Crowdstrike Next-Gen SIEM

The Crowdstrike Next-Gen SIEM connector allows for seamless integration with Swimlane Turbine, enabling automated security incident management and enhanced threat detection capabilities.

Crowdstrike Next-Gen SIEM is a cutting-edge security information and event management platform that provides comprehensive visibility and advanced analytics to detect and respond to threats. This connector enables Swimlane Turbine users to automate key incident response tasks such as adding alerts and events to cases, managing case tags, and initiating searches within Crowdstrike. By integrating with Crowdstrike Next-Gen SIEM, security teams can enhance their operational efficiency, reduce response times, and maintain a robust security posture through streamlined case management and evidence collection.

Limitations

None to date.

Supported Versions

This Crowdstrike Next-Gen SIEM connector uses the latest Version API.

Additional Documents

Documentation Click Here

Prerequisites

To effectively utilize the Crowdstrike Next-Gen SIEM connector with Swimlane Turbine, ensure you have the following prerequisites:

OAuth 2.0 client credentials for secure authentication, which include:

URL: The endpoint URL for the Crowdstrike Next-Gen SIEM API.

Client ID: Your unique identifier issued by Crowdstrike for API access.

Client Secret: A secret key provided by Crowdstrike to authenticate your Client ID.

Token URL: The specific URL provided by Crowdstrike to obtain an OAuth token.

Authentication Methods

Oauth 2.0 Client Credentials Authentication Method

OAuth 2.0 client credentials for secure authentication, which include:

URL: The endpoint URL for the Crowdstrike API.

Client ID: Your unique identifier to authenticate with the Crowdstrike API.

Client Secret: A confidential secret key used in conjunction with the Client ID to authenticate.

Token URL: The specific URL to obtain the OAuth 2.0 access token.

Capabilities

This Crowdstrike Next-Gen SIEM Connector provides the following capabilities:

Add Alerts to Existing Case

Add Event Evidence to Existing Case

Add Tags to an Existing Case

Create a New Case

Get Cases by IDs

Get Search Status

Initiate Search

List Cases

Remove Tags from an Existing Case

Stop Search

Update an Existing Case

Add Alerts to Existing Case

Add alerts as evidence to an existing case Click Here.

Add Event Evidence to Existing Case

Adds the given list of event evidence to the specified case Click Here.

Add Tags to an Existing Case

Adds the given list of tags to the specified case Click Here

Create a New Case

Creates the given Case Click Here

Get Cases by IDs

Retrieves all Cases given their IDs Click Here.

Get Search Status

Get status of search Click Here

Initiate Search

Initiate SearchClick Here.

List Cases

Retrieves all Cases IDs that match a given query Click Here.

Remove Tags from an Existing Case

Removes the specified tags from the specified case Click Here

Stop Search

Stop search Click Here.

Update an Existing Case

Updates given fields on the specified case Click Here.

Configurations

Crowdstrike Next Gen Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token_url		string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
scope	Permission scopes for this action.	array	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Alerts to Existing Case

Adds specified alerts as evidence to an existing case in Crowdstrike Next-Gen SIEM, requiring the case ID and alert details.

Endpoint

URL: /cases/entities/alert-evidence/v1

Method: POST

Input

Argument Name	Type	Required	Description
alerts	array	Optional	An array of objects representing the alerts to add to the case. Each object in the array identifies a single alert by its id.
alerts.id	string	Required	The unique identifier of the alert to add to the case. The alert id field expects the alert's composite_id value. When adding multiple alerts, each id must be provided as its own object in the array.
id	string	Optional	The system-level identifier of the case to add the alert to.

Input Example

{"json_body":{"alerts":[{"id":"abcDEfg0123456789HIJKLMNOPQRSTUV-WX:ngsiem:abcDEfg0123456789HIJKLMNOPQRSTUV-WX:e38579xxxxxxxxxxa05b5c"}],"id":"AAAAAAAAxxx-xx-XE7x9xxxxxxxxxxxxOqLnX-1DsXyxxxxxxxxxxxxxxxxxxxMgJc9-2uxxxxxO5_Z_PmxxxxxWR-yE1PwxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxkvGz9_BWxxxxxxxM9_lZxxxxxdy_NYxxxxxWw"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.access_tags	array	Output field: resources.access_tags
resources.access_tags.cid	string	Unique identifier
resources.access_tags.id	string	Unique identifier
resources.access_tags.key	string	Output field: resources.access_tags.key
resources.analysis_results	object	Result of the operation
resources.analysis_results.alerts	object	Result of the operation
resources.analysis_results.alerts.records	array	Result of the operation
resources.analysis_results.alerts.records.id	string	Unique identifier

