ngsiem_data_connectors

Reads the NG-SIEM connector catalog and returns a list of connectors, each with its catalog ID, supported parsers, type, and vendor metadata. Supports an optional FQL filter.

API Scopes

The following API scopes are required:

• NGSIEM Data Connections API: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {}

# All connectors.
data "crowdstrike_ngsiem_data_connectors" "all" {}

# Only pull connectors.
data "crowdstrike_ngsiem_data_connectors" "pull" {
  filter = "type:'PULL'"
}

# Compose filters with FQL: AWS pull connectors only.
data "crowdstrike_ngsiem_data_connectors" "aws_pull" {
  filter = "type:'PULL'+vendor_name:'AmazonWebServices'"
}

# Build a name -> connector lookup to drive connections.
locals {
  connectors_by_name = {
    for c in data.crowdstrike_ngsiem_data_connectors.all.connectors : c.name => c
  }
}

output "connector_names" {
  value = [for c in data.crowdstrike_ngsiem_data_connectors.all.connectors : c.name]
}

Schema

Optional

• filter (String) Optional FQL filter to narrow the catalog. Filterable fields: type (PULL or PUSH), name, vendor_name, vendor_product_name, and subscription. Example: type:'PULL'+vendor_name:'AmazonWebServices'. If omitted, all connectors are returned.

Read-Only

• connectors (Attributes List) The list of connectors in the catalog matching the filter. (see below for nested schema)

Nested Schema for connectors

Read-Only:

• description (String) The connector description.
• id (String) The connector catalog ID.
• log_sources (List of String) Log sources declared by the connector.
• name (String) The connector name.
• parsers (List of String) All parsers the connector supports.
• subscription (String) The subscription the connector belongs to (e.g. Next-Gen SIEM).
• type (String) The connector type (PULL or PUSH).
• vendor_name (String) The vendor name (e.g. AmazonWebServices).
• vendor_product_name (String) The vendor product name (e.g. Amazon S3 Access Logs).