CrowdStrike Logscale

CrowdStrike Logscale is a log management platform that enables efficient ingestion, searching, and analysis of log data.

CrowdStrike Logscale is a powerful platform for log management and analysis, designed to handle large volumes of data with speed and efficiency. By integrating with Swimlane Turbine, users can automate security operations and data analysis, leveraging Logscale's capabilities to enhance threat detection and response. This integration allows for seamless ingestion, querying, and management of log data, enabling security teams to streamline workflows and improve incident response times.

Prerequisites

Before you can use the CrowdStrike Logscale connector for Turbine, you'll need access to the CrowdStrike Logscale API. This requires the following:

HTTP Bearer authentication using the following parameters:

URL: The endpoint URL for accessing CrowdStrike Logscale services.

Token: A bearer token such as a JWT for authenticating API requests.

Asset Setup

The asset for this Connector requires the following input:

Token

Capabilities

This Connector provides the following capabilities:

Create Alert

Create Query Jobs

Delete Alert by ID

Delete File for Cloud Users

Delete File for on Premises Users

Delete Query Job by ID

Execute Query

Get Alert by ID

Get Alerts

Ingest Raw Data

Ingest Raw Json Data

Ingest Structured Data

Ingest Unstructured Data

Initiate Search

Poll Query Job by ID ... and so on

Important Key Points

In the case of using Create Query Jobs and Execute Query tasks, we are allowed to pass the start and end fields in the json body request in the following two ways :

Absolute Time :

With absolute time, you specify a number that expresses the precise time in milliseconds since the Unix epoch (Unix time) in the UTC/Zulu time zone. This method is shown in the following example:

{ "queryString": "", "start": 1473449370018, "end": 1473535816755 }

Relative Time:

With relative time, you specify the start and end time as a relative time such as 1minute or 24hours. LogScale supports this using relative time modifiers. LogScale treats the start and end times as relative times if you specify them as strings. When providing a timestamp, relative time modifiers are specified relative to "now". This method is shown in the following examples:

{ "queryString": "ERROR", "start": "24hours", "end": "now" }

When using the Update Alert by ID task, throttleField input parameter details are available in the following link :

Throttle Field Details Link

Notes

For more information on Tanium is found at: CrowdStrike LogScale Main Site

API Documentation Link

API Authentication Documentation Link

Search API Documentation Link

GraphQL API Documentation Link

Alert API Documentation Link

Ingest API Documentation Link

Lookup API Documentation Link

Additional Documentation

CrowdStrike Logscale Connector Documentation

CrowdStrike Logscale API Documentation

Configurations

HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API key, token, etc.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Alert

Generate a new alert in the specified DATASPACE within CrowdStrike Logscale, requiring path parameters and JSON body inputs.

Endpoint

URL: /api/v1/repositories/{{DATASPACE}}/alerts

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.DATASPACE	string	Required	Parameters for the Create Alert action
name	string	Optional	Name of the resource
query	object	Optional	Parameter for Create Alert
query.queryString	string	Optional	Parameter for Create Alert
query.start	string	Optional	Parameter for Create Alert
description	string	Optional	Parameter for Create Alert
throttleTimeMillis	number	Optional	Parameter for Create Alert
silenced	boolean	Optional	Parameter for Create Alert
notifiers	array	Optional	Parameter for Create Alert
labels	array	Optional	Parameter for Create Alert

Input Example

{"json_body":{"name":"test","query":{"queryString":"foobar","start":"1h"},"description":"this is a test","throttleTimeMillis":600000,"silenced":false,"notifiers":["GrpMXUR2me8045Sz39qcsoWjXT3fJ7rT"],"labels":["test"]},"path_parameters":{"DATASPACE":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Create Query Jobs

Run a query in CrowdStrike Logscale using the specified repository name and query string, with the ability to check status later.

