CrowdStrike Tables

Permissions

The CrowdStrike plugin requires read access to the following:

Permission	Associated Table
alerts:read	CrowdStrikeAlerts, CrowdStrikeAlerts_CrowdStrikeBehaviors
incidents:read	CrowdStrikeAlerts_CrowdStrikeBehaviors, CrowdStrikeBehaviors, CrowdStrikeBehaviors_CrowdStrikeIncidents, CrowdStrikeIncidentEventHistograms, CrowdStrikeIncidents, CrowdStrikeIncidents_CrowdStrikeDevices , CrowdStrikeIncidents_CrowdStrikeIncidentTags, CrowdStrikeIncidents_CrowdStrikeUsers, CrowdStrikeIncidentTags
discover:read	CrowdStrikeApplications, CrowdStrikeApplications_CrowdStrikeDevices
cspm-registration:read	CrowdStrikeCloudBenchmarkFrameworks, CrowdStrikeCloudPolicies, CrowdStrikeCloudPolicies_CrowdStrikeCloudPolicyBenchmarks, CrowdStrikeCloudPolicies_CrowdStrikePolicyCloudAttackTypes, CrowdStrikeCloudPolicyAttackTypes, CrowdStrikeCloudPolicyBenchmarks, CrowdStrikeCloudPolicyRegions, CrowdStrikeCloudPolicySettings, CrowdStrikeCloudPolicySettings_CrowdStrikeCloudPolicyRegions
usermgmt:read	CrowdStrikeCombinedUserRoles, CrowdStrikeIncidents_CrowdStrikeUsers, CrowdStrikeRoles, CrowdStrikeUsers
device-control-policies:read	CrowdStrikeDevicePolicies, CrowdStrikeDevicePolicyControlClasses, CrowdStrikeDevicePolicyControlExceptions, CrowdStrikeDevicePolicyControlSettings, CrowdStrikeDevices_CrowdStrikeDevicePolicies
prevention-policies:read	CrowdStrikeDevicePolicies, CrowdStrikeDevicePolicyPreventionSettings, CrowdStrikeDevices_CrowdStrikeDevicePolicies
sensor-update-policies:read	CrowdStrikeDevicePolicies, CrowdStrikeDevicePolicySensorSettings, CrowdStrikeDevices_CrowdStrikeDevicePolicies
devices:read	CrowdStrikeDevices, CrowdStrikeDevices_CrowdStrikeDevicePolicies
spotlight-vulnerabilities:read	CrowdStrikeSpotlightCVEs, CrowdStrikeSpotlightVulnerabilities, CrowdStrikeSpotlightVulnerabilityApps, CrowdStrikeSpotlightVulnerabilityApps_CrowdStrikeSpotlightVulnerabilities

Tables

CrowdStrikeAlerts

Each alert CrowdStrike raised for the customer, with severity, status, and timing details.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
ApplicationID	string	Unique identifier for the application.
CID	string	CrowdStrike customer ID for the tenant.
Name	string	Name of the application.
NameVendor	string	Vendor related to this application.
NameVendorVersion	string	Version information for this application.
Category	string	Category assigned to the application.
SoftwareType	string	Type of software.
Vendor	string	Vendor related to this application.
Version	string	Version information for this application.
VersioningScheme	string	Version information for this application.
Architectures	string	Stores the architectures for the application.

CrowdStrikeApplications

Applications and their versions discovered across protected hosts.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
ApplicationID	string	Unique identifier for the application.
CID	string	CrowdStrike customer ID for the tenant.
Name	string	Name of the application.
NameVendor	string	Vendor related to this application.
NameVendorVersion	string	Version information for this application.
SoftwareType	string	Type of software.
Vendor	string	Vendor related to this application.
Version	string	Version information for this application.
VersioningScheme	string	Version information for this application.
Architectures	string	Stores the architectures for the application.
FirstSeenTimestamp	datetime	Date and time when the application was first seen.
LastUsedTimestamp	datetime	Date and time when the application was last used.
IsNormalized	boolean	Indicates whether the application is normalized.
IsSuspicious	boolean	Indicates whether the application is suspicious.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeBehaviors

Individual behaviors or indicators CrowdStrike detected during an alert.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
BehaviorID	string	Unique identifier for the behavior.
CID	string	CrowdStrike customer ID for the tenant.
AID	string	Unique identifier for the A.
CommandLine	string	Command line that was executed.
CompoundTto	string	Stores the compound tto for the behavior.
DisplayName	string	Name of the display.
Domain	string	Stores the domain for the behavior.
ExclusionType	string	Type of exclusion.
FilePath	string	File or resource path for this behavior.
GroupingIDs	string	Groups associated with this behavior.
IocSource	string	Stores the ioc source for the behavior.

