ngsiem_parser_info

Returns detailed information for one or more NG-SIEM parsers in the

Added in version 4.13.0

Parameters

Parameter	Type	Required	Default	Description
definitions	bool	No	true	Whether to fetch the full definition for each parser. When C(true) (default), an additional API call is made per parser to When C(false), only the lightweight list metadata is returned.
limit	int	No	100	Maximum number of parsers to return. Must be between 1 and 500.
name	str	No		Substring to match against parser names. This maps to the only supported parser query filter (C(name:~‘value’)),
offset	int	No	0	Starting index for pagination. Use with I(limit) to paginate through large result sets.
parser_ids	list	No		A list of parser IDs to get information about. Parser IDs are version-suffixed (e.g. C(abc123:1.0.0)). When provided, I(name), I(parser_type), and I(update_available) filters
parser_type	str	No		Filter parsers by type. C(ootb) returns only built-in (out-of-the-box) parsers. C(custom) returns only custom parsers created in your tenant.
repository	str	No	parsers-repository	The name of the repository to query.
update_available	bool	No		Filter parsers by whether a newer version is available.

Examples

- name: Get all parsers with full definitions
  crowdstrike.falcon.ngsiem_parser_info:

- name: Get only custom parsers
  crowdstrike.falcon.ngsiem_parser_info:
    parser_type: custom

- name: Get parsers whose name contains 'watchguard'
  crowdstrike.falcon.ngsiem_parser_info:
    name: watchguard

- name: Get specific parsers by ID
  crowdstrike.falcon.ngsiem_parser_info:
    parser_ids:
      - "10f55deaa2893f60b87af305f44f80bf:1.0.0"

- name: List parsers that have an update available (metadata only)
  crowdstrike.falcon.ngsiem_parser_info:
    update_available: true
    definitions: false

- name: Get custom parsers using metadata only for a quick inventory
  crowdstrike.falcon.ngsiem_parser_info:
    parser_type: custom
    definitions: false
    limit: 50

Return Values

Key	Type	Description
parsers		-
meta		M