hosts
Hosts examples
The examples in this folder focus on leveraging CrowdStrike's Hosts API to perform administrative operations.
Add Falcon Tags in bulk
Bulk assign a Falcon Grouping Tag to a list of hosts based on their serial number. This solution updates the tags of hosts in batches of 20.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will assume the file containing serial numbers is called "serials.txt" and is stored in the same folder. That tag that will be added will have a value of "TEST_TAG".
python3 bulk_add_falcon_tag.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 bulk_add_falcon_tag.pyRead the file "new_serials.txt" and apply the tag "NEW_TAG" to all devices identified.
python3 bulk_add_falcon_tag.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -f new_serials.txt -t NEW_TAGRemove the tag "NEW_TAG" from all hosts identified in the file "new_serials.txt".
python3 bulk_add_falcon_tag.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -f new_serials.txt -t NEW_TAG -rAPI debugging can be enabled using the
-dargument.
python3 bulk_add_falcon_tag.py -dCommand-line help
Command-line help is available via the -h argument.
usage: bulk_add_falcon_tag.py [-h] [-d] [-f SERIAL_FILE] [-t TAG] [-r] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
__ __ ___ _____ ______ _____ ______ ____ ____ ____ ___ ____
| T T / \ / ___/| T/ ___/ | T / T / T / T / _]| \
| l |Y Y( \_ | ( \_ | |Y o |Y __jY __j / [_ | D )
| _ || O | \__ Tl_j l_j\__ T l_j l_j| || T || T |Y _]| /
| | || | / \ | | | / \ | | | | _ || l_ || l_ || [_ | \
| | |l ! \ | | | \ | | | | | || || || T| . Y
l__j__j \___/ \___j l__j \___j l__j l__j__jl___,_jl___,_jl_____jl__j\_j
This script was developed by @Don-Swanson-Adobe to bulk assign or remove a Falcon
Grouping Tag against a list of hosts based on their serial number.
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-f SERIAL_FILE, --serial_file SERIAL_FILE
Text file contain serial numbers of hosts to tag
-t TAG, --tag TAG String to use for the Falcon Tag
-r, --remove Remove tag instead of applying it
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Default Groups
This script was developed to setup the default groups in a new CID. It should be run once to create the necessary groups and populate them with the appropriate assignment rules.
Note: This sample also demonstrates pythonic response handling using the Advanced Uber Class (APIHarnessV2).
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
[!IMPORTANT] This script should be reviewed and updated to match your environment needs. Review the
groupsdictionary to identify group names and assignment rules that will be created. (lines 89 - 102, shown below)
#### UPDATE THE FOLLOWING DICTIONARY TO MATCH YOUR ENVIRONMENT ##########
# One group will be created for each dictionary item.
# Groups are defined as "Group Name": "Assignment Rule"
groups = {
"Sensor Uninstall Group": "staticByID",
"Phase 0": "none",
"Phase 1": "hostname:*'*'",
"Active Policy": "none",
"Windows Servers": "platform_name:'Windows'+product_type_desc:'Server'",
"DEV Updates": "tags:'SensorGroupingTags/DEV'",
"Golden Images": "tags:'FalconGroupingTags/GoldenImage'",
"Windows 7 and Server 2008 R2 Hosts": "(os_version:'Windows Server 2008 R2',os_version:'Windows 7')"
}
#########################################################################Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will create the groups as defined by the
groupsdictionary within the current tenant (non-MSSP).
python3 default_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 default_groups.pyEnable MSSP mode and create the groups within all child CIDs.
python3 default_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -mEnable MSSP mode and create the groups within a specific child CID.
python3 default_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -c CHILD_CIDAPI debugging can be enabled using the
-dargument.
python3 default_groups.py -dCommand-line help
Command-line help is available via the -h argument.
usage: default_groups.py [-h] [-d] [-o OUTPUT_PATH] [-m] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
·▄▄▄▄ ▄▄▄ .·▄▄▄ ▄▄▄· ▄• ▄▌▄▄▌ ▄▄▄▄▄ ▄▄ • ▄▄▄ ▄• ▄▌ ▄▄▄·.▄▄ ·
██▪ ██ ▀▄.▀·▐▄▄·▐█ ▀█ █▪██▌██• •██ ▐█ ▀ ▪▀▄ █·▪ █▪██▌▐█ ▄█▐█ ▀.
