sensor_update_policies
Sensor Update Policies examples
The examples in this folder focus on leveraging CrowdStrike's Sensor Update Policies API to adjust sensor update policy settings.
Sensor Update Policy Cloner
This script will clone one or all sensor update policies from one CID to another.
Running the program
In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:
Sensor Update Policy
READ, WRITE
[!NOTE] You will need READ permissions on the source CID and WRITE permissions on the destination CID.
Execution syntax
This sample leverages simple command-line arguments to implement functionality.
Basic usage
Clone all policies from one CID to another CID.
This sample supports Environment Authentication, meaning you can execute this program without providing credentials for the source CID if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
Only clone a specific policy.
API debugging can be enabled using the
-dargument.
Command-line help
Command-line help is available via the -h argument.
Example source code
The source code for this example can be found here.
Create Host Group and attach to sensor update policy
This script will create a host group. If a list of sensor update policy IDs are provided, the newly created host group is added to each policy in the list. This can assist with complex group creation that may be difficult to perform in the console.
[!NOTE] If you set custom and/or criteria using the API, editing the group in the Falcon console will remove this criteria upon save.
Running the program
In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:
Host Group
READ, WRITE
Sensor Update Policy
READ, WRITE
Execution syntax
This sample leverages simple command-line arguments to implement functionality.
Basic usage
Create a simple host group with no settings.
This sample supports Environment Authentication, meaning you can execute this program without providing credentials if you have the values
FALCON_CLIENT_IDandFALCON_CLIENT_SECRETdefined in your environment.
Attach the newly created group to two sensor update policies.
Create a host group, setting all available parameters.
API debugging can be enabled using the
-dargument.
Command-line help
Command-line help is available via the -h argument.
Example source code
The source code for this example can be found here.
Manage sensor update policies with Policy Wonk
Manages CrowdStrike Falcon sensor update policy. Using this tool you can enable and disable policies, and their uninstall protection. You can create and remove policies. Policies can be updated with new host groups and precedence can be reordered.
Running the program
In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:
Host Group
READ
Sensor Update Policy
READ, WRITE
Execution syntax
This example accepts the following input parameters.
-h, --help
Show help message and exit
optional
-l, --list_all
Show all policies (Default action)
list
-k, --kernels
Show kernel build compatibility details
list
-b, --builds
Show available builds
list
-o, --host_groups
Show available host groups
list
-m, --maintenance
Show maintenance or a specific uninstall token
list
-v, --show_members
Show policy members in results
list
-z, --show_groups
Show host groups assigned to policies in results
list
-q SEARCH_STRING,
--search_string SEARCH_STRING
String to match against policy or host group name
search
-c, --create
Create a new policy
create
-d, --disable
Disable the policy
update and delete
-e, --enable
Enable the policy
update and delete
-x, --disable_uninstall_protection
Disable uninstall protection for the policy
update and delete
-u, --enable_uninstall_protection
Enable uninstall protection for the policy
update and delete
-p, --precedence
Set policy precedence to match the order of the list, use the policy_id argument to provide the list
update and delete
-r, --remove
Remove the policy
update and delete
-g ADD_HOST_GROUP,
--add_host_group ADD_HOST_GROUP
Add host group to the specified policy (comma delimit)
update and delete
-y YANK_HOST_GROUP,
--yank_host_group YANK_HOST_GROUP
Remove host group from the specified policy (comma delimit)
update and delete
-i POLICY_ID,
--policy_id POLICY_ID
ID(s) of the policy to update or remove (comma delimit)
required for update and delete
-n PLATFORM_NAME,
--platform_name PLATFORM_NAME
Platform name for policy precedence configurations
required for update and delete
-f FALCON_CLIENT_ID,
--falcon_client_id FALCON_CLIENT_ID
Falcon Client ID
always required
-s FALCON_CLIENT_SECRET,
--falcon_client_secret FALCON_CLIENT_SECRET
Falcon Client Secret
always required
Examples
These examples demonstrate command line usage of this sample. Commands may be chained on the same command line as long as all actions make sense for the arguments provided.
Show command line help.
List all sensor update policies.
Change your base URL
You can change your base URL using the -t argument. This is only required for GovCloud users.
Result
List all sensor update policies (display members and host groups).
Search for a specific sensor policy by name.
List all available builds.
List all available kernels.
Show bulk maintenance token.
Show uninstall token. Multiple device IDs may be specified by delimiting with a comma.
List all available host groups.
Search for a specific host group by name.
Disable a sensor update policy. Multiple policy IDs may be specified by delimiting with a comma.
Enable a sensor update policy. Multiple policy IDs may be specified by delimiting with a comma.
Disable uninstall protection on a sensor update policy. Multiple policy IDs may be specified by delimiting with a comma.
Enable uninstall protection on a sensor update policy. Multiple policy IDs may be specified by delimiting with a comma.
Add a host group to a sensor update policy. Multiple host groups and policy IDs may be specified by delimiting with a comma.
Remove a host group from a sensor update policy. Multiple host groups and policy IDs may be specified by delimiting with a comma.
Set policy precedence. Precedence will be determined by the order of the list provided.
Delete a sensor update policy.
Create a new sensor update policy.
Command-line help
Command-line help is available using the -h or --help parameters.
Example source code
The source code for this example can be found here.
Last updated
Was this helpful?