Skip to content
Lucas Lessa
Café com Features
Voltar para as notícias
DatabricksBetaImpacto: Médio

Connect CrowdStrike Falcon Events to Databricks Using Lakeflow

The new Lakeflow Connect connector brings CrowdStrike Falcon events directly into Databricks in Beta.

O que mudou

Use cases

Imagine you need to centralize security logs and endpoint events from your security infrastructure for analysis in Databricks. With this managed connector, you can:

  • Ingest Falcon Event Stream events incrementally from CrowdStrike Falcon.
  • Govern the ingested data using Unity Catalog.
  • Orchestrate the flow using Databricks Workflows.

How to use

The initial setup requires creating a connection in Catalog Explorer using OAuth 2.0 client credentials from a CrowdStrike API client with Event streams Read permission. Usage targets API-based pipelines and Asset Bundles.

Limitations and requirements

  • Stage: Beta (requires a workspace admin to enable it from the Previews page).
  • Authentication: OAuth M2M only (OAuth 2.0 client credentials).
  • UI-based pipeline authoring is not supported.
  • API-based row filtering and SCD Type 2 are not supported.
  • Schema evolution: new and deleted columns are supported, renames are treated as a new and deleted column, but data type changes are not supported.

Using it in a pipeline

This connector fits into the Bronze layer of your lakehouse, ingesting raw security events from CrowdStrike for further transformation and enrichment in the Silver layer.

Ver nota oficial do Databricks

CrowdStrike Falcon Event Stream connector (Beta)

Resumo e explicação gerados por IA a partir da release note oficial. Em caso de dúvida, a documentação oficial da plataforma prevalece.

Relacionadas