Skip to content

feat(crowdstrike): CrowdStrike source plugin#5122

Merged
cqgaurav merged 36 commits intomainfrom
crowdstrike
Dec 9, 2022
Merged

feat(crowdstrike): CrowdStrike source plugin#5122
cqgaurav merged 36 commits intomainfrom
crowdstrike

Conversation

@cqgaurav
Copy link
Copy Markdown
Contributor

@cqgaurav cqgaurav commented Nov 28, 2022 •
edited
Loading

Summary

This PR adds a few services for a crowdstrike cloudquery plugin. It is intended to serve as a smaller example for adding a realisting CQ plugin.

Tested using the following source and destination configs

cloudquery sync .
// source.yml

kind: source
spec:
  name: crowdstrike-0
  # registry: github
  # path: cloudquery/aws
  registry: grpc
  path: localhost:7777
  # version: v7.0.1
  tables: ['*']
  skip_tables: ['crowdstrike_incidents_crowdscore'] # skipped since this is pending on crowdstrike support.
  destinations: ["postgresql"]
  spec:
    client_id: "YOUR_CLIENT_ID"
    client_secret: "YOUR_CLIENT_SECRET"


kind: destination
spec:
  name: postgresql
  path: cloudquery/postgresql
  version: v1.7.9
  write_mode: append
  spec:
    connection_string: "postgresql://postgres:pass@localhost:5432/postgres?sslmode=disable"

Then start a local postgre in docker using
docker exec -it cloudquery_postgres psql -U postgres
And test that the table was created.

postgres=# select * from crowdstrike_alerts_query;
 _cq_source_name |       _cq_sync_time        |                _cq_id                | _cq_parent
_id | errors |                                                                                   
               meta                                                                              
                    | resources 
-----------------+----------------------------+--------------------------------------+-----------
----+--------+-----------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------
--------------------+-----------
 crowdstrike-0   | 2022-11-28 17:10:50.680223 | b0635155-2c56-41ee-8afb-59d7a0402ab2 |           
    | null   | {"writes": {"resources_affected": 0}, "trace_id": "173893ad-6264-4149-8a17-9c1e52a
8b5dc", "pagination": {"limit": 100, "total": 0, "offset": 0}, "powered_by": "detectsapi", "query
_time": 0.01502205} | {}
(1 row)

Note: I haven't been able to test this end to end because of the complexity of a test CrowdStrike setup combined with a non existent crowdstrike support, but hopefully it should work as an example.

@cqgaurav cqgaurav requested a review from bbernays November 28, 2022 16:59
bbernays
bbernays reviewed Nov 28, 2022
View reviewed changes
@cqgaurav cqgaurav changed the title Crowdstrike feat(crowdstrike): CrowdStrike source plugin Nov 29, 2022
@cqgaurav cqgaurav requested a review from disq November 29, 2022 11:35
disq
disq requested changes Nov 29, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@disq disq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small things, also remove the codegen binary from codegen/ :)

erezrokah
erezrokah requested changes Nov 29, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@erezrokah erezrokah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @cqgaurav, not sure if this is meant to be released, but if it is, we should also follow https://www.notion.so/cloudquery/Adding-a-new-plugin-to-the-monorepo-f216b653dbe648b2b3512fb8d59a8f89

cqgaurav and others added 4 commits November 29, 2022 13:51
@cqgaurav @disq
Update plugins/source/crowdstrike/README.md
3cdc570 
Co-authored-by: Kemal <223029+disq@users.noreply.github.com>
@cqgaurav @disq
Update plugins/source/crowdstrike/client/client.go
d5e5a18 
Co-authored-by: Kemal <223029+disq@users.noreply.github.com>
@cqgaurav @disq
Update plugins/source/crowdstrike/resources/services/incidents/crowds…
000c9d1 
…core_fetch.go

Co-authored-by: Kemal <223029+disq@users.noreply.github.com>
@cqgaurav @disq
Update plugins/source/crowdstrike/resources/services/alerts/query_fet…
7da1812 
…ch.go

Co-authored-by: Kemal <223029+disq@users.noreply.github.com>
@cqgaurav
Copy link
Copy Markdown
Contributor Author

cqgaurav commented Nov 29, 2022

@erezrokah Thanks for that link. Is it okay to break that into a separate pr to keep the example PR somewhat shorter ?
Maybe I should link/stack that from this one.

bbernays
bbernays reviewed Nov 29, 2022
View reviewed changes
@erezrokah
Copy link
Copy Markdown
Member

erezrokah commented Nov 29, 2022

@erezrokah Thanks for that link. Is it okay to break that into a separate pr to keep the example PR somewhat shorter ?
Maybe I should link/stack that from this one.

@cqgaurav I'm not sure. Is this PR here to serve as an example on how to add a community plugin or a plugin to the monorepo? If for a community plugin I think we should discuss this a bit more, as we've had a template and also considered a scaffold command. If for the monorepo, I think it should include the parts that also release the plugin

@cqgaurav
Copy link
Copy Markdown
Contributor Author

cqgaurav commented Nov 30, 2022

@erezrokah Yes, I don't have a strong opinion, and its possible that the users don't necessarily care about differentiating between plugin and releasing it separately. I added the requested changes

@cqgaurav cqgaurav marked this pull request as ready for review November 30, 2022 13:03
@cqgaurav cqgaurav requested a review from a team November 30, 2022 13:03
@github-actions
Copy link
Copy Markdown

github-actions bot commented Dec 9, 2022

This PR has the following changes to source plugin(s) tables:

  • Table crowdstrike_alerts_query was added
  • Table crowdstrike_incidents_crowdscore was added

@cqgaurav cqgaurav merged commit 0b6b47d into main Dec 9, 2022
@cqgaurav cqgaurav deleted the crowdstrike branch December 9, 2022 13:18
@cq-bot cq-bot mentioned this pull request Dec 9, 2022
Merged
kodiakhq bot pushed a commit that referenced this pull request Dec 20, 2022
@cq-bot
chore(main): Release plugins-source-crowdstrike v1.0.0 (#5528)
38abd78 
🤖 I have created a release *beep* *boop*
---


## 1.0.0 (2022-12-20)


### Features

* **crowdstrike:** CrowdStrike source plugin ([#5122](#5122)) ([0b6b47d](0b6b47d))


### Bug Fixes

* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.0 ([#5539](#5539)) ([fb71293](fb71293))
* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.2 ([#5583](#5583)) ([d721c4e](d721c4e))
* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.3 ([#5639](#5639)) ([6452d0e](6452d0e))
* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.4 ([#5649](#5649)) ([b4aa889](b4aa889))
* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.5 ([#5661](#5661)) ([b354b8a](b354b8a))
* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.6 ([#5790](#5790)) ([8e2663c](8e2663c))
* **deps:** Update module github.com/cloudquery/plugin-sdk to v1.12.7 ([#5797](#5797)) ([15da529](15da529))

---
This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bbernays bbernays bbernays left review comments

@disq disq disq approved these changes

@erezrokah erezrokah erezrokah approved these changes

@hermanschaaf hermanschaaf Awaiting requested review from hermanschaaf

@yevgenypats yevgenypats Awaiting requested review from yevgenypats

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@cqgaurav @erezrokah @disq @bbernays @cq-bot @hermanschaaf