Output Example

{"errors":[{"code":123,"id":"12345678-1234-1234-1234-123456789abc","message":"string"}],"meta":{"pagination":{"limit":123,"offset":123,"total":123},"powered_by":"string","query_time":123,"trace_id":"string","writes":{"resources_affected":123}},"resources":[{"access_tags":[],"analysis_results":{},"assigned_to":{},"cid":"string","consistency":{},"created_by":{},"created_timestamp":"string","description":"string","end_timestamp":"string","evidence":{},"fields":[],"id":"12345678-1234-1234-1234-12345...

Add Event Evidence to Existing Case

Adds a list of event evidence to an existing case in Crowdstrike Next-Gen SIEM using the case ID and events data.

Endpoint

URL: cases/entities/event-evidence/v1

Method: POST

Input

Argument Name	Type	Required	Description
events	array	Optional	An array of objects representing the events to add to the case. Each object in the array identifies a single event by its id.
events.id	string	Required	The unique ID of the event to add to the case. When adding multiple events, each id must be provided as its own object in the array.
id	string	Optional	The system-level identifier of the case to add the events to.

Input Example

{"json_body":{"events":[{"id":"abcDEfg0123456789HIJKLMNOPQRSTUV-WX:ngsiem:abcDEfg0123456789HIJKLMNOPQRSTUV-WX:e38579xxxxxxxxxxa05b5c"}],"id":"AAAAAAAAxxx-xx-XE7x9xxxxxxxxxxxxOqLnX-1DsXyxxxxxxxxxxxxxxxxxxxMgJc9-2uxxxxxO5_Z_PmxxxxxWR-yE1PwxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxkvGz9_BWxxxxxxxM9_lZxxxxxdy_NYxxxxxWw"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.access_tags	array	Output field: resources.access_tags
resources.access_tags.cid	string	Unique identifier
resources.access_tags.id	string	Unique identifier
resources.access_tags.key	string	Output field: resources.access_tags.key
resources.analysis_results	object	Result of the operation
resources.analysis_results.alerts	object	Result of the operation
resources.analysis_results.alerts.records	array	Result of the operation
resources.analysis_results.alerts.records.id	string	Unique identifier

Output Example

Add Tags to an Existing Case

Appends specified tags to an existing case in Crowdstrike Next-Gen SIEM using the case ID.

Endpoint

URL: cases/entities/case-tags/v1

Method: POST

Input

Argument Name	Type	Required	Description
id	string	Optional	The system-level identifier of the case to add the tags to.
tags	array	Optional	The list of tags to add to the case.

Input Example

{"json_body":{"id":"384759xxxxxxxxxxxxxxxxxxxx1234567890","tags":["test_tag1","test_tag2"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.access_tags	array	Output field: resources.access_tags
resources.access_tags.cid	string	Unique identifier
resources.access_tags.id	string	Unique identifier
resources.access_tags.key	string	Output field: resources.access_tags.key
resources.analysis_results	object	Result of the operation
resources.analysis_results.alerts	object	Result of the operation
resources.analysis_results.alerts.records	array	Result of the operation
resources.analysis_results.alerts.records.id	string	Unique identifier

Output Example

Create a New Case

Creates a new case in Crowdstrike Next-Gen SIEM with details such as assignment, description, evidence, name, severity, and status.

