CrowdStrike / psfalcon

PowerShell for CrowdStrike's OAuth2 APIs
The Unlicense
350 stars 66 forks source link

[ BUG ] `SensorTag` and `Uninstall` commands do not handle MacOS uninstallation tokens #400

Open adub24 opened 4 months ago

adub24 commented 4 months ago

Describe the bug When executing the Add-FalconSensorTag and targeting a MACOS host, the process does not pull maintenance token information or pass it to the falconctl executable with the -t flag. The results of the entire process will complete as successful but the tag will not be successfully added.

To Reproduce run Add-FalconSensorTag and target a MacOS host

Expected behavior Tag should be applied to the host when running the Add-FalconSensorTag command For the tag to be officially applied, a reboot of the sensor must happen, but this is not required as part of this process.

Environment (please complete the following information):

Additional context It appears that a maintenance token is not required with Windows (and maybe linux), so this may be a step specific to MacOS.

Transcript content

1. Set $VerbosePreference = 'Continue' 2. Run Import-Module, Request-FalconToken, Start-Transcript, Show-FalconModule, the affected PSFalcon commands or script, and Stop-Transcript 3. Copy/paste transcript content
bk-cs commented 2 months ago

Updated to use this issue to track Uninstall-FalconSensor support as well