Need help in deploying a script on a group tag

[DiegoMessi1711]

Hello, so I am looking to deploy a shell script across a group of linux servers to be executed and fetch an output. The list could span across 5000 plus servers. I am relatively new to powershell. Therefore, I need to test this first across a smaller set using the Invoke-Rtr option. Could you please help me in doing this? I am trying to make use of the script that could be deployed on the group tag itself . I came across this link https://github.com/CrowdStrike/psfalcon/wiki/Basic-Scripts#run-a-command-against-a-group-of-devices

And have some queries which I have posted inline with the script, Could you tell me if I am heading in the right direction? If you think a better script could help me in getting the desired output please suggest the same.

Find group identifier using 'name' filter

$GroupId = Get-FalconHostGroup -Filter "name:'$($GroupName.ToLower())'" --- Do I use the group name here instead of $GroupName?

if ($GroupId) {
# Get host identifiers for members of $GroupId
$Members = Get-FalconHostGroupMember -Id $GroupId -All
} else {
throw "No host group found matching '$GroupName'"
}
if ($Members) {
# Set filename for CSV export
$ExportName = "$pwd\rtr_$($Command -replace ' ','')$GroupId.csv" ---Need some help in placing the shell script in the export name. How do I use the shell script in the EXport Name.

# Set base parameters for Invoke-FalconRTR
$Param = @{
    Command = $Command  ---- What is expected in the $Command section? like a "Command = 'runscript' with the full argument for running the shell script: e.g.  '-Raw= ./myshell_script.sh'
    HostIds = $Members
}
switch ($PSBoundParameters.Keys) {
    # Append parameters from user input that match Invoke-FalconRTR
    { $_ -ne 'GroupName' } {
        $Param[$_] = $PSBoundParameters.$_ ----What is needed here?
    }
}
# Issue command and export results to CSV
Invoke-FalconRTR @Param | Export-Csv -Path $ExportName ---  What is required in $Export-Name? The entire path of the CSV file to be exported or just the name of the CSV file is good enough?

if (Test-Path $ExportName) {
    # Display CSV file
    Get-ChildItem $ExportName
}

} else {
throw "No members found in host group '$GroupName' [$GroupId]"
}

[bk-cs]

• Get-FalconHostGroup will only find matches for name values in the filter property when they're provided in lower case. $GroupName is used because it's part of that script example. You could replace "name:'$($GroupName.ToLower())'" with name:'my group name' and remove references to $GroupName.

• Invoke-FalconRtr expects either a single host identifier (-HostId), an array of host identifiers (-HostIds) or a group identifier (-GroupId). If you only want to run the command on a few hosts, you could just supply those individual identifiers. You can find the identifiers using Get-FalconHost -Filter "hostname:'my host name'" and then copy/paste the values, or create an array with those values by using a script that looks up multiple names.

I assume when you say "group tag" what you mean is SensorGroupingTag and not FalconGroupingTag, but for reference:

• SensorGroupingTag values are applied directly to a machine through falconctl (or the Windows registry) and permanently are associated with the device as long as Falcon is installed.
• FalconGroupingTag values are applied via the cloud, and are only associated with the device as long as it continues to report to the cloud. If it goes offline for more than 45 days, the value will no longer be associated.

If you're looking to assign a SensorGroupingTag, are you aware of Add-FalconSensorTag? It is designed to use Real-time Response (and an appropriate bash/zsh/PowerShell script) to add tag values to Mac, Linux or Windows devices. You could forget Invoke-FalconRtr and just use:

Add-FalconSensorTag -Tags my, example, tag, values -Ids <host_id_1>, <host_id_2>, <host_id_3>

[DiegoMessi1711]

I am looking at running the script across 3800 hosts, hence I was exploring the option of doing it using a group tag. Is there a better option of doing it? I don't think the option of "-Id host_id" is feasible here at all.

[bk-cs]

• Are the devices already in a group? Then use the id of that group with Invoke-FalconRtr under the GroupId parameter.
• Can you find a list of the devices you want to tag? Then use the ids of those devices in an array with Invoke-FalconRtr under the HostIds parameter.

You can tag the devices and then use the FalconGroupingTag (or SensorGroupingTag), but it's adding an extra step that you don't necessarily need to add.

If the only thing you want to do is add a tag, you can add a FalconGroupingTag with this:

Add-FalconGroupingTag -Tags my, tag, names -Ids <id>, <id>, <id>

Or add a SensorGroupingTag with this:

Add-FalconSensorTag -Tags my, tag, names -Ids <id>, <id>, <id>

Note that my example of <id>, <id>, <id> is simply meant to signify that it's an [array] of host id values. There are many different methods of getting those ids to use with the command.

Ultimately the RTR APIs work like this:

• Start session with one or more host identifiers
• Run command against identifiers
• If session involves a single host (versus more than one host), confirm results
• Output results
• Repeat

I think you're making it more complex than it really is. Here's an example of how I could run an RTR command against all my devices:

$Hosts = Get-FalconHost -All
Invoke-FalconRtr -Command ls -HostIds $Hosts

I could also add a -Filter to Get-FalconHost and limit it to a specific set of those devices:

$Hosts = Get-FalconHost -Filter "platform_name:'Linux'"
Invoke-FalconRtr -Command ls -HostIds $Hosts

[bryaner]

How do you filter using FalconGroupingTag, what is the name of the filter. I cannot find the Filtername

Get-FalconHost -Filter "falcongroupingtag:'FalconGroupingTag\mytag'"

[bryaner]

OK I found the answer.

Get-FalconHost -Filter "tags:'FalconGroupingTag\mytag'"