io/Usage/Falcon-Query-Language.html.
• task_id (String) Unique identifier of the IT Automation task being scheduled.

Optional

• discover_new_hosts (Boolean) Run on newly discovered hosts that match target while the schedule is active.
• distribute_execution (Boolean) Stagger execution across the expiration window to reduce concurrent load.
• execution_args (Map of String) Additional arguments passed to the underlying task at execution time.
• expiration_period (String) Duration the task remains active for new/offline hosts (e.g. 30m, 1h, 2d). Minimum 1m. Must be in canonical form: the API normalizes 60m to 1h, 24h to 1d, etc., so use the largest unit that divides evenly. Setting this requires at least one of discover_new_hosts, queue_offline_hosts, or distribute_execution to be true. Note: clearing this value forces resource replacement because the API does not support removing an expiration period via update.
• queue_offline_hosts (Boolean) Run on offline hosts when they come back online before the expiration period ends.
• run_time_limit_minutes (Number) Maximum runtime per host execution, in minutes. Maximum 120 (2 hours).
• schedule_name (String) Display name for the scheduled task. Note: clearing this value forces resource replacement because the API does not support removing a schedule name via update.
• trigger_condition (Attributes List) Query task result conditions that further filter hosts selected by target. Each element is one conditional group; groups are joined with an implicit AND. Statements within a group reference an existing query task by task_id and compare one of its result columns to a value. Maps to the Query tasks results sections in the Falcon console’s Advanced target definition. The console only exposes this feature for schedules whose underlying task is action or remediation type, but the API itself accepts it on query task schedules as well. (see below for nested schema)

Read-Only

• created_by (String) Username of the user who created the scheduled task.
• created_time (String) RFC3339 timestamp when the scheduled task was created.
• groups (Attributes List) Task group memberships of the underlying task. (see below for nested schema)
• id (String) The ID of the scheduled task.
• last_run (String) RFC3339 timestamp of the last execution.
• modified_by (String) Username of the user who last modified the scheduled task.
• modified_time (String) RFC3339 timestamp when the scheduled task was last modified.
• next_run_time (String) RFC3339 timestamp of the next scheduled execution.
• task_name (String) Name of the underlying scheduled task.
• task_type (String) Type of the underlying scheduled task (query or action).

Nested Schema for schedule

Required:

• frequency (String) Frequency of runs. One of: One-Time, Minutes, Hourly, Daily, Weekly, Monthly.

Optional:

• day_of_month (Number) Day of month (1-28) for Monthly frequency. Required when frequency = "Monthly". Not allowed for other frequencies. Note: API limits this to 1-28 to handle February.
• day_of_week (String) Day of week for Weekly frequency. One of Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday. Required when frequency = "Weekly". Not allowed for other frequencies.
• end_time (String) RFC3339 timestamp when the schedule stops running.
• interval (Number) Run interval. Required when frequency = "Minutes" (range 60-10080, in minutes) or frequency = "Hourly" (range 1-168, in hours). Not allowed for other frequencies. Meaning depends on frequency.
• start_time (String) RFC3339 timestamp for when the schedule first runs. Required when creating or modifying a schedule. Existing imported schedules may omit this value when the API does not return it. The timezone offset embedded in this value determines the local timezone for recurring runs.

Nested Schema for trigger_condition

Required:

• operator (String) Logical operator joining the group’s statements. One of: AND, OR.
• statements (Attributes List) Conditions evaluated against the results of a query task. (see below for nested schema)

Nested Schema for trigger_condition.statements

Required:

• data_comparator (String) Comparison operator. One of: Equals, NotEquals, Contains, NotContains, Matches, NotMatches, LessThan, LessThanEquals, GreaterThan, GreaterThanEquals.
• data_type (String) How to interpret value during comparison. One of: StringType, NumericType, SemverType.
• key (String) Result column from the query task to evaluate.
• task_id (String) ID of the query task whose results are evaluated.
• value (String) Value to compare against. Numeric comparisons require numeric strings (e.g. "100").

Nested Schema for groups

Read-Only:

• id (String) Group ID.
• name (String) Group name.

Import

Import is supported using the following syntax:

# it automation scheduled task can be imported by specifying the scheduled task id.
terraform import crowdstrike_it_automation_scheduled_task.example 005e5b946b1e4320bffb7c71427c0a00

# using import block (requires terraform 1.5+)
import {
  to = crowdstrike_it_automation_scheduled_task.example
  id = "005e5b946b1e4320bffb7c71427c0a00"
}