▐█· ▐█▌▐▀▀▪▄██▪ ▄█▀▀█ █▌▐█▌██▪ ▐█.▪ ▄█ ▀█▄▐▀▀▄ ▄█▀▄ █▌▐█▌ ██▀·▄▀▀▀█▄
██. ██ ▐█▄▄▌██▌.▐█ ▪▐▌▐█▄█▌▐█▌▐▌ ▐█▌· ▐█▄▪▐█▐█•█▌▐█▌.▐▌▐█▄█▌▐█▪·•▐█▄▪▐█
▀▀▀▀▀• ▀▀▀ ▀▀▀ ▀ ▀ ▀▀▀ .▀▀▀ ▀▀▀ ·▀▀▀▀ .▀ ▀ ▀█▄▀▪ ▀▀▀ .▀ ▀▀▀▀
This script was developed to setup the default groups in a new CID.
It should be run once to create the necessary groups and populate
them with the appropriate assignment rules.
Developed by @Don-Swanson-Adobe
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Location to store CSV output
-m, --mssp Return RFM details for child CIDs (MSSP parents only).
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Get Host Groups
This script will output a list of all Host Groups, for Flight Control scenarios it will display all the host groups in all child CIDs.
Note: This sample also demonstrates pythonic response handling using the Advanced Uber Class (APIHarnessV2).
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will list all groups within the current tenant.
python3 get_host_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 get_host_groups.pyEnable MSSP mode and list the groups within all child CIDs.
python3 get_host_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -mEnable MSSP mode and list the groups within a specific child CID.
python3 get_host_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -c CHILD_CIDChange the format of the output tabular display with the
-targument.
python3 get_host_groups.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -t fancy_gridAccepted formats
The following table formats are supported:
plainsimplegithubgridsimple_gridrounded_gridheavy_gridmixed_griddouble_gridfancy_gridoutlinesimple_outlinerounded_outlineheavy_outlinemixed_outlinedouble_outlinefancy_outlinepipeorgtblasciidocjiraprestoprettypsqlrstmediawikimoinmoinyoutrackhtmlunsafehtmllatexlatex_rawlatex_booktabslatex_longtabletextiletsv
API debugging can be enabled using the
-dargument.
python3 get_host_groups.py -dCommand-line help
Command-line help is available via the -h argument.
usage: get_host_groups.py [-h] [-d] [-m] [-c CHILD] [-t TABLE_FORMAT] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
__ __ _______ _______ _______
| | | || || || |
| |_| || _ || _____||_ _|
| || | | || |_____ | |
| || |_| ||_____ | | |
| _ || | _____| | | |
|__| |__||_______||_______| |___|
_______ ______ _______ __ __ _______ _______
| || _ | | || | | || || |
| ___|| | || | _ || | | || _ || _____|
| | __ | |_||_ | | | || |_| || |_| || |_____
| || || __ || |_| || || ___||_____ |
| |_| || | | || || || | _____| |
|_______||___| |_||_______||_______||___| |_______|
This script will output a list of all Host Groups, for Flight Control
scenarios it will display all the host groups in all child CIDs.
Developed by @Don-Swanson-Adobe
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-m, --mssp List groups in all child CIDs (MSSP parents only)
-c CHILD, --child CHILD
List groups in a specific child CID (MSSP parents only)
-t TABLE_FORMAT, --table_format TABLE_FORMAT
Table format to use for tabular display
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Host Report
This script replaces the manual daily export of hosts from the Falcon Console that was required to audit host compliance. It was developed to be run as a recurring job and will output a CSV with all hosts in the CID along with other required info that can then be imported into a compliance dashboard or tool.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will output results to a CSV file named
Hosts_output.csv.
python3 hosts_report.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 hosts_report.pyChange the output file with the
-oargument.
python3 hosts_report.py -o host_details.csvAPI debugging can be enabled using the
-dargument.
python3 hosts_report.py -dCommand-line help
Command-line help is available via the -h argument.
usage: hosts_report.py [-h] [-d] [-o OUTPUT_PATH] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
_ _ ______ ______ _______ ______
| | | | / | | \ / | | | / |
| |--| | | | | | '------. | | '------.
|_| |_| \_|__|_/ ____|_/ |_| ____|_/
______ ______ ______ ______ ______ _______
| | | \ | | | | | \ / | | \ | | | \ | |
| |__| | | |---- | |__|_/ | | | | | |__| | | |
|_| \_\ |_|____ |_| \_|__|_/ |_| \_\ |_|
This script was developed by @Don-Swanson-Adobe and is intended to
replace the manual daily export of hosts from the Falcon Console that
was required to audit host compliance. It was developed to be run as
a recurring job and will output a CSV with all hosts in the CID along
with other required info that can then be imported into a compliance
dashboard or tool.
