ngsiem_data_connection

Create, update, delete, and pause/resume NG-SIEM data connections in the

Added in version 4.13.0

Parameters

Parameter	Type	Required	Default	Description
`config`	dict	No		A free-form configuration dict for the connection. Used by PULL connectors to supply authentication and parameters “B(Note:) This field is write-only. It is applied on create but is never
`config_id`	str	No		The ID of a saved connector config to associate with the connection.
`connection_id`	str	No		The ID of an existing data connection. Preferred for identifying existing connections during update, delete, or Either I(connection_id) or I(name) is required.
`connector_id`	str	No		The ID of the connector this connection is based on. Required when creating a new connection. Use M(crowdstrike.falcon.ngsiem_data_connector_info) to discover available connectors.
`connector_type`	str	No		The type of the connector.
`description`	str	No		A description for the data connection. “B(Note:) This field is write-only. It is applied on create but is never
`enable_host_enrichment`	bool	No		Whether to enable host enrichment for the connection. “B(Note:) This field is write-only. It is applied on create but is never
`enable_user_enrichment`	bool	No		Whether to enable user enrichment for the connection. “B(Note:) This field is write-only. It is applied on create but is never
`enabled`	bool	No		Whether the connection should be running (resumed) or paused. C(true) resumes a paused connection; C(false) pauses a running connection. Only applied when the connection already exists. Pausing is only valid when the connection is in an C(Active), C(Error), or
`log_sources`	list	No		A list of log sources for the connection.
`name`	str	No		The name of the data connection. Required when creating a new connection and I(connection_id) is not provided. Used to look up an existing connection when I(connection_id) is not specified.
`parser`	str	No		The parser to apply to the connection’s data. Required when creating a new connection. The value must be valid for the chosen connector (e.g. C(microsoft-edge)).
`state`	str	No	present	The desired state of the data connection. C(present) ensures the connection exists with the specified configuration. C(absent) ensures the connection does not exist.
`vendor_name`	str	No		The vendor name associated with the connection.
`vendor_product_name`	str	No		The vendor product name associated with the connection.
`wait_for_ingest_token`	bool	No	true	Whether to wait for the ingest token to become available when creating a The token is minted on the first successful request, but immediately after The token is a one-time secret - it can only be retrieved once, so enabling Only applies to the create of a PUSH connection.
`wait_timeout`	int	No	120	Maximum number of seconds to wait for the ingest token when If the token is still not available after this timeout, the connection is

Examples

- name: Create a PUSH (HEC) data connection
  crowdstrike.falcon.ngsiem_data_connection:
    name: "Edge browser logs"
    connector_id: "a1bfd0c4380f436790cb41afc2b95f38"
    parser: "microsoft-edge"
    vendor_name: "Microsoft"
    vendor_product_name: "Edge"
  register: hec_connection

- name: Show the ingest URL (the token is sensitive and only returned once on create)
  ansible.builtin.debug:
    var: hec_connection.data_connection.ingest_url

- name: Create a PULL (S3) data connection with auth config
  crowdstrike.falcon.ngsiem_data_connection:
    name: "AWS S3 CloudTrail"
    connector_id: "0123456789abcdef0123456789abcdef"
    parser: "aws-cloudtrail"
    vendor_name: "AWS"
    vendor_product_name: "CloudTrail"
    config:
      auth:
        access_key_id: "{{ aws_access_key_id }}"
        secret_access_key: "{{ aws_secret_access_key }}"
      params:
        bucket: "my-cloudtrail-bucket"
        region: "us-east-1"

- name: Update a connection's name by ID
  crowdstrike.falcon.ngsiem_data_connection:
    connection_id: "abcdef1234567890abcdef1234567890"
    name: "Edge browser logs (renamed)"

- name: Pause a connection
  crowdstrike.falcon.ngsiem_data_connection:
    connection_id: "abcdef1234567890abcdef1234567890"
    enabled: false

- name: Resume a connection
  crowdstrike.falcon.ngsiem_data_connection:
    connection_id: "abcdef1234567890abcdef1234567890"
    enabled: true

- name: Delete a connection by name
  crowdstrike.falcon.ngsiem_data_connection:
    name: "Edge browser logs"
    state: absent

- name: Delete a connection by ID
  crowdstrike.falcon.ngsiem_data_connection:
    connection_id: "abcdef1234567890abcdef1234567890"
    state: absent

Return Values

Key	Type	Description
`data_connection`		-
`ingest_token`		-