Pre-Release

This feature is actively being developed. Breaking changes should be expected. Synqly Labs is available only in Synqly Mesh.

Please contact us before using this feature.

CrowdStrike

Labs URL: synqly://labs/crowdstrike

Create a Labs integration

Create an integration for the provider, the same way you would for the real provider.
Set the provider's URL to the Labs URL at the top of this page.
Fill in the credential fields. Labs accepts any value, but the credential must be the type the provider asks for, such as an OAuth client ID and secret or an API token.

Then call any operation the provider supports. Your requests run through the same connector that serves a real provider tenant, so the responses have the provider's shape and your code works against the real provider without changes.

Assets

Provider: CrowdStrike Falcon Spotlight

Operation	On Labs
`query_devices`	Available
`query_software`	Available

`query_devices`

Filter	Operators	Not on Labs
`device.hostname`	eq
`device.ip`	eq
`device.last_seen_time`	gt, gte, lt, lte
`device.mac`	eq
`metadata.labels`	eq, in

`query_software`

Filter	Operators	Not on Labs
`device.hostname`	eq, ne, in, not_in
`device.ip`	eq, ne, in, not_in
`device.mac`	eq, ne, in, not_in
`device.os.name`	eq, ne, in, not_in
`device.os.type`	eq, ne, in, not_in
`device.os.type_id`	eq, ne, in, not_in
`device.os.version`	eq, ne, in, not_in
`device.type`	eq, ne, in, not_in
`device.type_id`	eq, ne, in, not_in
`device.uid`	eq, ne, in, not_in
`metadata.modified_time`	gt, gte, lt, lte
`metadata.modified_time_dt`	gt, gte, lt, lte
`package.name`	eq, ne, in, not_in
`package.path`		eq, ne, in, not_in
`package.uid`	eq, ne, in, not_in
`package.vendor_name`	eq, ne, in, not_in
`package.version`	eq, ne, in, not_in
`start_time`	gt, gte, lt, lte
`start_time_dt`	gt, gte, lt, lte
`time`	gt, gte, lt, lte
`time_dt`	gt, gte, lt, lte

Sort	Directions	Not on Labs
`package.name`	asc, desc

Cloud Security

Provider: CrowdStrike Falcon® Insight EDR

Operation	On Labs
`query_cloud_resource_inventory`	Available
`query_compliance_findings`	Available
`query_ioms`	Available

`query_cloud_resource_inventory`

Filter	Operators	Not on Labs
`cloud.account.name`	eq, ne, like, not_like, in, not_in
`cloud.account.type`	eq, ne, like, not_like, in, not_in
`cloud.account.uid`	eq, ne, like, not_like, in, not_in
`cloud.provider`	eq, ne, like, not_like, in, not_in
`cloud.region`	eq, ne, like, not_like, in, not_in
`device.first_seen_time`	gt, gte, lt, lte
`device.first_seen_time_dt`	gt, gte, lt, lte
`device.modified_time`	gt, gte, lt, lte
`device.modified_time_dt`	gt, gte, lt, lte
`device.name`	eq, ne, like, not_like, in, not_in
`metadata.tenant_uid`	eq, ne, like, not_like, in, not_in

`query_compliance_findings`

Filter	Operators	Not on Labs
`cloud.account.name`	eq, ne, like, not_like, in, not_in
`cloud.account.uid`	eq, ne, like, not_like, in, not_in
`cloud.provider`	eq, ne, like, not_like, in, not_in
`cloud.region`	eq, ne, like, not_like, in, not_in
`compliance.standards`	eq, ne, like, not_like, in, not_in
`compliance.status`		eq, ne, like, not_like, in, not_in
`finding_info.uid`	eq, ne, like, not_like, in, not_in
`resource.name`	eq, ne, like, not_like, in, not_in
`resource.type`	eq, ne, like, not_like, in, not_in
`severity`	ne, not_in	eq, like, not_like, in
`severity_id`	ne, not_in	eq, like, not_like, in
`time`	gt, gte, lt, lte

