Spotlight - pulling the resource group name for Azure machines

[seemplybogo]

Hello,
in order to construct the full azure resource id of machines from spotlight, we need the hostname, subscription_id and resource_group name,
we have the hostname and subscription_id, but I can't find the resource group name anywhere in the data or the API.

is it available?
or, if we can add the resource_id itself, that would be wonderfull.

Thank you!!

[jshcodes]

Hi @seemplybogo -

We've investigated this and have confirmed that this field is not currently available via the CrowdStrike API.

This is a fantastic suggested addition. Would you be willing to submit it to the Ideas portal?

• US 1
• US 2
• EU 1

Select the link that matches your CrowdStrike region.

[seemplybogo]

Hello @jshcodes , thanks for the reply!

I currently don't have access to the portal, BUT:
The good news is, we found what we were looking for under "device_info"->"zone_group",
which will in fact be the resource_Group name for Azure machines,
so we're able to construct the complete azure resource id (it WOULD be nice if it was there AS IS in the data, but that's a strictly "nice to have" for us :)

the bad news is now we're trying to construct the GCP resource id and we're missing the project id (a unique string that is also a part of the GCP resource id).
there's a service_provider_account_id under device_info, but that's numeric and looks like the gcp project number instead,
see here for reference.
https://cloud.google.com/resource-manager/docs/creating-managing-projects

having both of them would be nice (the project "name" would be a great bonus) but the project ID is the most critical one so we're able to construct the resource id with this format
//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID

I can open this as a seperate request if that's preferred :)

and Thanks again!!