What is CrowdStrike? #

How to Sync CrowdStrike Data with CloudQuery #

1. Generate new Client Credentials: Navigate to the CrowdStrike's UI. From the left menu bar, go to Support and Resources > API Clients and Keys > Create API Client, and select all Read scopes. Save the credentials securely, as they will be needed later.
2. Install CloudQuery CLI: Download and install the CloudQuery CLI on your machine by following the steps on our download page.
3. Set Up the Sync Configuration: Create a CloudQuery configuration file by running the following init command:

   cloudquery init --source=crowdstrike --destination=postgresql

   This command will create a crowdstrike_to_postgresql.yaml file in your current directory.
4. Update Environment Variables: Set the environment variables CROWDSTRIKE_CLIENT_ID and CROWDSTRIKE_CLIENT_SECRET using the corresponding values from the credentials obtained in the first step:

   export CROWDSTRIKE_CLIENT_ID="YOUR_CROWDSTRIKE_CLIENT_ID"
   export CROWDSTRIKE_CLIENT_SECRET="YOUR_CROWDSTRIKE_CLIENT_SECRET"

5. Login to CloudQuery: Log into the CloudQuery Platform using:

cloudquery login

1. Sync with CloudQuery: Run the command below to begin syncing:

   cloudquery sync crowdstrike_to_postgresql.yaml

Example Queries #

select *
from crowdstrike_hosts
where platform_name = 'Mac';

select *
from crowdstrike_alerts
where confidence >= 60
  and 'Endpoint' = ANY(data_domains);

select *
from crowdstrike_host_zta_assessments
where exists (
    select 1
    from jsonb_array_elements(assessment_items->'os_signals') as os_signal
    where os_signal->>'criteria' ilike 'macos version is ≥11.0'
      and os_signal->>'meets_criteria' = 'yes'
);