search

snowflakedb / SnowAlert

Security Analytics Using The Snowflake Data Warehouse
Apache License 2.0
184 stars 57 forks source link

feat[spotlight]: adding connector for crowdstrike spotlight API #489

Closed jakeyheath closed 2 years ago

sfc-gh-afedorov commented 3 years ago

have you tested / are you running this? happy to have it, but not sure if we need it ourselves. any extra explanation of what this data is useful for or instructions for setting it up you can put into the /docs/connectors repo would be appreciated

jakeyheath commented 3 years ago

Hey there, at CZI we started using this API to pull in metrics and thought it might be nice to have it as a part of the existing CrowdStrike connector. It's been a while since i have reviewed this code, so I would probably want to go back and test it. I don't think we have started to use the connector yet.

jakeyheath commented 3 years ago

If it helps, I can convert to draft until I have more details

sfc-gh-afedorov commented 3 years ago

thank you, yes. here's the steps if you want to spend time getting it out of draft, or of course feel free to close if you'd prefer to abandon the effort —

  1. deploy locally
  2. document testing steps in PR description
  3. add migration SQL (if necessary) for current users of the connector
  4. add documentation (if necessary) of anything that needs to happen in the CrowdStrike app

Thanks for considering contributing, always happy to see folks sharing their efforts :)

jakeyheath commented 3 years ago

I think we ended up not really needing this as much, so I am going to close this for now.

jakeyheath commented 3 years ago

Turns out we ARE using this data pretty regularly. I am going to clean up this PR and write some tests.