Sort	Directions	Not on Labs
`actor.authorizations.policy.uid`		asc, desc
`compliance.control`	asc, desc
`compliance.requirements`	asc, desc
`compliance.standards`	asc, desc
`severity_id`		asc, desc
`start_time`	asc, desc
`time`	asc, desc

`query_ioms`

Filter	Operators	Not on Labs
`cloud.account.name`	eq, ne, like, not_like, in, not_in
`cloud.account.uid`	eq, ne, like, not_like, in, not_in
`cloud.provider`	eq, ne, like, not_like, in, not_in
`cloud.region`	eq, ne, like, not_like, in, not_in
`finding_info.created_time`	gt, gte, lt, lte
`finding_info.created_time_dt`	gt, gte, lt, lte
`metadata.tenant_uid`	ne, not_like, not_in	eq, like, in
`severity`	eq, ne, like, not_like, in, not_in
`severity_id`		eq

EDR

Provider: CrowdStrike Falcon® Insight EDR

Operation	On Labs
`create_ioa`	Available
`create_iocs`	Available
`create_threat_note`	Available
`delete_ioa`	Available
`delete_iocs`	Available
`execute_command`	Not available. Real Time Response is not available on Labs yet.
`execute_remote_script`	Not available. Real Time Response is not available on Labs yet.
`get_endpoint`	Available
`get_threat_notes`	Available
`network_quarantine`	Available
`query_alerts`	Available
`query_applications`	Available
`query_edr_events`	Available
`query_endpoints`	Available
`query_exclusions`	Not available. Exclusions and policies are not available on Labs yet.
`query_ioa`	Available
`query_iocs`	Available
`query_policies`	Not available. Exclusions and policies are not available on Labs yet.
`query_posture_score`	Available
`query_threatevents`	Available
`retrieve_file`	Not available. Real Time Response is not available on Labs yet.
`update_alert`	Partly available. Only comments are available on Labs. Status, verdict, tag, and assignment changes are not available yet.

`query_alerts`

Filter	Operators	Not on Labs
`comment`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`confidence`	eq, in
`confidence_id`	eq, in
`confidence_score`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.first_seen_time`	ne, gt, gte, lt, lte
`device.first_seen_time_dt`	ne, gt, gte, lt, lte
`device.hostname`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.last_seen_time`	ne, gt, gte, lt, lte
`device.last_seen_time_dt`	ne, gt, gte, lt, lte
`device.os.type`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.uid_alt`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`finding_info.created_time`	ne, gt, gte, lt, lte
`finding_info.created_time_dt`	ne, gt, gte, lt, lte
`finding_info.last_seen_time`	ne, gt, gte, lt, lte
`finding_info.last_seen_time_dt`	ne, gt, gte, lt, lte
`finding_info.types`		eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`finding_info.uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`metadata.product.feature.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`metadata.tenant_uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`risk_score`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`start_time`	ne, gt, gte, lt, lte
`start_time_dt`	ne, gt, gte, lt, lte
`status`	eq, ne, in, not_in
`status_id`	eq, ne, in, not_in
`time`	ne, gt, gte, lt, lte
`time_dt`	ne, gt, gte, lt, lte

Sort	Directions	Not on Labs
`comment`	asc, desc
`confidence_score`	asc, desc
`device.first_seen_time`	asc, desc
`device.first_seen_time_dt`	asc, desc
`device.hostname`	asc, desc
`device.last_seen_time`	asc, desc
`device.last_seen_time_dt`	asc, desc
`device.os.type`	asc, desc
`device.uid`	asc, desc
`device.uid_alt`	asc, desc
`finding_info.created_time`	asc, desc
`finding_info.created_time_dt`	asc, desc
`finding_info.last_seen_time`	asc, desc
`finding_info.last_seen_time_dt`	asc, desc
`finding_info.types`		asc, desc
`finding_info.uid`	asc, desc
`risk_score`	asc, desc
`start_time`	asc, desc
`start_time_dt`	asc, desc
`time`	asc, desc
`time_dt`	asc, desc

