ngsiem_parser

Create, update, clone, and delete custom NG-SIEM parsers in the CrowdStrike

Added in version 4.13.0

Parameters

Parameter	Type	Required	Default	Description
clone_from	str	No		The ID of a source parser to clone into a new parser named I(name). Mutually exclusive with I(parser_yaml) and I(extension_of). Only applies when the target parser (I(name)) does not already exist.
extension_of	str	No		The unversioned base parser ID to create an extension of, named I(name). “B(Note:) The base parser ID must be B(unversioned) (no C(:x.y.z) suffix).” Mutually exclusive with I(parser_yaml) and I(clone_from). Only applies when the target parser (I(name)) does not already exist.
name	str	No		The name of the parser. Required when creating a new parser and when using I(clone_from) or Used to look up an existing parser when I(parser_id) is not provided.
parser_id	str	No		The version-suffixed ID of an existing parser (e.g. C(abc123:1.0.0)). Preferred for identifying an existing parser during update or delete. When provided with I(state=absent), the parser is deleted by ID.
parser_yaml	str	No		The full LogScale parser YAML template. Required when creating or updating a parser via I(state=present) unless For idempotency, the module compares the C(script), C(tagFields), and
repository	str	No	parsers-repository	The name of the repository the parser belongs to.
state	str	No	present	The desired state of the parser. C(present) ensures the parser exists with the specified content. C(absent) ensures the parser does not exist.

Examples

- name: Create a custom parser from a YAML template
  crowdstrike.falcon.ngsiem_parser:
    name: my-custom-parser
    parser_yaml: "{{ lookup('file', 'my-parser.yaml') }}"

- name: Update a parser (idempotent - only changes when content differs)
  crowdstrike.falcon.ngsiem_parser:
    name: my-custom-parser
    parser_yaml: "{{ lookup('file', 'my-parser-v2.yaml') }}"

- name: Clone an existing parser into a new one
  crowdstrike.falcon.ngsiem_parser:
    name: my-cloned-parser
    clone_from: "10f55deaa2893f60b87af305f44f80bf:1.0.0"

- name: Create an extension of a base parser (base ID must be unversioned)
  crowdstrike.falcon.ngsiem_parser:
    name: my-parser-extension
    extension_of: "10f55deaa2893f60b87af305f44f80bf"

- name: Delete a parser by name
  crowdstrike.falcon.ngsiem_parser:
    name: my-custom-parser
    state: absent

- name: Delete a parser by ID
  crowdstrike.falcon.ngsiem_parser:
    parser_id: "10f55deaa2893f60b87af305f44f80bf:1.1.0"
    state: absent

Return Values

Key	Type	Description
parser		-