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Location to store CSV output
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Host Search
This script will take a file listing of hostnames (one host per line) or a single hostname provided at runtime to produce a CSV containing the details for hosts that are found. This solution can be used to compare a list of hostnames to the list of hosts in the Falcon Console to determine which hostnames are not currently reporting in to the console.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will assume the file containing serial numbers is called "serials.txt" and is stored in the same folder. That tag that will be added will have a value of "TEST_TAG".
python3 host_search.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 host_search.pyRead the file "new_hosts.txt" and search for matches.
python3 host_search.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -f new_hosts.txtSearch for the hostname
example-host.
python3 host_search.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -n example-hostOutput results to a different CSV file.
python3 host_search.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -o new_hosts.csvAPI debugging can be enabled using the
-dargument.
python3 host_search.py -dCommand-line help
Command-line help is available via the -h argument.
usage: host_search.py [-h] [-d] [-f HOSTNAME_FILE] [-n HOSTNAME] [-o OUTPUT_PATH] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
_ _ _ _____ _
| | | | | | / ___| | |
| |_| | ___ ___| |_ \ `--. ___ __ _ _ __ ___| |__
| _ |/ _ \/ __| __| `--. \/ _ \/ _` | '__/ __| '_ \
| | | | (_) \__ \ |_ /\__/ / __/ (_| | | | (__| | | |
\_| |_/\___/|___/\__| \____/ \___|\__,_|_| \___|_| |_|
This script will take a file listing of hostnames (one host per line) or
a single hostname provided at runtime to produce a CSV containing the
details for hosts that are found. This solution can be used to compare a
list of hostnames to the list of hosts in the Falcon Console to determine
which hostnames are not currently reporting in to the console.
Developed by @Don-Swanson-Adobe
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-f HOSTNAME_FILE, --hostname_file HOSTNAME_FILE
Text file containing hostnames to search for
-n HOSTNAME, --hostname HOSTNAME
Hostname to search for
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Location to store CSV output
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Host Search Advanced
This script retains the original functionality of host_search.py above, but adds in functionality for partial matches of hostnames. This will help with endpoint discovery where the domain is known, or a pattern of host naming is known, but not all endpoints have been discovered.
This script will also ignore comments in a hostname file, thus keeping the output.csv cleaner.
To read an input file of hostnames, the -f option (used in the original host_search.py) has been changed to -i. This made more sense considering the more "insensitive" nature of the search, and makes a visual identification of the full command easier if you use both the original host_search.py, and the host_search_advanced.py. A potential use case could be to discover hosts using the 'advanced' search, in order to reconcile with hostname files for use with the original host search.
Command-line help
Command-line help is available via the -h argument.
usage: host_search_advanced.py [-h] [-d] [-n HOSTNAME] [-i INPUT_FILE] [-o OUTPUT_PATH]
[-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
_ _ _ ____ _
| | | | ___ ___| |_ / ___| ___ __ _ _ __ ___| |__
| |_| |/ _ \/ __| __| \___ \ / _ \/ _` | '__/ __| '_ \
| _ | (_) \__ \ |_ ___) | __/ (_| | | | (__| | | |
|_| |_|\___/|___/\__| |____/ \___|\__,_|_| \___|_| |_|
_ _ _
/ \ __| |_ ____ _ _ __ ___ ___ __| |
/ _ \ / _` \ \ / / _` | '_ \ / __/ _ \/ _` |
/ ___ \ (_| |\ V / (_| | | | | (_| __/ (_| |
/_/ \_\__,_| \_/ \__,_|_| |_|\___\___|\__,_|
This script will take a file listing of hostnames (one host per line) or
a single hostname provided at runtime to produce a CSV containing the
details for hosts that are found. This solution can be used to compare a
list of hostnames to the list of hosts in the Falcon Console to determine
which hostnames are not currently reporting in to the console, or to discover hosts based on a partial match of the hostname. Comments in input files are also ommitted from lookup, thus keeping the output.csv clean, and allowing you to work with more useful host name files/inventory.
