correlation_rules

Use this data source to query existing CrowdStrike NGSIEM Correlation Rules.

API Scopes

The following API scopes are required:

• Correlation Rules: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

# Get all correlation rules
data "crowdstrike_correlation_rules" "all" {}

# Get only active correlation rules using individual attributes
data "crowdstrike_correlation_rules" "active" {
  status = "active"
}

# Get rules by name pattern using individual attributes
data "crowdstrike_correlation_rules" "by_name" {
  name   = "AWS-*"
  status = "active"
}

# Get rules using raw FQL filter
data "crowdstrike_correlation_rules" "by_fql" {
  filter = "status:'active'+name:'AWS-*'"
}

output "active_rule_count" {
  value = length(data.crowdstrike_correlation_rules.active.rules)
}

output "active_rule_names" {
  value = [for r in data.crowdstrike_correlation_rules.active.rules : r.name]
}

Schema

Optional

• filter (String) FQL filter to apply. Supported fields: created_on, customer_id, last_updated_on, name, status, user_id, user_uuid. Cannot be used together with name or status attributes. Example: status:'active'+name:'My Rule'.
• name (String) Filter rules by name. Supports FQL wildcards (*). Cannot be used together with filter.
• status (String) Filter rules by status. Cannot be used together with filter.

Read-Only

• rules (Attributes List) The list of correlation rules matching the query. (see below for nested schema)

Nested Schema for rules

Read-Only:

• cid (String) The CID of the environment.
• created_on (String) Timestamp when the rule was created.
• description (String) The correlation rule description.
• id (String) Stable identifier of the correlation rule (the API’s rule_id). Use this value with terraform import and when referencing the rule from other resources.
• name (String) The correlation rule name.
• rule_id (String) Alias of id. Stable correlation rule identifier returned by the API as rule_id.
• severity (String) The severity level (informational, low, medium, high, critical).
• status (String) The rule status (active or inactive).
• tactic (String) The MITRE ATT&CK tactic ID.
• technique (String) The MITRE ATT&CK technique ID.
• template_id (String) The template ID this rule was created from.
• type (String) Rule type. Always correlation; the data source filters out other rule types (e.g. sensor, behavioral) that this provider does not manage.
• updated_on (String) Timestamp when the rule was last updated.