CrowdStrikeCloudBenchmarkFrameworks

Security benchmark frameworks CrowdStrike tracks for cloud posture.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
FrameworkCode	string	Stores the framework code for the benchmark framework.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeCloudPolicies

CrowdStrike cloud posture policies with metadata and status.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	integer	Identifier for the policy inside CrowdStrike.
Name	string	Name of the cloud policy.
PolicyType	string	Type or category of policy.
CloudProvider	string	Cloud-specific detail for this cloud policy.
CloudServiceID	integer	Unique identifier for the cloud service.
CloudService	string	Cloud-specific detail for this cloud policy.
CloudServiceFriendly	string	Cloud-specific detail for this cloud policy.
CloudServiceSubtype	string	Type of cloud service sub.
CloudAssetTypeID	integer	Unique identifier for the cloud asset type.
CloudAssetType	string	Type of cloud asset.
DefaultSeverity	string	Severity level for the cloud policy.
IsGlobal	boolean	Indicates whether the cloud policy is global.
FQLPolicy	string	Stores the FQL policy for the cloud policy.
CreatedAt	datetime	Date and time when the cloud policy was created.
UpdatedAt	datetime	Date and time when the cloud policy was updated.
PolicyTimestamp	datetime	Date and time when the cloud policy was policy.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeCloudPolicyAttackTypes

Catalog of cloud attack types in CrowdStrike.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
AttackType	string	Type of attack.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeCloudPolicyBenchmarks

Cloud benchmark standards and sections referenced by policies.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
BenchmarkID	integer	Unique identifier for the benchmark.
FrameworkCode	string	Stores the framework code for the policy benchmark.
BenchmarkShort	string	Benchmark detail for this policy benchmark.
RecommendationNumber	string	Stores the recommendation number for the policy benchmark.
ApplicableProfiles	string	Stores the applicable profiles for the policy benchmark.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeCloudPolicyRegions

Cloud regions targeted by a policy setting.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
Region	string	Region tied to this policy region.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeCloudPolicySettings

Individual settings that make up each cloud policy.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	integer	Identifier for the policy inside CrowdStrike.
AccountID	string	Unique identifier for the account.
Enabled	boolean	Indicates whether the policy setting is enabled.
Severity	string	Severity level for the policy setting.
TagExcluded	boolean	Indicates whether the policy setting is tag excluded.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeCombinedUserRoles

CrowdStrike sensor policies configured for devices.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
UUID	string	Unique identifier for the user in CrowdStrike.
RoleID	string	Role identifier assigned by CrowdStrike.
RoleName	string	Friendly name of the role.
GrantType	string	Type of role grant the user received in CrowdStrike.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.
CID	string	CrowdStrike customer ID for the tenant.

CrowdStrikeDevicePolicies

CrowdStrike sensor policies configured for devices.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	string	Identifier for the policy inside CrowdStrike.
Name	string	Name of the device policy.
Description	string	Short description of the device policy.
PlatformName	string	Name of the platform.
Enabled	boolean	Indicates whether the device policy is enabled.
PolicyType	string	Type or category of policy.
CreatedBy	string	Stores the created by for the device policy.
CreatedTimestamp	datetime	Date and time when this record was created in CrowdStrike.
ModifiedBy	string	Stores the modified by for the device policy.
ModifiedTimestamp	datetime	Date and time when this record was last updated in CrowdStrike.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeDevicePolicyControlClasses

Policy control class definitions within device policies.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	string	Identifier for the policy inside CrowdStrike.
ClassID	string	Unique identifier for the class.
Action	string	Stores the action for the control class.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeDevicePolicyControlExceptions

Exceptions applied to specific device policy controls.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	string	Identifier for the policy inside CrowdStrike.
ClassID	string	Unique identifier for the class.
ExceptionID	string	Unique identifier for the exception.
Action	string	Stores the action for the control exception.
Class	string	Stores the class for the control exception.
CombinedID	string	Unique identifier for the combined.
MatchMethod	string	Stores the match method for the control exception.
ProductID	string	Unique identifier for the product.
ProductName	string	Name of the product.
SerialNumber	string	Stores the serial number for the control exception.
VendorID	string	Unique identifier for the vendor.
VendorName	string	Name of the vendor.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeDevicePolicyControlSettings

Individual control settings defined under each device policy.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	string	Identifier for the policy inside CrowdStrike.
EndUserNotification	string	Stores the end user notification for the control setting.
EnforcementMode	string	Stores the enforcement mode for the control setting.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeDevicePolicyPreventionSettings

