CrowdStrike QueryAlerts

CrowdStrike QueryAlerts
Certified
Enterprise Edition
Query CrowdStrike Falcon alert IDs

Searches alerts with the CrowdStrike Falcon Query Language (FQL) and returns matching composite IDs, which can be passed to GetAlerts to fetch full alert details. Omitting filter matches every alert visible to the API client.

yaml
type: io.kestra.plugin.ee.crowdstrike.alerts.QueryAlerts

Examples

Query and fetch every new critical alert

yaml
id: query_critical_alerts
namespace: company.team

tasks:
  - id: query_alerts
    type: io.kestra.plugin.ee.crowdstrike.alerts.QueryAlerts
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    filter: "status:'new'+severity:>=80"
    sort: "created_timestamp.desc"
    limit: 50

  - id: get_alerts
    type: io.kestra.plugin.ee.crowdstrike.alerts.GetAlerts
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    ids: "{{ outputs.query_alerts.ids }}"

Properties

clientId *string

API client ID

Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.

clientSecret *string

API client secret

Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.

baseUrl string

Defaulthttps://api.crowdstrike.com

CrowdStrike API base URL

Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.