Endpoint

URL: /api/v1/repositories/{{REPOSITORY_NAME}}/queryjobs

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.REPOSITORY_NAME	string	Required	Parameters for the Create Query Jobs action
queryString	string	Optional	Parameter for Create Query Jobs
start	string	Optional	Parameter for Create Query Jobs
end	string	Optional	Parameter for Create Query Jobs
isLive	boolean	Optional	Parameter for Create Query Jobs
timeZoneOffsetMinutes	number	Optional	Parameter for Create Query Jobs
arguments	object	Optional	Parameter for Create Query Jobs

Input Example

{"json_body":{"queryString":"loglevel=ERROR","start":"1473449370018","end":"1473535816755","isLive":false,"timeZoneOffsetMinutes":60,"arguments":{}},"path_parameters":{"REPOSITORY_NAME":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"string"}}

Delete Alert by ID

Remove a specified alert from CrowdStrike Logscale using the provided DATASPACE and ID.

Endpoint

URL: /api/v1/repositories/{{DATASPACE}}/alerts/{{ID}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.DATASPACE	string	Required	Parameters for the Delete Alert by ID action
path_parameters.ID	string	Required	Parameters for the Delete Alert by ID action

Input Example

{"path_parameters":{"DATASPACE":"","ID":"hZuxvyEitdisEA06EqzEO52gCd8PO0OR"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Delete File for Cloud Users

Delete a specified file from all repositories in CrowdStrike Logscale for cloud users. Requires repository name and filename as path parameters.

Endpoint

URL: /api/v1/repositories/{{REPOSITORY_NAME}}/files/{{filename}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.REPOSITORY_NAME	string	Required	Parameters for the Delete File for Cloud Users action
path_parameters.filename	string	Required	Parameters for the Delete File for Cloud Users action

Input Example

{"path_parameters":{"REPOSITORY_NAME":"","filename":"myfile.csv"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Delete File on Premises Users

Delete a specified shared file for on-premises users in CrowdStrike Logscale. Requires the filename as a path parameter.

Endpoint

URL: /api/v1/uploadedfiles/shared/{{filename}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.filename	string	Required	Parameters for the Delete File on Premises Users action

Input Example

{"path_parameters":{"filename":"myfile.csv"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Delete Query Job by ID

Cancel a specific running query job in CrowdStrike Logscale using the repository name and job ID.

Endpoint

URL: /api/v1/repositories/{{REPOSITORY_NAME}}/queryjobs/{{ID}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.REPOSITORY_NAME	string	Required	Parameters for the Delete Query Job by ID action
path_parameters.ID	string	Required	Parameters for the Delete Query Job by ID action

Input Example

{"path_parameters":{"REPOSITORY_NAME":"","ID":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Execute Query

Execute a query in CrowdStrike Logscale using the specified repository name and query string.

Endpoint

URL: /api/v1/repositories/{{REPOSITORY_NAME}}/query

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.REPOSITORY_NAME	string	Required	Parameters for the Execute Query action
queryString	string	Optional	Parameter for Execute Query
start	string	Optional	Parameter for Execute Query
end	string	Optional	Parameter for Execute Query
isLive	boolean	Optional	Parameter for Execute Query
timeZoneOffsetMinutes	number	Optional	Parameter for Execute Query
arguments	object	Optional	Parameter for Execute Query

Input Example

{"json_body":{"queryString":"loglevel=ERROR","start":"1473449370018","end":"1473535816755","isLive":false,"timeZoneOffsetMinutes":60,"arguments":{}},"path_parameters":{"REPOSITORY_NAME":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Get Alert by ID

Retrieve detailed information for a specific alert in CrowdStrike Logscale using the provided DATASPACE and ID.

Endpoint

URL: /api/v1/repositories/{{DATASPACE}}/alerts/{{ID}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.DATASPACE	string	Required	Parameters for the Get Alert by ID action
path_parameters.ID	string	Required	Parameters for the Get Alert by ID action

Input Example

{"path_parameters":{"DATASPACE":"","ID":"hZuxvyEitdisEA06EqzEO52gCd8PO0OR"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Get Alerts

Retrieve a list of alerts from a specified DATASPACE in CrowdStrike Logscale.