Prevention-related options inside a device policy.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	string	Identifier for the policy inside CrowdStrike.
SettingID	string	Unique identifier for the setting.
PreventionSettingGroupName	string	Name of the prevention setting group.
SettingName	string	Name of the setting.
SettingType	string	Type of setting.
SettingDescription	string	Short description of the setting.
IsEnabled	boolean	Indicates whether the prevention setting is enabled.
IsConfigured	boolean	Indicates whether the prevention setting is configured.
DetectionLevel	string	Stores the detection level for the prevention setting.
PreventionLevel	string	Stores the prevention level for the prevention setting.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeDevicePolicySensorSettings

Sensor configuration options stored within a device policy.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
PolicyID	string	Identifier for the policy inside CrowdStrike.
Build	string	Stores the build for the sensor setting.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeDevices

Every endpoint CrowdStrike manages for the tenant.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
DeviceID	string	CrowdStrike device identifier.
MACAddress	string	MAC address of the device.
AgentLocalTime	datetime	Date and time when the device was agent local.
AgentVersion	string	Version of the CrowdStrike agent running on the device.
ExternalIP	string	External IP address reported for the device.
Hostname	string	Device host name recorded by CrowdStrike.
FirstSeen	datetime	Date and time when the device was first seen by CrowdStrike.
LastSeen	datetime	Date and time when the device last checked in with CrowdStrike.
LastLoginUser	string	Stores the last login user for the device.
LastLoginTimeStamp	datetime	Date and time when the device was last login time stamp.
MachineDomain	string	Active Directory domain the machine is joined to.

CrowdStrikeIncidentEventHistograms

Counts of key events within each CrowdStrike incident.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
EventHistogramID	uniqueidentifier	Unique identifier for the event histogram.
IncidentID	string	CrowdStrike incident identifier.
Count	integer	Number of incident event histogramses.
HasDetect	boolean	Indicates whether it has detect.
HasOverwatch	boolean	Indicates whether it has overwatch.
HasPrevented	boolean	Indicates whether it has prevented.
TimestampMax	bigint	Stores the timestamp max for the incident event histogram.
TimestampMin	bigint	Stores the timestamp min for the incident event histogram.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeIncidents

CrowdStrike incident records with status, priority, and affected assets.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
IncidentID	string	CrowdStrike incident identifier.
CID	string	CrowdStrike customer ID for the tenant.
AssignedTo	string	Stores the assigned to for the incident.
AssignedToName	string	Name of the assigned to.
Created	datetime	Date and time when the incident was created.
Description	string	Short description of the incident.
EmailState	string	Email address related to this incident.
End	datetime	Date and time when the incident was end.
FineScore	integer	Score CrowdStrike assigned to this incident.
GroupingIds	string	Groups associated with this incident.
HostIds	string	Host ids related to this record.

CrowdStrikeIncidentTags

Available incident tags defined in CrowdStrike.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
Tag	string	Tags applied to this incident tag.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeRoles

Catalog of CrowdStrike roles and their metadata.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
ID	string	Unique identifier for the role.
DisplayName	string	Name of the display.
Description	string	Short description of the role.
IsGlobal	boolean	Indicates whether the role is global.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.
CID	string	CrowdStrike customer ID for the tenant.

CrowdStrikeSpotlightCVEs

Full CVE details sourced from CrowdStrike Spotlight.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
ID	string	Unique identifier for the CVE.
BaseScore	decimal	Score CrowdStrike assigned to this CVE.
Severity	string	Severity level for the CVE.
ExploitStatus	integer	Current status of the CVE.
ExpertRating	string	Stores the expert rating for the CVE.
RemediationLevel	string	Stores the remediation level for the CVE.
IsCisaKev	boolean	Indicates whether the CVE is cisa kev.
SpotlightPublishedDate	datetime	Date and time when the CVE was spotlight published.
PublishedDate	datetime	Date and time when the CVE was published.
ExploitabilityScore	decimal	Score CrowdStrike assigned to this CVE.
ImpactScore	decimal	Score CrowdStrike assigned to this CVE.
Vector	string	Stores the vector for the CVE.
Description	string	Short description of the CVE.
TypesCsv	string	Stores the types csv for the CVE.
CwesCsv	string	Stores the cwes csv for the CVE.
VendorAdvisoryCsv	string	Vendor related to this CVE.
ReferencesCsv	string	Stores the references csv for the CVE.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeSpotlightVulnerabilities

