CrowdStrike / ansible_collection_falcon

Comprehensive toolkit for streamlining your interactions with the CrowdStrike Falcon platform.
https://galaxy.ansible.com/ui/repo/published/crowdstrike/falcon/
GNU General Public License v3.0
93 stars 56 forks source link

Ubuntu 24.04 support #530

Closed ktinthecloud closed 2 months ago

ktinthecloud commented 2 months ago

Does this collection support Ubuntu 24.04 yet?

carlosmmatos commented 2 months ago

@ktinthecloud - the short answer is no, we don't officially support 24.04 yet - I believe it's slated for 7.17+ but until CRWD makes it official there is nothing we can do about that part.

I will say that there is an unofficial way you may be able to do this. Basically you will install the latest sensor from ubuntu 22.04 and it should run in user-mode (ebpf).

[!WARNING] This is not supported from CRWD

If you are interested in testing this out from our collection, you can try the following for falcon_install:

---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_os_version: "*22*"

You are basically overriding the default: falcon_os_version: "*{{ ansible_facts['distribution_major_version'] }}*"

ktinthecloud commented 2 months ago

@carlosmmatos - I think I will just wait until 24.04 is officially supported. Thanks for the info and work around.