Developed by @Don-Swanson-Adobe, additional functionality by @David-M-Berry
options:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-n HOSTNAME, --hostname HOSTNAME
Hostname to search for
-i INPUT_FILE, --input_file INPUT_FILE
Text file containing hostnames to search for
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Location to store CSV output
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretList sensors by hostname
Loops through all hosts and displays the hostname and sensor version.
There are multiple variations of this sample demonstrating different options for achieving the same goals.
Displays all hosts along with their sensor version. Maximum number of results returned: 10,000
Displays all hosts along with their sensor version. No maximum on number of hosts returned.
Displays all hosts along with their sensor version. No maximum on number of hosts returned. Leverages multiple threads to speed up results processing.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
These samples leverage simple command-line arguments to implement functionality.
All keywords are available in all three samples.
Execute the simple example.
python3 sensor_versions_by_hostname.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETExecute the scrolling example, reversing the sort.
python3 sensor_versions_by_hostname_scrolling.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -rExecute the advanced example and return results for a child tenant.
python3 sensor_versions_by_hostname_advanced.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -m $CHILD_CIDExecute the advanced example for a GovCloud tenant.
python3 sensor_versions_by_hostname_advanced.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -b usgov1Command-line help
Command-line help is available via the -h argument.
python3 sensor_versions_by_hostname.py -h
usage: sensor_versions_by_hostname.py [-h] -k CLIENT_ID -s CLIENT_SECRET [-m MSSP] [-b BASE_URL] [-r]
List sensors versions by hostname
optional arguments:
-h, --help show this help message and exit
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key ID
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API key secret
-m MSSP, --mssp MSSP Child CID to access (MSSP only)
-b BASE_URL, --base_url BASE_URL
CrowdStrike API region (us1, us2, eu1, usgov1). NOT required unless you are using `usgov1`.
-r, --reverse Reverse sort (defaults to ASC)Example source code
The source code for these examples can be found here:
List duplicate sensors
Retrieves a list of duplicate sensors across all hosts within your tenant. Can optionally hide (and then restore) duplicate sensors identified.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ, WRITE
Execution syntax
This application leverages easy to use command line arguments to implement functionality.
List just duplicate sensors.
python3 duplicate_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETPerform the same lookup against a tenant within GovCloud.
python3 duplicate_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -b usgov1List all hosts (including duplicates).
python3 duplicate_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -aSearch a child tenant.
python3 duplicate_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -a -m CHILD_CIDHide duplicate sensors identified.
python3 duplicate_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -dRestore previously removed duplicates.
python3 duplicate_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -r HOST_LIST_FILECommand-line help
Command-line help is available via the -h argument.
% python3 duplicate_sensors.py -h
usage: duplicate_sensors.py [-h] [-b BASE_URL] [-d] [-r RESTORE_DUPLICATES] [-a] [-m MSSP] -k FALCON_CLIENT_ID -s FALCON_CLIENT_SECRET
Duplicate sensor detection and removal.
______ __ __ __ ______ __ __
| _ \ .--.--.-----| |__.----.---.-| |_.-----. | _ \ .-----| |_.-----.----| |_.-----.----.
|. | \| | | _ | | | __| _ | _| -__| |. | \| -__| _| -__| __| _| _ | _|
|. | |_____| __|__|__|____|___._|____|_____| |. | |_____|____|_____|____|____|_____|__|
|: 1 / |__| |: 1 /
|::.. . / |::.. . / CrowdStrike FalconPy v1.2
`------' `------'
01.25.23 - jshcodes@CrowdStrike
optional arguments:
-h, --help show this help message and exit
-b BASE_URL, --base_url BASE_URL
CrowdStrike Region (us1, us2, eu1, usgov1)
Only required for GovCloud users.
-d, --delete_duplicates
Remove duplicate hosts from the CrowdStrike console.
-r RESTORE_DUPLICATES, --restore_duplicates RESTORE_DUPLICATES
Restores prevously deleted duplicates using a save file.
-a, --all Display all hosts, not just duplicates.
-m MSSP, --mssp MSSP CID of a child tenant to access.
required arguments:
-k FALCON_CLIENT_ID, --falcon_client_id FALCON_CLIENT_ID
CrowdStrike Falcon API client ID.
