🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createFdrFeed() mutation creates a Falcon Data Replicator (FDR) feed for a LogScale repository. FDR delivers CrowdStrike sensor telemetry to an AWS S3 bucket and uses an SQS queue to notify consumers when new data is available. This mutation registers the feed configuration — including the CrowdStrike API credentials, SQS queue URL, S3 identifier, and parser — in the target repository. Set enabled to true to begin ingest immediately, or omit it to create the feed in a disabled state and activate it after verification with testFdrFeed(). After creating the feed, use updateFdrFeedControl() to configure performance settings such as maximum node count and download parallelism.

Syntax

graphql
createFdrFeed(
      input: CreateFdrFeed!
   ): FdrFeed!

The mutation accepts a single required input argument of type CreateFdrFeed. All connection credentials, queue configuration, and parser assignment are nested within this input object. The Input Parameters section describes each field.

The mutation returns a non-null FdrFeed object representing the newly created feed. Request the id field to obtain the feed identifier needed by subsequent management mutations. The parserId field always returns the internal parser identifier, even if you supplied a parser name in the input. The Returned Values section describes all available fields.

Example

Raw
graphql
mutation {
  createFdrFeed(input:
         {name: "my-fdr-feed",
          repositoryName: "humio",
          parser: "humio",
          clientId: "1234",
          clientSecret: "psst",
          sqsUrl: "https://fdr.company.com",
          s3Identifier: "xxxx",
          enabled: false
        }
    )
  { id, name, enabled }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createFdrFeed(input:
         {name: \"my-fdr-feed\",
          repositoryName: \"humio\",
          parser: \"humio\",
          clientId: \"1234\",
          clientSecret: \"psst\",
          sqsUrl: \"https://fdr.company.com\",
          s3Identifier: \"xxxx\",
          enabled: false
        }
    )
  { id, name, enabled }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createFdrFeed(input:
         {name: \"my-fdr-feed\",
          repositoryName: \"humio\",
          parser: \"humio\",
          clientId: \"1234\",
          clientSecret: \"psst\",
          sqsUrl: \"https://fdr.company.com\",
          s3Identifier: \"xxxx\",
          enabled: false
        }
    )
  { id, name, enabled }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createFdrFeed(input: ^
         {name: \"my-fdr-feed\", ^
          repositoryName: \"humio\", ^
          parser: \"humio\", ^
          clientId: \"1234\", ^
          clientSecret: \"psst\", ^
          sqsUrl: \"https://fdr.company.com\", ^
          s3Identifier: \"xxxx\", ^
          enabled: false ^
        } ^
    ) ^
  { id, name, enabled } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createFdrFeed(input:
         {name: \"my-fdr-feed\",
          repositoryName: \"humio\",
          parser: \"humio\",
          clientId: \"1234\",
          clientSecret: \"psst\",
          sqsUrl: \"https://fdr.company.com\",
          s3Identifier: \"xxxx\",
          enabled: false
        }
    )
  { id, name, enabled }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createFdrFeed(input:
         {name: \"my-fdr-feed\",
          repositoryName: \"humio\",
          parser: \"humio\",
          clientId: \"1234\",
          clientSecret: \"psst\",
          sqsUrl: \"https://fdr.company.com\",
          s3Identifier: \"xxxx\",
          enabled: false
        }
    )
  { id, name, enabled }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createFdrFeed(input:
         {name: \"my-fdr-feed\",
          repositoryName: \"humio\",
          parser: \"humio\",
          clientId: \"1234\",
          clientSecret: \"psst\",
          sqsUrl: \"https://fdr.company.com\",
          s3Identifier: \"xxxx\",
          enabled: false
        }
    )
  { id, name, enabled }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createFdrFeed(input:
         {name: \"my-fdr-feed\",
          repositoryName: \"humio\",
          parser: \"humio\",
          clientId: \"1234\",
          clientSecret: \"psst\",
          sqsUrl: \"https://fdr.company.com\",
          s3Identifier: \"xxxx\",
          enabled: false
        }
    )
  { id, name, enabled }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

Provide the target repository name, feed name, CrowdStrike API credentials, SQS queue URL, S3 identifier, and parser. The clientId and clientSecret fields are the CrowdStrike API credentials that authenticate access to the FDR S3 bucket and SQS queue. The sqsUrl is the SQS queue URL that receives delivery notifications when new FDR data arrives in S3; s3Identifier identifies the corresponding S3 source within the FDR delivery bucket. The parser field accepts either a parser ID or name; CrowdStrike recommends the crowdstrike/fdr:FDR parser from the crowdstrike/fdr package. The enabled field controls whether LogScale actively polls the SQS queue; omitting it creates the feed in a disabled state. The following table describes all input fields:

Table: CreateFdrFeed Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
clientIdStringyes Long-Term The AWS client identifier of the FDR feed.
clientSecretStringyes Long-Term The AWS client secret of the FDR feed.
descriptionString  Long-Term A description of the FDR feed.
enabledBoolean  Long-Term Whether ingest from the FDR feed is enabled.
nameStringyes Long-Term The name of the FDR feed.
parserStringyes Long-Term The unique identifier or name of the parser that should be used to parse the FDR data. We recommend using the FDR parser from the crowdstrike/fdr package, which can be referred to as crowdstrike/fdr:FDR.
repositoryNameStringyes Long-Term The name of the repository of the FDR feed.
s3IdentifierStringyes Long-Term The AWS S3 identifier of the FDR feed.
sqsUrlStringyes Long-Term The AWS SQS queue URL of the FDR feed.

Returned Values

The mutation returns the newly created FdrFeed object. Request id to obtain the unique identifier assigned to the new feed; use this identifier with updateFdrFeed(), updateFdrFeedControl(), and deleteFdrFeed(). The parserId field returns the internal parser identifier, resolved from the name or ID you supplied in the input. The clientId field returns the credential identifier used for authentication; the client secret is not returned. The enabled field reflects the current ingest state of the feed.

Table: FdrFeed Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
clientIdStringyes Long-Term The AWS client identifier of the FDR feed.
descriptionString  Long-Term A description of the FDR feed.
enabledBooleanyes Long-Term Whether ingest from the FDR feed is enabled.
idStringyes Long-Term Unique identifier of the FDR feed.
nameStringyes Long-Term Name of the FDR feed.
parserIdStringyes Long-Term The unique identifier of the parser that is used to parse the FDR data.
s3IdentifierStringyes Long-Term The AWS S3 identifier of the FDR feed.
sqsUrlStringyes Long-Term The AWS SQS queue URL of the FDR feed.