Databricks SQL Addition Crowdstrike Queries

[zaynahsmith-dasilva]

Background

Changes

• Added a databricks sql YAML key to the existing SQL queries within the Crowdstrike log type.

Testing

[cursor]

PR Summary

Medium Risk
Medium risk because these are detection query changes for security analytics and require dialect correctness across Databricks nested-field access and SQL operators. Existing scheduled queries remain disabled and Snowflake logic is largely preserved, limiting runtime impact.

Overview
Adds DatabricksQuery definitions to seven CrowdStrike-related scheduled queries for AWS, Okta, 1Password, large zip creation, and macOS browser credential access detections.

The previous generic Query blocks are renamed to SnowflakeQuery, and the new Databricks variants adapt Snowflake-specific syntax such as LIKE ANY, variant field access, and casts to Databricks-compatible SQL.

^{Reviewed by Cursor Bugbot for commit c662ec0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d62c39c. Configure here.}