Endpoint

URL: /api/v1/repositories/{{DATASPACE}}/alerts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.DATASPACE	string	Required	Parameters for the Get Alerts action

Input Example

{"path_parameters":{"DATASPACE":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Ingest Raw Data

Ingest raw data into CrowdStrike Logscale, typically used when callbacks from other systems control the request body. Requires data_body input.

Endpoint

URL: /api/v1/ingest/raw

Method: POST

Input

Argument Name	Type	Required	Description
data_body	string	Required	Response data

Input Example

{"data_body":"My raw Message generated at \"2016-06-06T12:00:00+02:00\""}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Ingest Raw Json Data

Ingest raw JSON formatted data into CrowdStrike Logscale for analysis. The 'data_body' input is required.

Endpoint

URL: /api/v1/ingest/json

Method: POST

Input

Argument Name	Type	Required	Description
data_body	string	Required	Response data

Input Example

{"data_body":"[\"first event\", \"second event\"]"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Ingest Structured Data

Ingest pre-structured data into CrowdStrike Logscale for analysis and storage. Requires a JSON body input.

Endpoint

URL: /api/v1/ingest/humio-structured

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Ingest Unstructured Data

Ingest unstructured log data into CrowdStrike Logscale for structured searching and analysis.

Endpoint

URL: /api/v1/ingest/humio-unstructured

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Initiate Search

Initiate a search in CrowdStrike Logscale using a specified query string and target a repository.

Endpoint

URL: /humio/api/v1/repositories/{{repository}}/queryjobs

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.repository	string	Required	Name of repository to be searched.
allowEventSkipping	boolean	Optional	If set to true, allowEventSkipping enables some LogScale functions, such as head() and tail(), to stop processing all data in the selected timeframe and exit the query early, if more data would no longer change the result of the query. The recommended setting for the value is true, as this can improve performance of the query in some cases. However, please note that some metadata may no longer have the same semantics as before - for example, events visited will no longer represent all matching events, but instead just the events visited for the query to finish.
arguments	object	Optional	Dictionary of arguments specified in queries with ?param or ?{param=defaultValue} syntax. Provided arguments must be a simple dictionary of string values. If an argument is given explicitly as in ?query(param=value) then that value overrides values provided here.
around	object	Optional	Used to define the pagination of events in the result set within the given query when using pagination. Used for cursor-based paginating of filter query result. This cannot be used with aggregate results as all rows are always returned. For more information see api-search-request-around.
around.eventId	string	Required	The ID of the event to use as the reference point.
around.timestamp	number	Required	The timestamp to use as the reference for pagination.
around.numberOfEventsBefore	number	Required	Number of events to show before the event ID.
around.numberOfEventsAfter	number	Required	Number of events to show after the event ID.
autobucketCount	number	Optional	Determines the number of buckets the system should create during live query searches, when no other explicit bucketing aggregate is specified (such as bucket(), timechart()). Higher autobucket counts means finer granularity, but at the cost of increased memory usage during search. Default value 90.
start	string	Optional	The start date and time. This parameter tells LogScale not to return results from before this date and time. See how to specify a time.
isLive	boolean	Optional	Sets whether this query is live. Defaults to false . Live queries are continuously updated.
end	string	Optional	The end date and time. This parameter tells LogScale not to return results from after this date and time. See how to specify a time.
queryString	string	Optional	The actual query. See Query Language Syntax for details.
ingestEnd	string	Optional	Specifies the end time based on when the data was ingested.
ingestStart	string	Optional	Specifies the start time based on when the data was ingested.
languageVersion	string	Optional	The version of the query language to use.
timeZoneOffsetMinutes	number	Optional	Set the time zone offset used for bucket() and timeChart() time slices, which is significant if the corresponding span is multiples of days. Defaults to 0 (UTC); positive numbers are to the east of UTC, so for UTC+01:00 timezone the value 60 should be passed.
isAlertQuery	boolean	Optional	Indicates whether the query comes from an alert or not.
isInteractive	boolean	Optional	Whether the search is being run interactively, i.e., from with the LogScale or another UI.
showQueryEventDistribution	boolean	Optional	If true LogScale will return an additional resultset containing a histogram of the number of events over the time interval. This field is deprecated. Use results instead. If both this field an results is specified, results takes precedence.
timeZone	string	Optional	The timezone to be used when returning dates.
useIngestTime	boolean	Optional	When set to true, uses the ingest time rather than event timestamp as the basis for the time span.