`query_applications`

Filter	Operators	Not on Labs
`metadata.modified_time`	gt, gte, lt, lte
`metadata.modified_time_dt`	gt, gte, lt, lte
`product.name`	eq, ne, in, not_in
`product.path`		eq, ne, in, not_in
`product.uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`product.vendor_name`	eq, ne, in, not_in
`product.version`	eq, ne, in, not_in
`start_time`	gt, gte, lt, lte
`start_time_dt`	gt, gte, lt, lte
`time`	gt, gte, lt, lte
`time_dt`	gt, gte, lt, lte

Sort	Directions	Not on Labs
`product.name`	asc, desc

`query_edr_events`

Filter	Operators	Not on Labs
`actor.process.cmd_line`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`actor.process.file.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`actor.process.file.path`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`actor.process.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hostname`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.ip`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.os.name`	gte, lt	eq, ne, gt, lte, in, not_in, like, not_like
`metadata.product.feature.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`status`	gt, lte	eq, ne, gte, lt, in, not_in, like, not_like

`query_endpoints`

Filter	Operators	Not on Labs
`device.first_seen_time`	gt, gte, lt, lte
`device.hostname`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hw_info.bios_manufacturer`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hw_info.bios_ver`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hw_info.chassis`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hw_info.serial_number`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.instance_uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.ip`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.last_seen_time`	gt, gte, lt, lte
`device.mac`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.modified_time`	gt, gte, lt, lte
`device.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.org.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.org.uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.os.name`	gt, lte	eq, ne, gte, lt, in, not_in, like, not_like
`device.os.type`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.os.type_id`	eq, ne, in, not_in
`device.os.version`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.type`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.type_id`	eq, ne, in, not_in
`device.uid`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.zone`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`status`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`time`	gt, gte, lt, lte

Sort	Directions	Not on Labs
`time`	asc, desc

`query_iocs`

Filter	Operators	Not on Labs
`created`	gt, gte, lt, lte
`created_by_ref.id`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`extensions.action`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`extensions.expired`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`extensions.platforms`		eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`extensions.severity`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`labels`		eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`modified`	gt, gte, lt, lte
`pattern`	gt, lte	eq, ne, gte, lt, in, not_in, like, not_like
`pattern_type`	gt, lte	eq, ne, gte, lt, in, not_in, like, not_like

`query_threatevents`

Filter	Operators	Not on Labs
`actor.process.cmd_line`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`actor.process.file.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`actor.process.file.path`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`actor.process.file.type`		eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`confidence_score`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.first_seen_time_dt`	gt, gte, lt, lte
`device.hostname`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hw_info.bios_manufacturer`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.hw_info.bios_ver`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.ip`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.last_seen_time_dt`	gt, gte, lt, lte
`device.mac`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`device.modified_time_dt`	gt, gte, lt, lte
`device.os.name`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`finding_info.created_time_dt`	gt, gte, lt, lte
`finding_info.modified_time`	gt, gte, lt, lte
`metadata.product.version`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`severity`		eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`severity_id`		eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`status`	eq, ne, gt, gte, lt, lte, in, not_in, like, not_like
`time`	gt, gte, lt, lte

Vulnerabilities

Provider: CrowdStrike Falcon® Spotlight

Operation	On Labs
`query_assets`	Available
`query_findings`	Available

`query_assets`

Filter	Operators	Not on Labs
`device.hostname`	eq
`device.ip`	eq
`device.last_seen_time`	gt, gte, lt, lte
`device.mac`	eq
`device.uid`	eq, in

`query_findings`

Filter	Operators	Not on Labs
`device.uid`	eq, in
`finding.first_seen_time`	gt, gte, lt, lte
`finding.last_seen_time`	gt, gte, lt, lte
`finding.title`	eq, in
`finding.uid`	eq, in
`severity`	eq, in

CrowdStrike

Create a Labs integration

Assets

query_devices

query_software

Cloud Security

query_cloud_resource_inventory

query_compliance_findings

query_ioms

EDR

query_alerts

query_applications

query_edr_events

query_endpoints

query_iocs

query_threatevents