-s FALCON_CLIENT_SECRET, --falcon_client_secret FALCON_CLIENT_SECRET
CrowdStrike Falcon API client secret.Example source code
The source code for this example can be found here.
List stale sensors
Retrieves a list of hosts that have not been seen since the number of days specified. Can optionally hide the hosts identified.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ, WRITE
Execution syntax
The following command will retrieve a list of hosts that haven't checked in to CrowdStrike in 30 days or more.
python3 stale_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -d 30Perform the same lookup against a tenant within GovCloud.
python3 stale_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -d 30 -gThis variation will retrieve a list of hosts that haven't checked in to CrowdStrike in 30 days or more that have the tag testtag.
python3 stale_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -d 30 -t testtagThis variation leverages a regular expression to match the host "SDKDEMO3".
python3 stale_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -d 30 -p "^SDK.*3$"You can reverse the list sort with the -r or --reverse argument.
python3 stale_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -d 30 --reverseThe following command will hide any hosts that haven't checked in to CrowdStrike in 30 days or more. You may also use -x to accomplish this.
python3 stale_sensors.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -d 30 --removeCommand-line help
Command-line help is available via the -h argument.
% python3 stale_sensors.py -h
usage: stale_sensors.py [-h] -k CLIENT_ID -s CLIENT_SECRET [-m MSSP] [-g] [-d DAYS] [-r] [-x] [-t TAG] [-c] [-o OUTPUT_FILE] [-q]
[-f {windows,mac,linux,k8s}] [-p HOSTFILTER]
CrowdStrike Unattended Stale Sensor Environment Detector.
_______ ___ ___ _______ _______ _______ ______
| _ | Y | _ | _ | _ | _ \
|. 1___|. | | 1___| 1___|. 1___|. | \
|. |___|. | |____ |____ |. __)_|. | \
|: 1 |: 1 |: 1 |: 1 |: 1 |: 1 /
|::.. . |::.. . |::.. . |::.. . |::.. . |::.. . /
`-------`-------`-------`-------`-------`------'
stale_sensors.py - Detects devices that haven't checked into
CrowdStrike for a specified period of time.
REQUIRES: crowdstrike-falconpy v0.9.0+, python-dateutil, tabulate
This example will work for all CrowdStrike regions. In order to produce
results for the US-GOV-1 region, pass the '-g' argument.
- jshcodes@CrowdStrike; 09.01.21
- [email protected]; 03.29.22 - Added new argument for Grouping Tags (--grouping, -g)
- @morcef, jshcodes@CrowdStrike; 06.05.22 - More reasonable date calcs, Linting, Easier arg parsing
Easier base_url handling, renamed grouping_tag to tag
- jshcodes@Crowdstrike; 11.02.22 - Added CSV output options and cleaner date outputs.
- nmills@forbarr; 22.05.24 - Fixed deprecation warning on date function,
Added new arg to accept hostname pattern
Batch the call to hide_hosts to avoid API error
optional arguments:
-h, --help show this help message and exit
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key ID
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API key secret
-m MSSP, --mssp MSSP Child CID to access (MSSP only)
-g, --govcloud Use the US-GOV-1 region
-d DAYS, --days DAYS Number of days since a host was seen before it is considered stale
-r, --reverse Reverse sort (defaults to ASC)
-x, --remove Remove hosts identified as stale
-t TAG, --tag TAG Falcon Grouping Tag name for the hosts
-c, --csv Export results to CSV
-o OUTPUT_FILE, --output_file OUTPUT_FILE
File to output CSV results to. Ignored when "-c" is not specified.
-q, --quotes Quote non-numeric fields in CSV output.
-f {windows,mac,linux,k8s}, --filter-by-os {windows,mac,linux,k8s}
OS filter (windows, macos, linux)
-p HOSTFILTER, --host-pattern HOSTFILTER
filter hostnames by regexExample source code
The source code for this example can be found here.
Policy Check
This program will check if a specific host group is properly assigned to a list of Prevention Policies.
Note: This sample also demonstrates pythonic response handling using the Advanced Uber Class (APIHarnessV2).
