Falcon LogScale Repository
The Falcon LogScale Repository action sends events from a trigger to a LogScale repository. This can be used to summarize all such events, or to aggregate information from multiple triggers.
Parameter | Description |
---|---|
Ingest token | An Ingest Tokens for the repository receiving the events. |
The events from the trigger are parsed and ingested using the ingest token. If the ingest token has an associated parser, it is used, otherwise, the built-in-parser json-for-action is used.
The events sent to the parser contain the following fields:
Field | Value |
---|---|
@trigger.id
| The id of the trigger. |
@trigger.name
| The user-made name of the trigger. |
@trigger.description
| The user-made description of the trigger. |
@trigger.type
|
The type of the trigger. Either
alert or
scheduled-search .
|
@trigger.query.start
| The query start time (e.g. 10m). |
@trigger.query.end
| The query end time (e.g. now). |
@trigger.invocation.triggeredAt
| The time at which the trigger was triggered, formatted as ISO 8601. |
@trigger.invocation.uuid
| A unique id for an invocation of the trigger. Can be used to identify events from the same invocation of the trigger. |
@trigger.invocation.start
| The actual query start time as Unix Time in milliseconds. |
@trigger.invocation.end
| The actual query end time as Unix Time in milliseconds. |
@trigger.repository.name
| The name of the repository in which the trigger is defined. |
@rawstring |
The original event from the trigger, encoded as JSON. A prefix
# character in a field
name is replaced by @tag .,
so that e.g. #source becomes
@tag.source .
|
The default json-for-action
parser will extract the original event from the
@rawstring field, so that the parsed event contains
all the original fields together with all the
@trigger.XXX
fields. It will not
parse any timestamps, so if the original event does not contain a
@timestamp field, the event will get "now" as
timestamp.
The events you send through this action count towards the daily ingest limit.