CrowdStrike Trigger

CrowdStrike Trigger
Certified
Enterprise Edition
Trigger a flow on a new CrowdStrike Falcon alert

Polls QueryAlerts/GetAlerts at the configured interval, filtered server-side to alerts created after the last delivered one, and fires one execution per newly discovered alert (oldest first, one per poll cycle) so no alert is skipped even during a burst. The trigger tracks the created_timestamp of the newest delivered alert in namespace KV to avoid re-firing; on the first poll, only the current baseline is recorded — no execution is fired — to avoid flooding on initial activation.

yaml
type: io.kestra.plugin.ee.crowdstrike.alerts.Trigger

Examples

Trigger a flow whenever a new critical CrowdStrike alert is raised

yaml
id: crowdstrike_on_new_alert
namespace: company.team

tasks:
  - id: log_alert
    type: io.kestra.plugin.core.log.Log
    message: "New alert {{ trigger.compositeId }} ({{ trigger.severity }}): {{ trigger.name }}"

triggers:
  - id: on_critical_alert
    type: io.kestra.plugin.ee.crowdstrike.alerts.Trigger
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    filter: "severity:>=80"
    interval: PT2M

Properties

clientId *string

API client ID

Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.

clientSecret *string

API client secret

Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.

allowConcurrent boolean

Defaultfalse

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

baseUrl string

Defaulthttps://api.crowdstrike.com

CrowdStrike API base URL

Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.

filter string

FQL filter

CrowdStrike Falcon Query Language expression applied in addition to the trigger's own time cursor (for example: severity: >=80).

interval string

DefaultPT1M

Formatduration

Polling interval

How often to poll the CrowdStrike API for new items. Defaults to PT1M (every minute).

stopAfter array

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

when string

Defaulttrue

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.

Outputs

compositeId string

Alert composite ID

hostInfo object

Raw device object describing the host the alert originated from

name string

Alert name

severity integer

Alert severity, from 1 (lowest) to 100 (highest)

status string

Alert status

timestamp string