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will check within the local tenant that the group has the policies assigned listed in the
-pargument.
python3 policy_check.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -g GROUP_NAME -p POLICY_ID_1,POLICY_ID_2This sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 policy_check.py -g GROUP_NAME -p POLICY_ID_1,POLICY_ID_2Enable MSSP mode and create the groups within all child CIDs.
python3 policy_check.py -k $FALCON_CLIENT_ID_PARENT -s $FALCON_CLIENT_SECRET_PARENT -g GROUP_NAME -p POLICY_ID_1,POLICY_ID_2 -mEnable MSSP mode and create the groups within a specific child CID.
python3 policy_check.py -k $FALCON_CLIENT_ID_PARENT -s $FALCON_CLIENT_SECRET_PARENT -g GROUP_NAME -p POLICY_ID_1,POLICY_ID_2 -c CHILD_CIDAPI debugging can be enabled using the
-dargument.
python3 policy_check.py -dCommand-line help
Command-line help is available via the -h argument.
usage: policy_check.py [-h] [-d] [-m] [-c CHILD] [-k CLIENT_ID] [-s CLIENT_SECRET] -g GROUP_NAME -p POLICY_IDS
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
__ ___ ___ ___
.'|=| | .'|=|`. .'| .'| .'|=|_.' | | | |
.' | | | .' | | `. .' | .' | .' | `. |_| .'
| |=|.' | | | | | | | | | | `. .'
| | `. | | .' | | ___ | | `. | ___ | |
|___| `.|=|.' |___|=|_.' |___| `.|=|_.' |___|
___ ___ ___
.'|=|_.' .'| |`. .'|=|_.' .'|=|_.' .'| .'|
.' | .' | | `. .' | ___ .' | .' | .' .'
| | | |=| | | |=|_.' | | | |=|.:
`. | ___ | | | | | | ___ `. | ___ | | |'.
`.|=|_.' |___| |___| |___|=|_.' `.|=|_.' |___| |_|
This program will check if a specific host group is properly
assigned to a list of Prevention Policies.
Created by: @Don-Swanson-Adobe
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-m, --mssp List groups in all child CIDs (MSSP parents only)
-c CHILD, --child CHILD
List groups in a specific child CID (MSSP parents only)
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secret
-g GROUP_NAME, --group_name GROUP_NAME
Group name to check
-p POLICY_IDS, --policy_ids POLICY_IDS
Policy IDs to confirm (comma delimit)Example source code
The source code for these examples can be found here.
Match usernames to hosts
Submitted by @micgoetz, this example demonstrates leveraging the QueryDeviceLoginHistory method to identify the most common username for hosts within a Falcon tenant. Hosts are then tagged with a Falcon Grouping Tag to reflect this identified user.
Running the program.
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ, WRITE
Execution syntax
Generic execution.
python3 match_username_to_hosts.py -c APIClientID -s APISecretIDTest the results of execution without taking action.
python3 match_username_to_hosts.py -c APIClientID -s APISecretID -tLoad a username to host mapping file.
python3 match_username_to_hosts.py -c APIClientID -s APISecretID -i PathToMyCSV.csv -tRemove grouping tags set by this routine.
python3 match_username_to_hosts.py -c APIClientID -s APISecretID -rChange your BASE_URL to point to GovCloud.
python3 match_username_to_hosts.py -c APIClientID -s APISecretID -b usgov1Command-line help
Command-line help is available via the -h argument.
usage: match_username_to_host.py [-h] -c CLIENT_ID -s CLIENT_SECRET [-b BASE_URL] [-m MSSP] [-i INPUT_FILE] [-t] [-r]
Identify usernames for specific hosts.
88 88 88
88 ,d "" 88
88 88 88
,adPPYba, 8b,dPPYba, ,adPPYba, 8b db d8 ,adPPYb,88 ,adPPYba, MM88MMM 8b,dPPYba, 88 88 ,d8 ,adPPYba,
a8" "" 88P' "Y8 a8" "8a `8b d88b d8' a8" `Y88 I8[ "" 88 88P' "Y8 88 88 ,a8" a8P_____88
8b 88 8b d8 `8b d8'`8b d8' 8b 88 `"Y8ba, 88 88 88 8888[ 8PP"
"8a, ,aa 88 "8a, ,a8" `8bd8' `8bd8' "8a, ,d88 aa ]8I 88, 88 88 88`"Yba, "8b, ,aa
`"Ybbd8"' 88 `"YbbdP"' YP YP `"8bbdP"Y8 `"YbbdP"' "Y888 88 88 88 `Y8a `"Ybbd8"'
Created: 05/08/2022, micgoetz@CrowdStrike
Updated: 05/24/2022, micgoetz@CrowdStrike
This script will grab ALL (max 5000) of your CrowdStrike-installed devices and auto-tag each one based upon the most common
username seen. Or, provide a csv file with hosts and usernames you want to tag each with.