Vulnerabilities Spotlight found across the environment.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
VulnerabilityID	string	Unique identifier for the vulnerability.
HostID	string	CrowdStrike host identifier.
ResourceID	string	Unique identifier for the resource.
CreatedTimedStamp	datetime	Date and time when the vulnerability was created.
UpdatedTimedStamp	datetime	Date and time when the vulnerability was updated.
ClosedTimedStamp	datetime	Date and time when the vulnerability was closed.
Status	string	Current status of the vulnerability.
Confidence	string	Stores the confidence for the vulnerability.
IsSuppressed	boolean	Indicates whether the vulnerability is suppressed.
DeviceID	string	CrowdStrike device identifier.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeSpotlightVulnerabilityApps

Applications implicated in Spotlight vulnerability findings.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
ProductNameVersion	string	Version information for this vulnerable application.
Vendor	string	Vendor related to this vulnerable application.
Product	string	Stores the product for the vulnerable application.
SubStatus	string	Current status of the vulnerable application.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

CrowdStrikeUsers

User accounts pulled from CrowdStrike identity services.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.
UUID	string	Unique identifier for the user in CrowdStrike.
CreatedAt	datetime	Date and time when the user was created.
FirstName	string	First name of the user.
LastLoginAt	datetime	Date and time when the user was last logged in.
LastName	string	Last name of the user.
Status	string	Current status of the user.
UID	string	Unique user identifier within CrowdStrike.
UpdatedAt	datetime	Date and time when the user was updated.
CID	string	CrowdStrike customer ID for the tenant.

Bridge Tables

CrowdStrikeAlerts_CrowdStrikeBehaviors

Links alerts to the detailed behaviors observed inside each alert.

Name	Type	Description
AlertID	string	Unique identifier for the alert.
BehaviorID	string	Unique identifier for the behavior.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeApplications_CrowdStrikeDevices

Links each application to the device it was found on.

Name	Type	Description
ApplicationID	string	Unique identifier for the application.
DeviceID	string	CrowdStrike device identifier.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeBehaviors_CrowdStrikeIncidents

Connects behaviors to the incidents they contributed to.

Name	Type	Description
BehaviorID	string	Unique identifier for the behavior.
IncidentID	string	CrowdStrike incident identifier.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeCloudPolicies_CrowdStrikeCloudPolicyBenchmarks

Maps cloud policies to the benchmark controls they satisfy.

Name	Type	Description
PolicyID	integer	Identifier for the policy inside CrowdStrike.
BenchmarkID	integer	Unique identifier for the benchmark.
FrameworkCode	string	Stores the framework code for the policy-benchmark link.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeCloudPolicies_CrowdStrikePolicyCloudAttackTypes

Maps cloud policies to the attack types they address.

Name	Type	Description
PolicyID	integer	Identifier for the policy inside CrowdStrike.
AttackType	string	Type of attack.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeCloudPolicySettings_CrowdStrikeCloudPolicyRegions

Pairs a policy setting with the regions where it applies.

Name	Type	Description
PolicyID	integer	Identifier for the policy inside CrowdStrike.
AccountID	string	Unique identifier for the account.
Region	string	Region tied to this setting-region link.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeDevices_CrowdStrikeDevicePolicies

Links devices to the sensor policies currently assigned to them.

Name	Type	Description
DeviceID	string	CrowdStrike device identifier.
PolicyID	string	Identifier for the policy inside CrowdStrike.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeIncidents_CrowdStrikeDevices

Lists which devices are tied to a given incident.

Name	Type	Description
IncidentID	string	CrowdStrike incident identifier.
DeviceID	string	CrowdStrike device identifier.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeIncidents_CrowdStrikeIncidentTags

Connects incidents to the tags applied in CrowdStrike.

Name	Type	Description
IncidentID	string	CrowdStrike incident identifier.
Tag	string	Tags applied to this incident-tag link.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeIncidents_CrowdStrikeUsers

Shows which users are associated with each incident.

Name	Type	Description
IncidentID	string	CrowdStrike incident identifier.
UUID	string	Unique identifier for the user in CrowdStrike.
ConfigID	integer	Internal Compyl configuration ID for this tenant.

CrowdStrikeSpotlightVulnerabilityApps_CrowdStrikeSpotlightVulnerabilities

Links applications to the vulnerability findings they relate to.

Name	Type	Description
VulnerabilityID	string	Unique identifier for the vulnerability.
HostID	string	CrowdStrike host identifier.
ProductNameVersion	string	Version information for this app-vulnerability link.
ConfigID	integer	Internal Compyl configuration ID for this tenant.