connector

package
v0.0.16 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 24, 2026 License: Apache-2.0 Imports: 35 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ResourcesPageSize int64 = 50

Functions

func New 

func New(ctx context.Context, cc *cfg.Crowdstrike, opts *cli.ConnectorOpts) (connectorbuilder.ConnectorBuilderV2, []connectorbuilder.Opt, error)

New returns the CrowdStrike connector.

func WithRateLimitAnnotations 

func WithRateLimitAnnotations(rateLimitInfo ...RateLimitInfo) annotations.Annotations

Types

type AccountData added in v0.0.8 

type AccountData struct {
	TypeName string `json:"__typename"`

	// Active Directory fields
	ObjectSid      string `json:"objectSid,omitempty"`
	SamAccountName string `json:"samAccountName,omitempty"`
	Domain         string `json:"domain,omitempty"`
	ObjectGUID     string `json:"objectGuid,omitempty"`

	// Azure AD / AWS IC SSO / Generic SSO fields
	DataSourceParticipantIdentifier string `json:"dataSourceParticipantIdentifier,omitempty"`

	// PasswordAttributes carries per-account password risk signals (present on user
	// account descriptors). Nil when the descriptor type does not expose it.
	PasswordAttributes *PasswordAttributes `json:"passwordAttributes,omitempty"`
}

AccountData represents an external account descriptor associated with an identity entity.

func (AccountData) ExternalID added in v0.0.8 

func (a AccountData) ExternalID() string

ExternalID returns the best external identifier for this account based on its type.

Mapping by account type:

  • ActiveDirectoryAccountDescriptor → objectGuid (formatted as hyphen-free hex)
  • AzureSsoUserAccountDescriptor → dataSourceParticipantIdentifier (Azure AD object ID)
  • AwsIcSsoUserAccountDescriptorImpl → dataSourceParticipantIdentifier (AWS IC user ID)
  • SsoUserAccountDescriptorImpl → dataSourceParticipantIdentifier (generic SSO ID)

Non-user account types (groups, roles, endpoints, cloud services) return "".

type Connector added in v0.0.6 

type Connector struct {
	// contains filtered or unexported fields
}

func (*Connector) GlobalActions added in v0.0.15 

func (o *Connector) GlobalActions(ctx context.Context, registry actions.ActionRegistry) error

GlobalActions registers account-level actions used by C1 automations such as push rules.

func (*Connector) Metadata added in v0.0.6 

func (o *Connector) Metadata(ctx context.Context) (*v2.ConnectorMetadata, error)

func (*Connector) ResourceSyncers added in v0.0.6 

func (o *Connector) ResourceSyncers(ctx context.Context) []connectorbuilder.ResourceSyncerV2

func (*Connector) Validate added in v0.0.6 

func (o *Connector) Validate(ctx context.Context) (annotations.Annotations, error)

Validates that the user has access to all relevant endpoints.

type IdentityProtectionClient added in v0.0.7 

type IdentityProtectionClient struct {
	// contains filtered or unexported fields
}

IdentityProtectionClient provides methods to interact with CrowdStrike's Identity Protection API.

func NewIdentityProtectionClient added in v0.0.7 

func NewIdentityProtectionClient(httpClient *uhttp.BaseHttpClient, host string, includePasswordRisk bool) *IdentityProtectionClient

NewIdentityProtectionClient creates a new Identity Protection client that talks to CrowdStrike's GraphQL API over the given shared uhttp base client (OAuth2 client-credentials, transient-error retries, and rate-limit metadata all handled by uhttp). includePasswordRisk opts the entities query into the password-attributes selection.

func (*IdentityProtectionClient) GetIdentityRiskScores added in v0.0.7 

func (c *IdentityProtectionClient) GetIdentityRiskScores(ctx context.Context, pageSize int, cursor string) ([]IdentityRiskData, string, bool, RateLimitInfo, error)

GetIdentityRiskScores fetches identity risk scores from CrowdStrike Identity Protection. It uses the GraphQL API to retrieve risk data for all users.

func (*IdentityProtectionClient) ValidateAccess added in v0.0.7 

func (c *IdentityProtectionClient) ValidateAccess(ctx context.Context) error

ValidateAccess checks if the connector has access to the Identity Protection API.

type IdentityRiskData added in v0.0.7 

type IdentityRiskData struct {
	PrimaryDisplayName   string        `json:"primaryDisplayName"`
	SecondaryDisplayName string        `json:"secondaryDisplayName"`
	EmailAddresses       []string      `json:"emailAddresses"`
	RiskScore            float64       `json:"riskScore"`
	RiskScoreSeverity    string        `json:"riskScoreSeverity"`
	RiskFactors          []RiskFactor  `json:"riskFactors"`
	Accounts             []AccountData `json:"accounts"`
}

IdentityRiskData represents the risk data for a single identity from CrowdStrike.

type PasswordAttributes added in v0.0.16 

type PasswordAttributes struct {
	Exposed  bool   `json:"exposed"`
	Strength string `json:"strength"`
}

PasswordAttributes captures the password risk signals Identity Protection exposes on a user account descriptor. "Exposed" is CrowdStrike's compromised-credential signal (the password appears in a known breach/exposed set); "Strength" is the PasswordStrength enum (UNKNOWN | WEAK | STRONG).

type RateLimitInfo 

type RateLimitInfo struct {
	Limit     int64
	Remaining int64
}

func NewRateLimitInfo 

func NewRateLimitInfo(limit, remaining int64) RateLimitInfo

type RiskFactor added in v0.0.7 

type RiskFactor struct {
	Type     string `json:"type"`
	Severity string `json:"severity"`
}

RiskFactor represents a single factor contributing to an identity's risk score.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.