🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateFdrFeed() mutation updates the configuration of an existing FDR (Falcon Data Replicator) ingest feed. Provide id and repositoryName to identify the feed, then include only the fields you want to change.

Syntax

graphql
updateFdrFeed(
      input: UpdateFdrFeed!
   ): FdrFeed!

The mutation requires an input argument of type UpdateFdrFeed!. The id and repositoryName fields are required. All other fields are optional; omit any field you do not want to change. The mutation returns an FdrFeed! object representing the updated feed.

The returned FdrFeed! type exposes the feed identifier, name, description, enabled state, AWS connection details, and the parser identifier.

Input parameters

Provide id and repositoryName to identify the feed. Include only the fields you want to update. To retrieve the feed identifier, use the repository() query shown in the Related section.

Table: UpdateFdrFeed Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
clientIdString  Long-Term The AWS client unique identifier of the FDR feed.
clientSecretString  Long-Term The AWS client secret for the FDR feed.
descriptionUpdateDescription  Long-Term The description of the FDR feed. See UpdateDescription.
enabledBoolean  Long-Term Whether ingest from the FDR feed is enabled.
idStringyes Long-Term The unique identifier of the FDR feed.
nameString  Long-Term The name of the FDR feed.
parserString  Long-Term The unique identifier or name of the parser that should be used to parse the FDR data. Use the FDR parser from the crowdstrike/fdr package, which can be referred to as \"crowdstrike/fdr:FDR\".
repositoryNameStringyes Long-Term The name of the repository of the FDR feed.
s3IdentifierString  Long-Term The AWS S3 identifier of the FDR feed.
sqsUrlString  Long-Term The AWS SQS queue URL of the FDR feed.

Example

Raw
graphql
mutation {
  updateFdrFeed( input:
     { repositoryName: "humio",
       id: "abc123",
       enabled: true
     } 
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateFdrFeed( input:
     { repositoryName: \"humio\",
       id: \"abc123\",
       enabled: true
     } 
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateFdrFeed( input:
     { repositoryName: \"humio\",
       id: \"abc123\",
       enabled: true
     } 
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateFdrFeed( input: ^
     { repositoryName: \"humio\", ^
       id: \"abc123\", ^
       enabled: true ^
     }  ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateFdrFeed( input:
     { repositoryName: \"humio\",
       id: \"abc123\",
       enabled: true
     } 
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateFdrFeed( input:
     { repositoryName: \"humio\",
       id: \"abc123\",
       enabled: true
     } 
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateFdrFeed( input:
     { repositoryName: \"humio\",
       id: \"abc123\",
       enabled: true
     } 
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateFdrFeed( input:
     { repositoryName: \"humio\",
       id: \"abc123\",
       enabled: true
     } 
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateFdrFeed": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns an FdrFeed! object describing the updated feed. The returned fields include the feed identifier, name, description, enabled state, AWS SQS URL, S3 identifier, client identifier, and parser identifier. Request id to confirm the update, or request the full field set to inspect the updated configuration.

Table: FdrFeed Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
clientIdStringyes Long-Term The AWS client identifier of the FDR feed.
descriptionString  Long-Term A description of the FDR feed.
enabledBooleanyes Long-Term Whether ingest from the FDR feed is enabled.
idStringyes Long-Term Unique identifier of the FDR feed.
nameStringyes Long-Term Name of the FDR feed.
parserIdStringyes Long-Term The unique identifier of the parser that is used to parse the FDR data.
s3IdentifierStringyes Long-Term The AWS S3 identifier of the FDR feed.
sqsUrlStringyes Long-Term The AWS SQS queue URL of the FDR feed.