Export from Crowdstrike to File

CloudQuery is an open-source data integration platform that allows you to export data from any source to any destination.

The CloudQuery Crowdstrike plugin allows you to sync data from Crowdstrike to any destination, including File. It's free, open source, requires no account, and takes only minutes to get started.

Ready? Let's dive right in!

Step 1. Install the CloudQuery CLI

The CloudQuery CLI is a command-line tool that runs the sync. It supports MacOS, Linux and Windows.

brew install cloudquery/tap/cloudquery

Step 2. Configure the Crowdstrike source plugin

Create a configuration file for the Crowdstrike plugin and set up authentication.

Crowdstrike is a community plugin, which means that it is maintained by the CloudQuery community. Create a file called crowdstrike.yaml, then copy the example and follow the instructions in the Crowdstrike Plugin Documentation ↗ to fit your needs.

Step 3. Configure the File destination plugin

Create a configuration file for the File plugin and set up authentication.

Configuration

Create a file called file.yaml and add the following contents:

This example configures the file destination, to create CSV files in ./cq_csv_output. You can also choose json or parquet as the output format.

kind: destination
spec:
  name: "file"
  path: "cloudquery/file"
  version: "v3.4.9"
  spec:
    path: "path/to/files/{{TABLE}}/{{UUID}}.{{FORMAT}}"
    format: "csv" # options: parquet, json, csv
    # Optional parameters
    # directory: "" # required if path is not present
    # format_spec:
      # CSV-specific parameters:
      # delimiter: ","
      # skip_header: false
    # compression: "" # options: gzip
    # no_rotate: false
    # batch_size: 10000
    # batch_size_bytes: 52428800 # 50 MiB
    # batch_timeout: 30s

Note that the file plugin only supports append write-mode. The (top level) spec section is described in the Destination Spec Reference.

Fine-tune this configuration to match your needs. For more information, see the File Plugin ↗ page in the docs.

Step 4. Start the Sync

Run the following command in your terminal to start the sync

cloudquery sync crowdstrike.yaml file.yaml

And away we go! 🚀 The sync will run until completion, fetching all selected tables from Crowdstrike. Any errors will be logged to a file called cloudquery.log.