Get minimum sensor version supported for RFM hosts

[brucelourenco]

Hello community!
I need to make a report about all hosts in RFM state for one customer and deliver the requirements to plan how to put these hosts in compliance.
The problem is I'm checking the requirements host by host to make this report so far, and there are a lot of hosts to make this manual work.
I already checked the json from Hosts endpoint and could find the 'reduced_functionality_mode': 'yes' information, but is there another way/endpoint that can show me the details about minimum sensor requirements?

Thank you all!

[crowdstrikedcs]

Hi @brucelourenco is your intention to deliver a report showing which hosts need to be updated to a given sensor version to exit RFM? Have you tried using the query_combined_kernels operation? Since you have the detail of those hosts that are in an RFM state, the next step would be to grab the kernel version for those hosts and filter the response from query_combined_kernels to find the supported sensor version if available. This operation requires the read permission on the Sensor Update Polices scope.

Try out something like this:

response = falcon.query_combined_kernels(filter="release:'5.4.228-131.415.amzn2.x86_64'")

Here is the response body snippet

[brucelourenco]

Hi @brucelourenco is your intention to deliver a report showing which hosts need to be updated to a given sensor version to exit RFM?
Exactly Dixon! Thats it!
I'll make some tries using 'query_combined_kernels'.
I'll keep you in touch.
Thanks a lot!