CrowdStrike GetAlerts
CertifiedEnterprise EditionFetch CrowdStrike Falcon alerts by composite ID
CrowdStrike GetAlerts
Fetch CrowdStrike Falcon alerts by composite ID
Fetches full alert details for a list of composite IDs, typically obtained from QueryAlerts.
type: io.kestra.plugin.ee.crowdstrike.alerts.GetAlertsExamples
Fetch a known set of alerts and log their severity
id: get_alerts
namespace: company.team
tasks:
- id: get_alerts
type: io.kestra.plugin.ee.crowdstrike.alerts.GetAlerts
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
ids:
- "aid:ind:1700000000"
Properties
clientId *Requiredstring
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *Requiredstring
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
ids array
Composite IDs
Alert composite IDs to fetch.
Outputs
alerts array
Fetched alerts
io.kestra.plugin.ee.crowdstrike.alerts.AlertRecord
UID of the analyst the alert is assigned to, if any.
Composite ID of the alert, unique across products (for example aid: ind: timestamp).
UTC timestamp the alert was created, ISO-8601.
Alert description.
Raw device object describing the host the alert originated from (fields vary by alert type).
Human-readable alert name.
Numeric severity from 1 (lowest) to 100 (highest).
Current alert status: new, in_progress, closed, or reopened.
Tags attached to the alert.
Alert type (for example ldt, xdr).
UTC timestamp the alert was last updated, ISO-8601.
