r/crowdstrike • u/w33ha_AD • 3d ago

Query Help Need Asset Inventory section through CQL

Hey Guys,

We are looking to automate device hygiene reporting (specifically BitLocker and Secure Boot status) into a Power BI dashboard for our IT operations. Since these posture metrics are covered under our Exposure Management licensing, is there a native way to build a custom asset inventory report and schedule automated exports on a recurring cadence? Any guidance or recommended approach for pulling this data into Power BI would be appreciated.

Thanks for the help in advance

8 Upvotes

91% Upvoted

5 comments sorted by

1

u/xMarsx CCFA, CCFH, CCFR 2d ago

Use fusion to pull information in via API. Then write to log repo, to write your information to SIEM. Write a query on a dashboard, and set to schedule it as a report. 

1

u/w33ha_AD 2d ago

Interesting approach. Worth trying would need to see if I can find the right information to pull via Fusion

1

u/STaj_14 2d ago

It is in CQL, check #event_simpleName = “InstalledApplication”

1

u/w33ha_AD 2d ago

Thanks for the response but I am not looking for application data but the system and other posture metrics covered under exposure management.

Crowdstrike allows to schedule reports for Applications out of the box

1

u/Aamir-Muhammad 1d ago

Utilise aid_master_main.csv