ngsiem_data_connection_token

Generates and manages the HEC ingest token for a push crowdstrike_ngsiem_data_connection. The token is generated by the API and returned only at generation time; it is stored in Terraform state as a sensitive value and cannot be read back from the API afterward. Because the plaintext cannot be re-read, this resource does not support import. Rotate the token by changing triggers, which replaces the resource and generates a new token.

API Scopes

The following API scopes are required:

• NGSIEM Data Connections API: READ
• NGSIEM Data Connections API: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {}

# PUSH connection (HEC / HTTP Event Connector): no config, exposes an ingest URL.
resource "crowdstrike_ngsiem_data_connection" "hec" {
  name         = "app-hec-ingest"
  connector_id = "a1bfd0c4380f436790cb41afc2b95f38"
  parser       = "aws-elb" # required: supply a valid parser name from the catalog

  enable_host_enrichment = false
  enable_user_enrichment = false
}

# Generate the HEC ingest token for the push connection. The token is returned
# only at generation time and stored in state as sensitive; it cannot be read
# back from the API. Change triggers to regenerate (and invalidate the
# previous token).
resource "crowdstrike_ngsiem_data_connection_token" "hec" {
  connection_id = crowdstrike_ngsiem_data_connection.hec.id

  triggers = {
    rotated_on = "2026-01-01"
  }
}

# The ingest URL is not sensitive and can be output.
output "hec_ingest_url" {
  value = crowdstrike_ngsiem_data_connection_token.hec.ingest_url
}

# The token is sensitive: consume it via a write-only sink (e.g. a secrets
# manager), do not output it in plaintext.

Schema

Required

• connection_id (String) The ID of the push crowdstrike_ngsiem_data_connection to generate an ingest token for. Changing this forces a new resource to be created.

Optional

• triggers (Map of String) A map of arbitrary strings that, when changed, will force the token to be regenerated, invalidating the previous one. Use this to rotate the token on demand (e.g. set a date or version string).

Read-Only

• created_at (String) Timestamp (RFC3339) when the token was generated.
• expires_at (String) Timestamp (RFC3339) when the token expires.
• ingest_url (String) The HEC ingest URL for the connection. External sources send events here using the token.
• token (String, Sensitive) The HEC ingest token. Returned only when generated and stored in state as sensitive; it cannot be read back from the API. Regenerated when triggers changes or the resource is replaced.