Endpoint

URL: /cases/entities/cases/v2

Method: PUT

Input

Argument Name	Type	Required	Description
access_tags	array	Optional	The access tags to add to the new case.
access_tags.cid	string	Optional	The CID of the Falcon user to add to the new case.
access_tags.id	string	Optional	The ID of the Falcon user to add to the new case.
access_tags.key	string	Optional	The key of the Falcon user to add to the new case.
assigned_to_user_uuid	string	Optional	The UUID of the Falcon user to assign the new case to. To get user UUIDs, see List user IDs in a CID.
description	string	Optional	A brief summary of the case. Any UTF-8 characters are supported. Maximum length 2048 bytes.
evidence	object	Optional	The alerts and events to add to the new case as evidence.
evidence.alerts	array	Required	The alerts to add to the new case.
evidence.alerts.id	string	Required	The unique identifier of the alert to add to the case. The alert id field expects the alert's composite_id value. Send each id as a separate object in the array.
evidence.events	array	Required	The events to add to the new case as evidence.
evidence.events.id	string	Required	The unique ID of the event to add to the case. Send each id as a separate object in the array.
evidence.leads	array	Required	Unique identifier
evidence.leads.id	string	Required	Unique identifier
name	string	Optional	A user-defined name for the case. Any UTF-8 characters are supported. Maximum length 256 bytes.
severity	number	Optional	The case severity rating on a numeric scale from 1 (least severe) to 100 (most severe). Numeric values correspond to the following string severity levels used for cases in the Falcon console and Case Management API - 1-19 informational, 20-39 low, 40-59 medium, 60-79 high, 80-100 critical.
severity_info	object	Optional	The severity level of the case.
severity_info.level	string	Required	Parameter for Create a New Case
status	string	Optional	The workflow state of the case. Possible values - new (default), closed, in_progress, reopened.
tags	array	Optional	The tags to add to the new case.
template	object	Optional	The template to apply when creating the case. Templates are created and managed with the Case Management API.
template.id	string	Required	The unique ID of the custom template to apply to the case. Templates are created using the Case Management API. For more info, see Template endpoints.

Input Example

{"json_body":{"access_tags":[{"cid":"abcDEfg0123456789HIJKLMNOPQRSTUV-WX","id":"4d759xxxxxxxxxxe417a","key":"manage"}],"assigned_to_user_uuid":"string","description":"Multiple unauthorized login attempts on host WINDOWS-2445.","evidence":{"alerts":[{"id":"abcDEfg0123456789HIJKLMNOPQRSTUV-WX:ngsiem:abcDEfg0123456789HIJKLMNOPQRSTUV-WX:e38579xxxxxxxxxxa05b5c"},{"id":"abcDEfg0123456789HIJKLMNOPQRSTUV-WX:ind:cb28a1xxxxxxxxxx49556f:252f50xxxxxxxxxx37f24c"}],"events":[{"id":"pbQ9xxxxxxxxxxxxxxxxxxxx_12_3_1755xxxxxx"},{"id":"D4s0xxxxxxxxxxxxxxxxxxxx_5_0_1755xxxxxx"}],"leads":[{"id":"string"}]},"name":"P1: Unauthorized Access","severity":90,"severity_info":{"level":"string"},"status":"new","tags":["unauthorized-access","P1"],"template":{"id":"4d759xxxxxxxxxxe417a"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.cid	string	Unique identifier
resources.reference_id	string	Unique identifier
resources.version	number	Output field: resources.version
resources.consistency	object	Output field: resources.consistency
resources.consistency.consistent	boolean	Output field: resources.consistency.consistent
resources.consistency.version	number	Output field: resources.consistency.version
resources.created_timestamp	string	Output field: resources.created_timestamp
resources.created_by	object	Output field: resources.created_by
resources.created_by.uuid	string	Unique identifier
resources.created_by.email	string	Output field: resources.created_by.email
resources.created_by.full_name	string	Name of the resource
resources.updated_timestamp	string	Output field: resources.updated_timestamp
resources.last_updated_by	object	Output field: resources.last_updated_by
resources.last_updated_by.uuid	string	Unique identifier
resources.last_updated_by.email	string	Output field: resources.last_updated_by.email

Output Example

{"meta":{"query_time":123,"writes":{"resources_affected":123},"powered_by":"string","trace_id":"string"},"resources":[{"id":"12345678-1234-1234-1234-123456789abc","cid":"string","reference_id":"string","version":123,"consistency":{},"created_timestamp":"string","created_by":{},"updated_timestamp":"string","last_updated_by":{},"start_timestamp":{},"end_timestamp":{},"name":"Example Name","description":"string","severity_info":{},"severity":123}]}

Get Cases by IDs

Retrieves all Crowdstrike Next-Gen SIEM cases for specified case IDs provided in the JSON body.

Endpoint

URL: /cases/entities/cases/v2

Method: POST

Input

Argument Name	Type	Required	Description
ids	array	Optional	A comma-separated list of system-level case id values to retrieve the details for.

Input Example

{"json_body":{"ids":["AAAAAAAAAxxx-xx-XE7x9xxxxxxxxxxxxOqLnX-1DsXyxxxxxxxxxxxxxxxxxxxMgJc9-2uxxxxxO5_Z_PmxxxxxWR-yE1PwxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxkvGz9_BWxxxxxxxM9_lZxxxxxdy_NYxxxxxWw"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.access_tags	array	Output field: resources.access_tags
resources.access_tags.cid	string	Unique identifier
resources.access_tags.id	string	Unique identifier
resources.access_tags.key	string	Output field: resources.access_tags.key
resources.analysis_results	object	Result of the operation
resources.analysis_results.alerts	object	Result of the operation
resources.analysis_results.alerts.records	array	Result of the operation
resources.analysis_results.alerts.records.id	string	Unique identifier

Output Example

Get Search Status

Retrieve the current status of a search in Crowdstrike Next-Gen SIEM using the specified repository and ID.

