CrowdStrike / falcon-scripts

Scripts to streamline the deployment and use of the CrowdStrike Falcon sensor
The Unlicense
154 stars 90 forks source link

Enhance uninstall / install script with additional features #92

Closed ps4signedout closed 1 year ago

ps4signedout commented 1 year ago

usecase: migration from US to EU i.e. steps:

  1. retrieve uninstall token by using API (no powershell SDK integration)
  2. retrieve all relevant tags (sensor AND Falcon) from old environment
  3. write all into $hostname.csv (configurable)
  4. uninstall sensor
  5. verify uninstall
  6. download sensor and retrieve CID
  7. install sensor including sensor-tags as derived from step 2 from CSV file of #3
  8. retrieve maintenance token from new environment
  9. set Falcon tags derived in step 2 from CSV file of #3
  10. verify sensor
  11. remove orphaned host from old environment or set FLAG "moved"

Most probably it will not be one script more like an uninstall.ps1 && install.ps1 approach ;-)

ffalor commented 1 year ago

Changes to install/uninstall:

Migration Script: