CrowdStrike / falcon-scripts

Scripts to streamline the deployment and use of the CrowdStrike Falcon sensor
The Unlicense
144 stars 84 forks source link

API for RHEL/.. os filter is inconsistent #93

Closed carlosmmatos closed 1 year ago

carlosmmatos commented 1 year ago

This PR fixes an issue affecting RHEL family only. For RHEL based systems, you can see a few different variations for theos: output of the sensor query. This ensures we capture any RHEL based os version to ensure we account for RHEL 9, arm, and x64.

Example filter w/ change:

'filter=os:"*RHEL*"+os_version:~"arm64"'

This is also consistent with Ansible/Puppet/Chef