Endpoint

URL: humio/api/v1/repositories/{{repository}}/queryjobs/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.repository	string	Required	Name of repository
path_parameters.id	string	Required	ID of query.

Input Example

{"path_parameters":{"repository":"a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6","id":"search-384759xxxxxxxxxxxxxxxxxxxx1234567890"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cancelled	boolean	Output field: cancelled
done	boolean	Output field: done
events	array	Output field: events
events._bucket	string	Output field: events._bucket
events.event_simpleName	string	Name of the resource
events.FileName	string	Name of the resource
events.aid	string	Unique identifier
events.CommandLine	string	Output field: events.CommandLine
filesUsed	array	Output field: filesUsed
filterMatches	array	Output field: filterMatches
metaData	object	Response data
metaData.costs	object	Response data
metaData.costs.liveCost	number	Response data
metaData.costs.liveCostRate	number	Response data
metaData.costs.staticCost	number	Response data
metaData.costs.staticCostRate	number	Response data
metaData.digestFlow	object	Response data
metaData.digestFlow.ingestTimeKnownGood	number	Response data
metaData.digestFlow.maxIngestLatency	number	Response data
metaData.digestFlow.minIngestTimeIncluded	number	Response data
metaData.eventCount	number	Response data
metaData.fieldOrder	array	Response data
metaData.isAggregate	boolean	Response data

Output Example

{"cancelled":true,"done":true,"events":[{"_bucket":"string","event_simpleName":"Example Name","FileName":"Example Name","aid":"string","CommandLine":"string"}],"filesUsed":["string"],"filterMatches":[123],"metaData":{"costs":{"liveCost":123,"liveCostRate":123,"staticCost":123,"staticCostRate":123},"digestFlow":{"ingestTimeKnownGood":123,"maxIngestLatency":123,"minIngestTimeIncluded":123},"eventCount":123,"fieldOrder":["string"],"isAggregate":true,"pollAfter":123,"processedBytes":123,"processedEv...

Initiate Search

Initiates a search in Crowdstrike Next-Gen SIEM using a specified query string and repository.

Endpoint

URL: humio/api/v1/repositories/{{repository}}/queryjobs

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.repository	string	Required	The repository to initiate the search in.
allowEventSkipping	boolean	Optional	Enables some LogScale functions, such as head() and tail(), to stop processing all data in the selected timeframe and exit the query early.
arguments	object	Optional	JSON blob with parameters defined in query.
around	object	Optional	Event context for around-based queries with eventId, numberOfEventsAfter, numberOfEventsBefore, and timestamp.
around.eventId	string	Required	The event ID to center the search around.
around.numberOfEventsAfter	number	Required	The number of events to include after the specified event.
around.numberOfEventsBefore	number	Required	The number of events to include before the specified event.
around.timestamp	number	Required	The timestamp in milliseconds for the around query.
autobucketCount	number	Optional	The number of buckets the system should create during live query searches, when no other explicit bucketing aggregate is specified.
end	string	Optional	The date and time to use as the ending point of the search results.
ingestEnd	string	Optional	The end date and time applied for @ingesttimestamp.
ingestStart	string	Optional	The start date and time applied for @ingesttimestamp.
isLive	boolean	Optional	Sets whether this query is live. Defaults to false. Live queries are continuously updated.
queryString	string	Optional	The CQL query to use for the search.
start	string	Optional	The date and time to use as the starting point of the search results.
timeZone	string	Optional	The time zone to use if start and end times are not specified in milliseconds. Eg UTC.
timeZoneOffsetMinutes	number	Optional	A positive or negative number representing how many minutes a given time zone is ahead or behind Coordinated Universal Time (UTC).
useIngestTime	boolean	Optional	When set to true, the event's ingestStart and ingestEnd times are used as the basis for the query timespan rather than the start and end timestamps.

