crowdstrike: provide alternate endpoint to query host data for GovCloud CIDs #16007

navnit-elastic · 2025-11-18T05:59:06Z

Proposed commit message

crowdstrike: provide alternate endpoint to query host data for GovCloud CIDs

This change adds a toggle in the host data stream manifest
to switch between two different device endpoints to query host data.

The "/devices/combined/devices/v1" endpoint is not supported in GovCloud CIDs,
which was introduced in this PR[1]. This impacted GovCloud users to encounter errors
when enabling the host data stream.

This change provides an option for GovCloud users to query an alternate endpoint,
"/devices/entities/devices/v2".

If the GovCloud flag is disabled, the CEL program inspects the base URL to infer
whether the integration is pointed at a GovCloud environment. If the
URL matches a known GovCloud domain, the integration avoids calling the unsupported
combined endpoint and instead uses "/devices/entities/devices/v2".

[1] https://github.com/elastic/integrations/pull/15419

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

System Tests:

--- Test results for package: crowdstrike - START ---
╭─────────────┬─────────────┬───────────┬─────────────┬────────┬───────────────╮
│ PACKAGE     │ DATA STREAM │ TEST TYPE │ TEST NAME   │ RESULT │  TIME ELAPSED │
├─────────────┼─────────────┼───────────┼─────────────┼────────┼───────────────┤
│ crowdstrike │ host        │ system    │ common      │ PASS   │ 44.078286575s │
│ crowdstrike │ host        │ system    │ govcloud    │ PASS   │ 44.100005811s │
│ crowdstrike │ host        │ system    │ govcloudurl │ PASS   │ 44.272329058s │
╰─────────────┴─────────────┴───────────┴─────────────┴────────┴───────────────╯
--- Test results for package: crowdstrike - END   ---
Done

Related issues

Closes [Crowdstrike] - "combined/devices" API endpoint is only available in Crowdstrike Commercial Cloud CID's #15795

Screenshots

screencapture-localhost-5602-app-fleet-integrations-crowdstrike-2-8-1-add-integration-2025-11-19-15_49_47

…Cloud CIDs

elastic-vault-github-plugin-prod · 2025-11-18T06:54:36Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

packages/crowdstrike/data_stream/host/manifest.yml

packages/crowdstrike/_dev/build/docs/README.md

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

packages/crowdstrike/changelog.yml

elasticmachine · 2025-11-19T08:07:02Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy

@navnit-elastic, can you add screenshot how the new option would show to the users?
cc: @narph

navnit-elastic · 2025-11-19T10:22:43Z

@navnit-elastic, can you add screenshot how the new option would show to the users? cc: @narph

@kcreddy - added it in the commit message.

elasticmachine · 2025-11-19T12:21:58Z

💚 Build Succeeded

Buildkite Build
Commit: fb41790

History

💔 Build #34353 failed 2ff00cf
💚 Build #34346 succeeded 5f9980f
💚 Build #34278 succeeded 02f68d7
💔 Build #34274 failed 35f356f

cc @navnit-elastic

efd6 · 2025-11-20T01:09:50Z

packages/crowdstrike/changelog.yml

+- version: "2.8.1"
+  changes:
+    - description: Provide an alternate endpoint to query host data for GovCloud CIDs.
+      type: bugfix


I think this is an enhancement. This is an additional feature, not a fix for an incorrect behaviour.

efd6 · 2025-11-20T01:17:46Z

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

-          (size(body.?errors.orValue([])) > 0) ?
-            {
-              "events": body.errors.map(error,
+  // This logic determines which CrowdStrike devices endpoint to call. The


If we can automagically determine the correct behaviour from the URL, why are we adding a configuration toggle? Is it the case that the known URLs are not an exhaustive enumeration of all GovCloud base URLs?

I personally feel we should not even try to switch the request flow based on url parsing as it obfuscates the control flow and undermines the entire presence of the toggle

Agree. We should do one or the other. If we can always determine the correct behaviour from the URL, we should do that, if it is less than always, we should not even try and just use a configuration.

The approach was discussed in #15795 and since there was no alternate proposals, this was taken up. I can see that the URL check will give us correct behaviour all the time until a new GovCloud URL is launched by Crowdstrike, in such case a toggle can help quicken the SDH resolution.
I do agree that having both might be confusing and reduces each other's efficacy.

If there's a chance that new GovCloud URLs can be launched in future, I feel it's best to just stick to a toggle based approach for clarity purposes. When a failure occurs (if the toggle in not configured), it would be a clear signal to indicate the real issue in every case. Also it's easier for support to resolve without creating a SDH if the behaviour is singular and known in advance. A dual mechanism, though efficient and less intrusive can obfuscate the behaviour and lead to confusion in some scenarios down the line.

efd6 · 2025-11-20T01:18:11Z

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

+  // This dual-check mechanism ensures that GovCloud users do not encounter errors
+  // even if they forget to enable the "gov_cloud" flag in the manifest.


