Tables in CrowdStrike
The crowdstrike plugin includes 5 tables:
Name | Description | Queries |
|---|---|---|
CrowdStrike FDR AIDMaster snapshots: sensor, operating system and hardware metadata for every Falcon agent. | ||
CrowdStrike FDR AppInfo snapshots: the application inventory Falcon observes on each host. | ||
CrowdStrike FDR primary events: sensor telemetry and external-API events delivered by Falcon Data Replicator. | ||
CrowdStrike FDR ManagedAssets snapshots: network interface and gateway info for each Falcon-managed host. | ||
CrowdStrike FDR UserInfo snapshots: the accounts Falcon observes signing in on each host. |