Input Example

{"json_body":{"allowEventSkipping":true,"arguments":{},"around":{"eventId":"evt-7b3c9d1e5f2a4b6c8d0e_12_3_1755123456","numberOfEventsAfter":50,"numberOfEventsBefore":50,"timestamp":1721289600000},"autobucketCount":100,"end":"2026-03-18T23:59:59.999Z","ingestEnd":"2026-03-18T23:59:59.999Z","ingestStart":"2026-03-18T00:00:00.000Z","isLive":true,"queryString":"event_simpleName=ProcessRollup2 AND FileName=*powershell*","start":"2026-03-18T00:00:00.000Z","timeZone":"America/New_York","timeZoneOffsetMinutes":-300,"useIngestTime":true},"path_parameters":{"repository":"a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
hashedQueryOnView	string	Output field: hashedQueryOnView
id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"hashedQueryOnView":"test_hash","id":"search-384759xxxxxxxxxxxxxxxxxxxx1234567890"}}

List Cases

Retrieves all Case IDs from Crowdstrike Next-Gen SIEM that match a specified query.

Endpoint

URL: cases/queries/cases/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	The maximum number of Cases to return in this response (default - 100; max - 10000). Use this parameter together with the offset parameter to manage pagination of the results.
parameters.offset	number	Optional	The first case to return, where 0 is the latest case. Use with the offset parameter to manage pagination of results.
parameters.filter	string	Optional	Filter Cases using a query in Falcon Query Language (FQL).

Filter fields can be any keyword field that is part of #domain.Case

An asterisk wildcard * includes all results.

Empty value means to not filter on anything.

Most commonly used filter fields that supports exact match: cid, id, etc.

Most commonly used filter fields that supports wildcard (*) - assigned_to_name, assigned_to_uuid...

Most commonly filter fields that supports range comparisons (>, <, >=, <=) - created_timestamp, updated_timestamp...

All filter fields and operations support negation (!). The full list of valid filter options is extensive. Review it in our documentation inside the Falcon console. | | parameters.sort | string | Optional | Sort parameter takes the form <field|direction>. Direction can be either asc (ascending) or desc (descending) order. For example - status|asc or status|desc. | | parameters.q | string | Optional | Search all Case metadata for the provided string. |

Input Example

{"parameters":{"limit":100,"offset":0,"filter":"cve.severity:['HIGH','CRITICAL']","sort":"status|asc","q":"test query"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.file_name	string	Name of the resource
resources.file	string	Output field: resources.file

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 18 Mar 2026 00:43:50 GMT","Content-Type":"application/json","Content-Length":"205","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","Vary":"Origin","X-Cs-Region":"us-1","X-Cs-Traceid":"2a8251e4-083a-4c47-8a96-38cdcb226605","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"reason":"OK","json_body":{"meta":{"query_t...

Remove Tags from an Existing Case

Removes specified tags from an existing case in Crowdstrike Next-Gen SIEM using the case ID.

Endpoint

URL: cases/entities/case-tags/v1

Method: DELETE

Input

Argument Name	Type	Required	Description
parameters.id	string	Required	The system-level identifier of the case to remove the specified tags from.
parameters.tag	string	Required	The tags to remove to the case. Send multiple tags

Input Example

{"parameters":{"id":"384759xxxxxxxxxxxxxxxxxxxx1234567890","tag":"test_tag1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.access_tags	array	Output field: resources.access_tags
resources.access_tags.cid	string	Unique identifier
resources.access_tags.id	string	Unique identifier
resources.access_tags.key	string	Output field: resources.access_tags.key
resources.analysis_results	object	Result of the operation
resources.analysis_results.alerts	object	Result of the operation
resources.analysis_results.alerts.records	array	Result of the operation
resources.analysis_results.alerts.records.id	string	Unique identifier

Output Example

Stop Search

Terminate an ongoing search in Crowdstrike Next-Gen SIEM using the specified repository and search ID.

Endpoint

URL: humio/api/v1/repositories/{{repository}}/queryjobs/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.repository	string	Required	Name of repository
path_parameters.id	string	Required	ID of query.

Input Example

{"path_parameters":{"repository":"a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6","id":"search-384759xxxxxxxxxxxxxxxxxxxx1234567890"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"humio-query-api","query_time":0.032,"trace_id":"tr-1n5q7s9t2u4v6w8x0y2z4a","writes":{}}}}

Update an Existing Case

Updates specified fields for an existing case in Crowdstrike Next-Gen SIEM using the case ID.

