ngsiem_data_connection

Manages a single NG-SIEM data connection that ingests logs from an external source into the CrowdStrike Falcon platform. A connection instantiates a connector from the catalog; pull connectors reference a crowdstrike_ngsiem_data_connector_config via config_id, while push connectors (e.g. HEC) take no config and expose an ingest URL.

API Scopes

The following API scopes are required:

• NGSIEM Data Connections API: READ
• NGSIEM Data Connections API: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {}

# Reusable connector config (see crowdstrike_ngsiem_data_connector_config).
resource "crowdstrike_ngsiem_data_connector_config" "s3" {
  connector_id = "07d3b89a204f41d988e198bd2d6536d8"
  name         = "prod-s3-access-logs"
  params = jsonencode({
    account_id            = "123456789012"
    bucket                = "my-access-log-bucket"
    prefix                = "logs/"
    region                = "us-east-1"
    sqs_name              = "my-s3-notification-queue"
    authentication_method = "iam_assume_role"
    iam_assume_role       = "arn:aws:iam::123456789012:role/crowdstrike-s3-ingest"
  })
}

# Look up the connector to get its id and default parser.
data "crowdstrike_ngsiem_data_connector" "s3" {
  name = "Amazon S3 Access Log Data Connector"
}

# PULL connection referencing the config by id.
resource "crowdstrike_ngsiem_data_connection" "s3_access_logs" {
  name         = "prod-s3-access-logs"
  connector_id = data.crowdstrike_ngsiem_data_connector.s3.id
  config_id    = crowdstrike_ngsiem_data_connector_config.s3.id

  # parser is REQUIRED; use the connector's first supported parser from the data source.
  parser = data.crowdstrike_ngsiem_data_connector.s3.parsers[0]

  # Both enrichment flags are REQUIRED with no default. The console defaults
  # these to true, but this resource forces an explicit choice.
  enable_host_enrichment = true
  enable_user_enrichment = true

  description = "Production S3 server-access logs"
}

# PUSH connection (HEC / HTTP Event Connector): no config, exposes an ingest URL.
resource "crowdstrike_ngsiem_data_connection" "hec" {
  name         = "app-hec-ingest"
  connector_id = "a1bfd0c4380f436790cb41afc2b95f38"
  parser       = "aws-elb" # required: supply a valid parser name from the catalog

  enable_host_enrichment = false
  enable_user_enrichment = false
}

Schema

Required

• connector_id (String) The connector catalog ID this connection instantiates. Changing this forces a new resource to be created.
• enable_host_enrichment (Boolean) Whether to enrich ingested events with host data. Required; the Falcon console defaults this to true, but this resource requires an explicit value.
• enable_user_enrichment (Boolean) Whether to enrich ingested events with user data. Required; the Falcon console defaults this to true, but this resource requires an explicit value.
• name (String) The name of the data connection.
• parser (String) The parser applied to ingested events. The API requires a parser and does not default one. Use the crowdstrike_ngsiem_data_connector data source’s parsers for the connector’s supported parsers; a parser that does not match the connector’s event format may not parse correctly.

Optional

• config_id (String) ID of a crowdstrike_ngsiem_data_connector_config to use for a pull connection.
• custom (Map of String) Free-form key/value metadata sent to the API. Not returned by the API on read.
• description (String) A human-readable description of the data connection.
• log_sources (Set of String) Optional log-source tags for the connection.

Read-Only

• connector_type (String) The connector type, derived from the connector catalog (Pull or Push).
• id (String) The ID of the data connection.
• ingest_url (String) The HEC ingest URL. Populated for push connections only, and only after an ingest token has been generated for the connection; null for pull connections and before a token exists.
• last_ingested (String) Timestamp (RFC3339) of the most recent ingestion. Empty until data is ingested.
• last_ingested_volume_one_day (String) Human-readable volume ingested in the last 24 hours (e.g. 1.23 GB).
• status (String) The runtime status of the connection (e.g. Active, Idle, Pending).
• vendor_name (String) The vendor name, derived from the connector catalog.
• vendor_product_name (String) The vendor product name, derived from the connector catalog.

Import

Import is supported using the following syntax:

# NG-SIEM data connections can be imported by specifying the connection id.
terraform import crowdstrike_ngsiem_data_connection.example a1bfd0c4380f436790cb41afc2b95f38