Skip to main content

​
Background​

The Run Crowdstrike Cloud Query Action performs Steampipe queries on CrowdStrike resources with a powerful and simple PostgreSQL syntax. For example, a complicated action such as fetching all of your hosts: 
select    instance_id,    hostname,    last_login_timestampfrom    crowdstrike_host;
To list hosts which do not have firewall applied, use the following query: 
select    hostname,    device_policiesfrom    crowdstrike_hostwhere    (device_policies -> 'firewall' -> 'applied') :: bool = false;
A query that fetches a list of open detections from the last 4 days might look like this: 
select    detection_id,    created_timestamp,    device ->> 'device_id' as device_id,    device ->> 'hostname' as hostname,    device ->> 'platform_name' as platform_name,    device ->> 'os_version' as os_version,    statusfrom    crowdstrike_detectionwhere    status = 'open'  and now() - created_timestamp > interval '4 days';
A full description of all existing tables and official examples are provided here:
Blink supports this Steampipe version: v0.2.0.

​
Action Parameters​

ParameterDescription
SQL statementThe SQL statement we wish to use to query the resource.
Output formatRepresentation of the output result. The possible options are “Table”, “CSV” or “JSON”.
RunAWSCloudQuery