Input Example

{"json_body":{"allowEventSkipping":false,"arguments":{},"around":{"eventId":"","timestamp":0,"numberOfEventsBefore":100,"numberOfEventsAfter":100},"autobucketCount":0,"start":"1h","isLive":false,"end":"now","queryString":"count()","ingestEnd":"","ingestStart":"","languageVersion":"","timeZoneOffsetMinutes":0,"isAlertQuery":false,"isInteractive":false,"showQueryEventDistribution":false,"timeZone":"","useIngestTime":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
hashedQueryOnView	string	Output field: hashedQueryOnView
id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 23 Jan 2024 20:37:23 GMT"},"reason":"OK","json_body":{"hashedQueryOnView":"","id":""}}

Poll Query Job by ID

Poll the status of a running query job in CrowdStrike Logscale using the repository name and job ID.

Endpoint

URL: /api/v1/repositories/{{REPOSITORY_NAME}}/queryjobs/{{ID}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.REPOSITORY_NAME	string	Required	Parameters for the Poll Query Job by ID action
path_parameters.ID	string	Required	Parameters for the Poll Query Job by ID action

Input Example

{"path_parameters":{"REPOSITORY_NAME":"","ID":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Submit Graphql Query

Execute a specified GraphQL query within CrowdStrike Logscale to retrieve structured data.

Endpoint

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Update Alert by ID

Update a specific alert in CrowdStrike Logscale using the provided DATASPACE and ID as path parameters.

Endpoint

URL: /api/v1/repositories/{{DATASPACE}}/alerts/{{ID}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.DATASPACE	string	Required	Parameters for the Update Alert by ID action
path_parameters.ID	string	Required	Parameters for the Update Alert by ID action
name	string	Optional	Name of the resource
query	object	Optional	Parameter for Update Alert by ID
query.queryString	string	Optional	Parameter for Update Alert by ID
query.start	string	Optional	Parameter for Update Alert by ID
description	string	Optional	Parameter for Update Alert by ID
throttleTimeMillis	number	Optional	Parameter for Update Alert by ID
throttleField	string	Optional	Parameter for Update Alert by ID
silenced	boolean	Optional	Parameter for Update Alert by ID
notifiers	array	Optional	Parameter for Update Alert by ID
labels	array	Optional	Parameter for Update Alert by ID

Input Example

{"json_body":{"name":"different test","query":{"queryString":"foobar","start":"1h"},"description":"this is a test","throttleTimeMillis":600000,"throttleField":"server","silenced":false,"notifiers":["GrpMXUR2me8045Sz39qcsoWjXT3fJ7rT"],"labels":["test"]},"path_parameters":{"DATASPACE":"","ID":"hZuxvyEitdisEA06EqzEO52gCd8PO0OR"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Upload File to Repository

Upload a file to a specified CrowdStrike Logscale repository using the REPOSITORY_NAME path parameter.

Endpoint

URL: /api/v1/repositories/{{REPOSITORY_NAME}}/files

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.REPOSITORY_NAME	string	Required	Parameters for the Upload File to Repository action
attachments	array	Required	File to be uploaded
attachments.file	string	Optional	Parameter for Upload File to Repository
attachments.file_name	string	Optional	Name of the resource

Input Example

{"path_parameters":{"REPOSITORY_NAME":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Upload Shared File in all Repos

Upload a file to be shared across all repositories in CrowdStrike Logscale for on-premises users. Requires attachments.

Endpoint

URL: /api/v1/uploadedfiles/shared

Method: POST

Input

Argument Name	Type	Required	Description
attachments	array	Required	File to be uploaded
attachments.file	string	Optional	Parameter for Upload Shared File in all Repos
attachments.file_name	string	Optional	Name of the resource

Input Example

{"attachments":[{"file":"string","file_name":"Example Name"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 23 Jan 2024 20:37:23 GMT