CrowdStrike UpdateAlert
CertifiedEnterprise EditionUpdate CrowdStrike Falcon alerts
CrowdStrike UpdateAlert
Update CrowdStrike Falcon alerts
Bulk-updates status, assignment, and/or adds a comment on one or more alerts identified by composite ID. At least one of status, assignedToUid, or comment must be set.
type: io.kestra.plugin.ee.crowdstrike.alerts.UpdateAlertExamples
Acknowledge and assign a batch of alerts
id: update_alerts
namespace: company.team
tasks:
- id: update_alert
type: io.kestra.plugin.ee.crowdstrike.alerts.UpdateAlert
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
ids:
- "aid:ind:1700000000"
status: IN_PROGRESS
assignedToUid: "analyst@example.com"
comment: "Triaged by automated workflow."
Properties
clientId *string
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *string
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150assignedToUid string
Assignee UID
UID (usually an email) of the analyst to assign the alert(s) to.
baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
comment string
Comment
Comment appended to the alert(s).
ids array
Composite IDs
Alert composite IDs to update.
status string
NEWIN_PROGRESSCLOSEDREOPENEDNew status
New alert status: NEW, IN_PROGRESS, CLOSED, or REOPENED.
Outputs
updatedCount integer
Number of alerts CrowdStrike confirmed were updated
Alerts submitted minus any the API reported as failed. See the task logs for the specific error messages.