I'm not convinced of the value of this convenience.

efd6 · 2025-11-20T01:18:39Z

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

+  // This dual-check mechanism ensures that GovCloud users do not encounter errors
+  // even if they forget to enable the "gov_cloud" flag in the manifest.
+  (
+    state.gov_cloud || state.url.trim_right("/") in ["https://api.laggar.gcw.crowdstrike.com", "https://api.us-gov-2.crowdstrike.mil"] ?


Add a comment saying that this is the GovCloud branch.

(this is a long program, so some navigation aids will be helpful)

efd6 · 2025-11-20T01:19:04Z

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

+        )
+      )
+    :
+      state.with(


Add comment that this is the non-GovCloud branch.

efd6 · 2025-11-20T01:20:18Z

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

+                "error": {
+                  "code": string(get_resp.StatusCode),
+                  "id": string(get_resp.Status),
+                  "message": "GET:" + (


Suggested change

"message": "GET:" + (

"message": "GET: " + (

efd6 · 2025-11-20T01:20:29Z

packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs

+                    "error": {
+                      "code": string(post_resp.StatusCode),
+                      "id": string(post_resp.Status),
+                      "message": "POST:" + (


Suggested change

"message": "POST:" + (

"message": "POST: " + (

ShourieG · 2025-11-20T09:18:26Z

packages/crowdstrike/data_stream/host/manifest.yml

+        type: bool
+        title: GovCloud
+        description: >-
+          GovCloud CIDs should enable this. When enabled, the integration will automatically use CrowdStrike’s GovCloud-supported devices endpoint (`/devices/entities/devices/v2`) instead of the standard combined endpoint (`/devices/combined/devices/v1`).


Suggested change

GovCloud CIDs should enable this. When enabled, the integration will automatically use CrowdStrike’s GovCloud-supported devices endpoint (`/devices/entities/devices/v2`) instead of the standard combined endpoint (`/devices/combined/devices/v1`).

GovCloud CIDs should enable this. When enabled, the integration will use CrowdStrike’s GovCloud-supported devices endpoint (`/devices/entities/devices/v2`) instead of the standard combined endpoint (`/devices/combined/devices/v1`).

If we are enabling the toggle, then it's no longer automatic. As for the dual safety mechanism, it undermines the presence of the toggle.

crowdstrike: provide an alternate endpoint to query host data for Gov…

35f356f

…Cloud CIDs

navnit-elastic self-assigned this Nov 18, 2025

navnit-elastic mentioned this pull request Nov 18, 2025

[Crowdstrike] - "combined/devices" API endpoint is only available in Crowdstrike Commercial Cloud CID's #15795

Open

regenerate policy tests

02f68d7

kcreddy reviewed Nov 18, 2025

View reviewed changes

navnit-elastic added 2 commits November 19, 2025 11:31

address pr comments

5f9980f

add system test for govcloud url

2ff00cf

navnit-elastic marked this pull request as ready for review November 19, 2025 08:06

navnit-elastic requested a review from a team as a code owner November 19, 2025 08:07

kcreddy reviewed Nov 19, 2025

View reviewed changes

regenerate readme

fb41790

efd6 reviewed Nov 20, 2025

View reviewed changes

ShourieG reviewed Nov 20, 2025

View reviewed changes

		// This dual-check mechanism ensures that GovCloud users do not encounter errors
		// even if they forget to enable the "gov_cloud" flag in the manifest.

	GovCloud CIDs should enable this. When enabled, the integration will automatically use CrowdStrike’s GovCloud-supported devices endpoint (`/devices/entities/devices/v2`) instead of the standard combined endpoint (`/devices/combined/devices/v1`).
	GovCloud CIDs should enable this. When enabled, the integration will use CrowdStrike’s GovCloud-supported devices endpoint (`/devices/entities/devices/v2`) instead of the standard combined endpoint (`/devices/combined/devices/v1`).

crowdstrike: provide alternate endpoint to query host data for GovCloud CIDs #16007

Are you sure you want to change the base?

crowdstrike: provide alternate endpoint to query host data for GovCloud CIDs #16007

Uh oh!

Conversation

navnit-elastic commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elastic-vault-github-plugin-prod bot commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Nov 19, 2025

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

navnit-elastic commented Nov 19, 2025

Uh oh!

elasticmachine commented Nov 19, 2025

💚 Build Succeeded

History

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ShourieG Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ShourieG Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ShourieG Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

navnit-elastic commented Nov 18, 2025 •

edited

Loading

elastic-vault-github-plugin-prod bot commented Nov 18, 2025 •

edited

Loading

ShourieG Nov 20, 2025 •

edited

Loading

ShourieG Nov 21, 2025 •

edited

Loading

ShourieG Nov 20, 2025 •

edited

Loading