CrowdStrike LogScale
Introduction
This guide tells you how to authenticate the CrowdStrike LogScale connector in Swimlane using HTTP Bearer Authentication.
You will generate an API token in CrowdStrike LogScale, collect the required connection details, and configure the connector in Swimlane.
Prerequisites
CrowdStrike LogScale Access Requirements
You must have permissions to:
- Access the CrowdStrike LogScale portal.
- Create and manage API tokens.
- Access the LogScale REST APIs.
- Read or manage repositories based on your intended use.
Required Credentials
During setup, you will collect:
Credential | Description |
|---|---|
URL | Base URL of your CrowdStrike LogScale instance |
Token | API Bearer Token used for authentication |
CrowdStrike LogScale Setup
Take the following steps to generate an API Token:
- Log in to your CrowdStrike LogScale instance.
- Click your User Profile.
- Navigate to API Tokens or Personal Access Tokens.
- Click Create Token.
- Enter a descriptive name for the token.
- Assign the appropriate permissions required for your workflows.
- Click Create.
- Copy and securely save the generated token.
This saved value is your Bearer Token.
Take the following steps to collect the LogScale URL:
- Log in to your CrowdStrike LogScale instance.
- Copy the URL displayed in your browser.
Example:
- Cloud: https://cloud.us.humio.com
- Self-hosted: https://logscale.company.com
Use this value as the url during connector configuration.
Connector Configuration in Swimlane
- Log in to Turbine.
- From the left-hand navigation pane, click ORCHESTRATION and click Assets.
- Asset homepage opens.
- Click the plus icon to open the Configure your Connector Asset window.
- Select CrowdStrike LogScale from the Asset type list.
- Fill in the Asset Settings and Asset Input as shown:
Field | Description | Required/Optional |
|---|---|---|
url | CrowdStrike LogScale instance URL | Required |
token | Bearer API Token | Required |
verify_ssl | Enable/Disable SSL Verification | Optional |
http_proxy | Optional proxy configuration | Optional |
Fields with * marks are required.
- Click Create.
- The connector authenticates using an HTTP Bearer Token.
- The token is sent in the Authorization header as a Bearer token.
- Ensure the token has permissions appropriate for the actions you intend to perform.
- Repository-level permissions determine which repositories and APIs the connector can access.
Troubleshooting
Authentication Failed (401 Unauthorised)
Verify that:
- The Bearer Token is valid.
- The token has not expired or been revoked.
- The URL points to the correct CrowdStrike LogScale instance.
- There are no extra spaces when copying the token.
Permission Denied (403 Forbidden)
Verify that:
- The API token has sufficient permissions.
- Your account has access to the required repositories.
- Your organisation allows API access for your user account.
SSL Errors
If SSL verification fails:
- Verify that the LogScale SSL certificate is trusted.
- Confirm that any corporate proxy or firewall is not intercepting SSL traffic.
- Temporarily disable verify_ssl only for testing if permitted by your organisation's security policy.
Result
You have successfully authenticated the CrowdStrike LogScale connector in Swimlane.
Sources
- CrowdStrike LogScale Authentication Documentation https://library.humio.com/falcon-logscale/api-authentication.htmlο»Ώ
- CrowdStrike LogScale REST API Documentation https://library.humio.com/falcon-logscale/api.htmlο»Ώ
- CrowdStrike LogScale Search API Documentation https://library.humio.com/falcon-logscale/api-search.htmlο»Ώ
- CrowdStrike LogScale GraphQL API Documentation https://library.humio.com/falcon-logscale/api-graphql.htmlο»Ώ
- CrowdStrike LogScale Alert API Documentation https://library.humio.com/falcon-logscale/api-alerts.htmlο»Ώ
- CrowdStrike LogScale Ingest API Documentation https://library.humio.com/falcon-logscale/api-ingest.htmlο»Ώ
- CrowdStrike LogScale Lookup API Documentation https://library.humio.com/falcon-logscale/api-lookups.htmlο»Ώ