Find-FalconDuplicate: exporting and hiding duplicates

[f1r3walled]

Hello,
I'm trying to use the script to Find and Hide Duplicates. I'm able to successfully authenticate and validate the connection.
When I use the latest version of PSFalcon, which is indicated as 2.1.4, I have no error but nothing happens. I see that a list of potential hosts to be hidden are shown on the screen, but the file duplicates.csv isn't being created and nothing happens looking at the console through "Host Management" session.

When I try to download the current code, which is named as "bk-cs v2.1.5", I have a lot of error when trying to "ImportModule".

I'm using the intended version of PowerShell (+5.1) and I'm properly authenticating at "us-2" using the parameter "-Cloud".

[bk-cs]

v2.1.5 hasn't been released, and is currently under development. I recommend staying with v2.1.4 until v2.1.5 is officially released.

To make sure you have no versions other than the latest official release, you can delete that 2.1.5 folder that you created and do the following:

Uninstall-Module -Name PSFalcon -AllVersions
Install-Module -Name PSFalcon -Scope CurrentUser

The script example has mostly been replaced by functionality native to Find-FalconDuplicate. If you'd like produce a spreadsheet of potential duplicates, you can run this:

Find-FalconDuplicate | Export-Csv .\duplicates.csv

Once the list is produced, if you agree with the results, you can:

$Duplicates = (Import-Csv .\duplicates.csv).device_id
Invoke-FalconHostAction -Name hide_hosts -Ids $Duplicates

[bk-cs]

I saw this same import-related error with another user. I suspect it is due to the size of the file that contains the Uninstall-FalconSensor command. The next version of PSFalcon (v2.1.5) will break this file up into smaller files in an effort to fix it.

[mmaticnav]

is it possible to include additional fields into the csv that gets exported, e.g. platform and/or OS and/or lastseen?

[bk-cs]

is it possible to include additional fields into the csv that gets exported, e.g. platform and/or OS and/or lastseen?

In the latest version of PSFalcon (v2.2.6) Find-FalconDuplicate exports the following fields: cid, device_id, first_seen, last_seen and hostname. You cannot modify those fields.

You can write your own script that exports all devices, discovers duplicates and exports with your desired information using the Get-FalconHost command. Something like this will replicate what Find-FalconDuplicate is doing:

$HostList = Get-FalconHost -Detailed -All
@($HostList | Group-Object cid,hostname).Where({$_.Count -gt 1 -and $_.Name}).foreach{
  $_.Group | Sort-Object last_seen | Select-Object -First ($_.Count - 1)
} | Select-Object cid,device_id,first_seen,last_seen,hostname,platform_name

[mmaticnav]

thank you, I will have a play around :)