Endpoint

URL: /cases/entities/cases/v2

Method: PATCH

Input

Argument Name	Type	Required	Description
expected_consistency_version	number	Optional	The expected consistency version of the case.
expected_version	number	Optional	Parameter for Update an Existing Case
fields	object	Optional	The fields to update in the case.
fields.access_tags	array	Optional	Parameter for Update an Existing Case
fields.access_tags.cid	string	Optional	Unique identifier
fields.access_tags.id	string	Optional	Unique identifier
fields.access_tags.key	string	Optional	Parameter for Update an Existing Case
fields.assigned_to_user_uuid	string	Required	The UUID of the Falcon user to assign the case to, such as 00000000-0000-0000-0000-000000000000. To remove the current user assignment without assigning a new user, use the remove_user_assignment parameter.
fields.custom_fields	array	Required	Custom fields applied to a case through a template.
fields.custom_fields.id	string	Required	The ID of the custom field to update.
fields.custom_fields.values	array	Required	The custom field value.
fields.description	string	Required	The new case description.
fields.name	string	Required	The new case name.
fields.remove_user_assignment	boolean	Required	Remove the user currently assigned to the case. If set to true and assigned_to_user_uuid is not provided, the case becomes unassigned. If set to false and assigned_to_user_uuid is provided, the case is reassigned to the specified user UUID. If set to true and assigned_to_user_uuid is provided, the case is reassigned to the specified user UUID. If this field is omitted and assigned_to_user_uuid is provided, the case is reassigned to the specified user UUID.
fields.severity	number	Required	The new case severity rating on a numeric scale from 1 (least severe) to 100 (most severe). Numeric values correspond to the following string severity levels used for cases in the Falcon console and Case Management API - 1-19 informational, 20-39 low, 40-59 medium, 60-79 high, 80-100 critical.
fields.severity_info	object	Required	Parameter for Update an Existing Case
fields.severity_info.level	string	Required	Parameter for Update an Existing Case
fields.slas_active	boolean	Required	When specified, the status of the in-progress timer will be changed if appropriate.
fields.status	string	Required	The new case status.
fields.template	object	Optional	The template to apply to the case. This is only valid if no template has been applied to the case yet.
fields.template.id	string	Required	The unique ID of the template to apply to the case.
fields.workflows	array	Optional	Parameter for Update an Existing Case
fields.workflows.execution_id	string	Required	Unique identifier
fields.workflows.id	string	Required	Unique identifier
fields.workflows.name	string	Required	Name of the resource

Input Example

{"json_body":{"expected_consistency_version":0,"expected_version":0,"fields":{"access_tags":[{"cid":"abcDEfg0123456789HIJKLMNOPQRSTUV-WX","id":"4d759xxxxxxxxxxe417a","key":"manage"}],"assigned_to_user_uuid":"550e8400-e29b-41d4-a716-446655440001","custom_fields":[{"id":"field-1a2b3c4d5e6f","values":["P1"]}],"description":"Multiple unauthorized login attempts on host WINDOWS-2445.","name":"P1: Unauthorized Access","remove_user_assignment":true,"severity":90,"severity_info":{"level":"critical"},"slas_active":true,"status":"new","template":{"id":"4d759xxxxxxxxxxe417a"},"workflows":[{"execution_id":"wf-exec-7b3c9d1e5f2a","id":"wf-7b3c9d1e5f2a","name":"Critical Response SLA","status":"in_progress"}]},"id":"AAAAAAAAAxxx-xx-XE7x9xxxxxxxxxxxxOqLnX-1DsXyxxxxxxxxxxxxxxxxxxxMgJc9-2uxxxxxO5_Z_PmxxxxxWR-yE1PwxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxkvGz9_BWxxxxxxxM9_lZxxxxxdy_NYxxxxxWw"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.access_tags	array	Output field: resources.access_tags
resources.access_tags.cid	string	Unique identifier
resources.access_tags.id	string	Unique identifier
resources.access_tags.key	string	Output field: resources.access_tags.key
resources.analysis_results	object	Result of the operation
resources.analysis_results.alerts	object	Result of the operation
resources.analysis_results.alerts.records	array	Result of the operation
resources.analysis_results.alerts.records.id	string	Unique identifier

Output Example

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	205
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 18 Mar 2026 00:43:50 GMT
Server	Information about the software used by the origin server	nginx
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
Vary	HTTP response header: Vary	Origin
X-Cs-Region	HTTP response header: X-Cs-Region	us-1
X-Cs-Traceid	HTTP response header: X-Cs-Traceid	2a8251e4-083a-4c47-8a96-38cdcb226605
X-Ratelimit-Limit	The number of requests allowed in the current rate limit window	6000
X-Ratelimit-Remaining	The number of requests remaining in the current rate limit window	5998