Most common username is determined by looking at the last 10 logins.
Requires: crowdstrike-falconpy
python3 -m pip install crowdstrike-falconpy
This program requires your:
- API Client ID
- API Secret ID
With permissions:
Hosts: Read + Write
optional arguments:
-h, --help show this help message and exit
-c CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key ID
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API key secret
-b BASE_URL, --base_url BASE_URL
CrowdStrike API region (us1, us2, eu1, usgov1). NOT required unless you are using `usgov1`.
-m MSSP, --mssp MSSP Child CID to access (MSSP only)
-i INPUT_FILE, --input_file INPUT_FILE
The path to a csv with only hostnames & usernames. Expected format: 'hostname, username'
-t, --test run the program and output the results that would take place but take no action
-r, --remove remove falcon grouping tags, undoing whatever was originally done by this scriptExample source code
The source code for this example can be found here.
Comparing QueryDevicesByFilter and QueryDevicesByFilterScroll (Offset vs. Token)
This routine queries all of the hosts in your environment using the QueryDevicesByFilter and the QueryDevicesByFilterScroll operations. The results of the two methods are then compared for equivalency. This sample demonstrates how to use both operations to paginate through large result sets, and discusses the inherent limitations of the QueryDevicesByFilter operation.
Running the program.
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This example requires no input parameters.
python3 offset_vs_token.pyExample source code
The source code for this example can be found here.
Prune Hosts by Hostname or AID
Search for and optionally remove hosts by hostname or AID. Removed host AIDs are saved to a file which can be leveraged to restore removed hosts.
Running the program.
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ, WRITE
Execution syntax
List hosts by hostname or AID.
python3 prune_hosts.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -f HOSTNAMERemove identified hosts.
python3 prune_hosts.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -f HOSTNAME -dRestore previously deleted hosts from the restore file.
python3 prune_hosts.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -r -a RESTORE_FILENAMERestore previously deleted hosts by AID.
python3 prune_hosts.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -r -a AID1,AID2,AID3Change your BASE_URL to point to GovCloud.
python3 prune_hosts.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -b usgov1Search a child tenant for hosts to remove.
python3 prune_hosts.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRET -f HOSTNAME -m CHILD_CIDCommand-line help
Command-line help is available via the -h argument.
python3 prune_hosts.py -h
usage: prune_hosts.py [-h] [-b BASE_URL] [-f FIND] [-r] [-a AIDS] [-d] [-m MSSP] -k FALCON_CLIENT_ID -s FALCON_CLIENT_SECRET
Remove sensors by name or AID sample.
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy v1.2
`-------' `-------'
__ __ ___ _____ ______ ____ ____ __ __ ____ ___ ____
| T T / \ / ___/| T | \| \ | T T| \ / _]| \
| l |Y Y( \_ | | | o ) D )| | || _ Y / [_ | D )
| _ || O | \__ Tl_j l_j | _/| / | | || | |Y _]| /
| | || | / \ | | | | | | \ | : || | || [_ | \
| | |l ! \ | | | | | | . Yl || | || T| . Y
l__j__j \___/ \___j l__j l__j l__j\_j \__,_jl__j__jl_____jl__j\_j
Removes hosts by hostname or AID. Can restore hosts that have been removed.
02.11.23 - jshcodes@CrowdStrike
optional arguments:
-h, --help show this help message and exit
-b BASE_URL, --base_url BASE_URL
CrowdStrike Region (us1, us2, eu1, usgov1)
Only required for GovCloud users.
-f FIND, --find FIND Hostname or AID string to use to identify hosts for removal.
Hostname searches are stemmed, AID searches must be an exact match.
-r, --restore Restores prevously deleted hosts using a save file or list of AIDs.
Specify the AID list or filename using the `-a` command line argument.
-a AIDS, --aids AIDS List of AIDs to restore (comma delimited string or a filename).
-d, --delete Perform the delete, default behavior is to list only.
-m MSSP, --mssp MSSP CID of a child tenant to access (MSSP only).
required arguments:
-k FALCON_CLIENT_ID, --falcon_client_id FALCON_CLIENT_ID
CrowdStrike Falcon API client ID.
