Skip to content

crowdstrike: add support for http proxy configuration #15880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Nov 12, 2025
+43 −1
Merged

crowdstrike: add support for http proxy configuration #15880

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c07fd81
crowdstrike: add support for http proxy configuration for Event Strea…
navnit-elastic Nov 6, 2025
51e43c0
clarify input name in changelog
navnit-elastic Nov 6, 2025
3d5b806
add proxy headers configuration
navnit-elastic Nov 7, 2025
d23c43a
add proxy headers configuration for CEL
navnit-elastic Nov 10, 2025
941ec56
update changelog description
navnit-elastic Nov 10, 2025
1d0c46a
Merge branch 'main' into crowdstrike-event-streams-proxy
navnit-elastic Nov 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/crowdstrike/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.7.0"
changes:
- description: Add support for HTTP proxy configuration for Event Streams.
type: enhancement
link: https://github.com/elastic/integrations/pull/15880
- version: "2.6.0"
changes:
- description: Add a fallback parsing command_line to populate the process name in the FDR data stream.
Expand Down
3 changes: 3 additions & 0 deletions packages/crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ resource.tracer:
{{#if proxy_url}}
resource.proxy_url: {{proxy_url}}
{{/if}}
{{#if proxy_headers}}
resource.proxy_headers: {{proxy_headers}}
{{/if}}
{{#if ssl}}
resource.ssl: {{ssl}}
{{/if}}
Expand Down
6 changes: 6 additions & 0 deletions packages/crowdstrike/data_stream/falcon/agent/stream/streaming.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ auth:
client_secret: {{client_secret}}
token_url: {{token_url}}
crowdstrike_app_id: {{app_id}}
{{#if proxy_url}}
proxy_url: {{proxy_url}}
{{/if}}
{{#if proxy_headers}}
proxy_headers: {{proxy_headers}}
{{/if}}
redact:
fields: ~
program: |
Expand Down
3 changes: 3 additions & 0 deletions packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ resource.tracer:
{{#if proxy_url}}
resource.proxy_url: {{proxy_url}}
{{/if}}
{{#if proxy_headers}}
resource.proxy_headers: {{proxy_headers}}
{{/if}}
{{#if ssl}}
resource.ssl: {{ssl}}
{{/if}}
Expand Down
3 changes: 3 additions & 0 deletions packages/crowdstrike/data_stream/vulnerability/agent/stream/cel.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ resource.tracer:
{{#if proxy_url}}
resource.proxy_url: {{proxy_url}}
{{/if}}
{{#if proxy_headers}}
resource.proxy_headers: {{proxy_headers}}
{{/if}}
{{#if ssl}}
resource.ssl: {{ssl}}
{{/if}}
Expand Down
24 changes: 23 additions & 1 deletion packages/crowdstrike/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: crowdstrike
title: CrowdStrike
version: "2.6.0"
version: "2.7.0"
description: Collect logs from Crowdstrike with Elastic Agent.
type: integration
format_version: "3.4.0"
Expand Down Expand Up @@ -68,6 +68,21 @@ policy_templates:
- type: streaming
title: Collect CrowdStrike Falcon Logs via Event Stream
description: Collecting CrowdStrike Falcon Logs via Event Stream.
vars:
- name: proxy_url
Copy link
Contributor

@kcreddy kcreddy Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add proxy_headers

Copy link
Contributor Author

@navnit-elastic navnit-elastic Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was referring to the recent PRs and was wondering why we don't add headers configuration along with the URL.

Copy link
Member

@andrewkroh andrewkroh Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do the other input types used throughout the Crowdstrike package also support proxy_headers (aws-s3, cel)? If so, then the other data streams' *.yml.hbs files should be updated to use proxy_headers.

Copy link
Contributor Author

@navnit-elastic navnit-elastic Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh - added proxy_headers option for CEL in d23c43a.
The aws-s3 input doesn't mention support for it.

Copy link
Contributor

@kcreddy kcreddy Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@navnit-elastic, please update PR title and changelog accordingly.

type: text
title: Proxy URL
multi: false
required: false
show_user: false
description: URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Ensure your username and password are in URL encoded format.
- name: proxy_headers
type: yaml
title: Proxy headers
multi: false
required: false
show_user: false
description: This specifies the headers to be sent to the proxy server.
- type: cel
title: Collect CrowdStrike logs via API
description: Collecting CrowdStrike logs via API.
Expand Down Expand Up @@ -108,6 +123,13 @@ policy_templates:
required: false
show_user: false
description: URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.
- name: proxy_headers
type: yaml
title: Proxy headers
multi: false
required: false
show_user: false
description: This specifies the headers to be sent to the proxy server.
- name: ssl
type: yaml
title: SSL Configuration
Expand Down