​
Background​

The Run Crowdstrike Cloud Query Action performs Steampipe queries on CrowdStrike resources with a powerful and simple PostgreSQL syntax.

For example, a complicated action such as fetching all of your hosts:

select    instance_id,    hostname,    last_login_timestampfrom    crowdstrike_host;

To list hosts which do not have firewall applied, use the following query:

select    hostname,    device_policiesfrom    crowdstrike_hostwhere    (device_policies -> 'firewall' -> 'applied') :: bool = false;

A query that fetches a list of open detections from the last 4 days might look like this:

select    detection_id,    created_timestamp,    device ->> 'device_id' as device_id,    device ->> 'hostname' as hostname,    device ->> 'platform_name' as platform_name,    device ->> 'os_version' as os_version,    statusfrom    crowdstrike_detectionwhere    status = 'open'  and now() - created_timestamp > interval '4 days';

A full description of all existing tables and official examples are provided here:

Blink’s supported Steampipe version is: v0.2.0.

​
Action Parameters​

ParameterDescription
SQL statementThe SQL statement we wish to use to query the resource.
Output formatRepresentation of the output result. The possible options are “Table”, “CSV” or “JSON”.

Was this page helpful?

OverviewCheck Analysis Progress