-s FALCON_CLIENT_SECRET, --falcon_client_secret FALCON_CLIENT_SECRET
CrowdStrike Falcon API client secret.Example source code
The source code for this example can be found here.
RFM Report
This script determines the number of hosts in RFM (Up for more than 24 hours and seen within the last 24 hours) in your tenant or every child tenant attached to your parent.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Flight Control
READ (MSSP usage only)
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will output results for your tenant (only) to a CSV file called
RFM_Report.csv.
python3 rfm_report.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 rfm_report.pyThe output file name can be changed using the
-oargument.
python3 rfm_report.py -o my_rfm_report.csvFor MSSP scenarios, provide your parent credentials and activate MSSP mode with the
-margument.
python3 rfm_report.py -k $FALCON_CLIENT_ID_PARENT -s $FALCON_CLIENT_SECRET_PARENT -mAPI debugging can be enabled using the
-dargument.
python3 rfm_report.py -dCommand-line help
Command-line help is available via the -h argument.
usage: rfm_report.py [-h] [-d] [-m] [-o OUTPUT_PATH] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
██████ ███████ ███ ███ ██████ ███████ ██████ ██████ ██████ ████████
██ ██ ██ ████ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
██████ █████ ██ ████ ██ ██████ █████ ██████ ██ ██ ██████ ██
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
██ ██ ██ ██ ██ ██ ██ ███████ ██ ██████ ██ ██ ██
This script was developed by @Developed by Don-Swanson-Adobe to determine the
number of hosts in RFM (Up for more than 24 hours and seen within the last 24
hours) in your tenant or every child tenant attached to your parent.
Developed by @Don-Swanson-Adobe
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-m, --mssp Return RFM details for child CIDs (MSSP parents only).
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Location to store CSV output
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Serial Search
This script takes a file listing Serial Numbers and outputs a CSV with the Serial Number, Hostname, CID, RFM, Last Seen, Local IP, and Tags for each host in the list. This list can be used to compare a list of serial numbers to the list of hosts in the Falcon Console to determine which serial numbers are not currently reporting to the console.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Hosts
READ
Execution syntax
This samples leverages simple command-line arguments to implement functionality.
Execute the default example. This will output results to a CSV file named
output.csv.
python3 serial_search.py -k $FALCON_CLIENT_ID -s $FALCON_CLIENT_SECRETThis sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
python3 serial_search.pyChange the output file with the
-oargument.
python3 serial_search.py -o search_results.csvChange the input file containing the serials to search for using the
-fargument.
python3 serial_search.py -f serials_to_find.txtAPI debugging can be enabled using the
-dargument.
python3 serial_search.py -dCommand-line help
Command-line help is available via the -h argument.
usage: serial_search.py [-h] [-d] [-f SERIAL_FILE] [-o OUTPUT_PATH] [-k CLIENT_ID] [-s CLIENT_SECRET]
_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | |::.. . | FalconPy
`-------' `-------'
8¯¯¯¯8 8¯¯¯¯8
8 eeee eeeee e eeeee e 8 eeee eeeee eeeee eeee e e
8eeeee 8 8 8 8 8 8 8 8eeeee 8 8 8 8 8 8 8 8 8
88 8eee 8eee8e 8e 8eee8 8e 88 8eee 8eee8 8eee8e 8e 8eee8
e 88 88 88 8 88 88 8 88 e 88 88 88 8 88 8 88 88 8
8eee88 88ee 88 8 88 88 8 88eee 8eee88 88ee 88 8 88 8 88e8 88 8
This script takes a file listing Serial Numbers and outputs a CSV with the
Serial Number, Hostname, CID, RFM, Last Seen, Local IP, and Tags for each
host in the list. This list can be used to compare a list of serial numbers
to the list of hosts in the Falcon Console to determine which serial numbers
are not currently reporting to the console.
Developed by @Don-Swanson-Adobe
optional arguments:
-h, --help show this help message and exit
-d, --debug Enable API debugging
-f SERIAL_FILE, --serial_file SERIAL_FILE
Text file contain serial numbers of hosts to tag
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Location to store CSV output
Required arguments:
-k CLIENT_ID, --client_id CLIENT_ID
CrowdStrike Falcon API key
-s CLIENT_SECRET, --client_secret CLIENT_SECRET
CrowdStrike Falcon API secretExample source code
The source code for these examples can be found here.
Last updated
Was this helpful?