ngsiem_data_connection_info

Returns detailed information for one or more NG-SIEM data connections. Some of the details returned include connection name, vendor, parser, status,

Added in version 4.13.0

Parameters

Parameter	Type	Required	Default	Description
connection_ids	list	No		A list of data connection IDs to get information about. If not provided, connections will be returned based on filter and pagination settings. Cannot be used together with I(filter).
filter	str	No		FQL (Falcon Query Language) filter expression to limit results. “Supported fields: C(name), C(id), C(vendor_name), C(vendor_product_name), “C(status) accepts: C(Pending), C(Active), C(Disconnected), C(Error), C(Idle), C(Paused).” “C(type) accepts: C(PUSH), C(PULL).” “Examples: C(name:‘edge’), C(status:‘Active’), C(type:‘PUSH’).” Cannot be used together with I(connection_ids).
include_status	bool	No	false	Whether to enrich each connection with its current provisioning status. When enabled, adds a C(provisioning_status) field to each connection. This requires an additional API call per connection.
limit	int	No	100	Maximum number of data connections to return. Must be between 1 and 500.
offset	int	No	0	Starting index for pagination. Use with I(limit) to paginate through large result sets.
sort	str	No		Property to sort results by. “B(Note:) Only C(name.asc) is supported by the API. Other sort values are rejected.”

Examples

- name: Get all data connections
  crowdstrike.falcon.ngsiem_data_connection_info:

- name: Get specific data connections by ID
  crowdstrike.falcon.ngsiem_data_connection_info:
    connection_ids:
      - "abcdef1234567890abcdef1234567890"
      - "1234567890abcdef1234567890abcdef"

- name: Search connections by name pattern
  crowdstrike.falcon.ngsiem_data_connection_info:
    filter: "name:'*edge*'"
    limit: 50

- name: Filter connections by status
  crowdstrike.falcon.ngsiem_data_connection_info:
    filter: "status:'Active'"
    sort: "name.asc"

- name: Filter PUSH connections and include provisioning status
  crowdstrike.falcon.ngsiem_data_connection_info:
    filter: "type:'PUSH'"
    include_status: true

Return Values

Key	Type	Description
data_connections		-
meta		M