-
Notifications
You must be signed in to change notification settings - Fork 65
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
2.2.6 #367
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Added `IamRoleArn` parameter to `New-FalconDiscoverAwsAccount`
Modified timeout for `Invoke-FalconDeploy` to default to 600 when using `put` and use `$Timeout` for other commands
Rearranged how `ApiClient.Invoke()` downloads files to eliminate "index out of range" error.
Created new `format.json` file to contain endpoint body/formdata/query parameter info for easier updating when there are large number of changes to API endpoints.
Added function `Get-EndpointFormat` to read body/formdata/query parameters from `format.json`. Replaced tab of four spaces with two to reduce file size. Moved code that replaces the user input parameters with proper parameter names for body payloads from the `Invoke-Falcon` function into the `Build-Content` function.
Replaced tab of four spaces with two to reduce file size.
Renamed `Inputs` to `UserInput` in keeping with PowerShell style. Replaced tab of four spaces with two to reduce file sizes.
Renamed `$Inputs` to `$UserInput`
Replaced tab of four spaces with two to reduce file size. Added code to import `format\format.json` when creating `$Script:Falcon` variable during initial access token request.
Replaced tab of four spaces with two to reduce file size. Renamed `Inputs` to `UserInput` in keeping with PowerShell style.
Replaced tab of four spaces with two to reduce file size. Renamed `Inputs` to `UserInput` in keeping with PowerShell style. Added `TenantId` and `ObjectId` parameters to `Update-FalconDiscoverAzureAccount`. Added parameters `TenantId`, `Status`, `Limit`, `Offset`, `All` and `Total` to `Get-FalconDiscoverAzureAccount`. Added `YearsValid` parameter to `Get-FalconDiscoverAzureCertificate`. Added parameters `ClientId`, `YearsValid`, `AccountType`, and `DefaultSubscription` to `New-FalconDiscoverAzureAccount`.
Replaced tab of four spaces with two to reduce file size.
Bug fixes for parameters generating errors when using `Invoke-FalconHostAction` with `Build-Content`
Bugfixes for when `Build-Content` adds single string values (instead of an array) to `$Expected` when validating user input
Modified commands to use `format.json` for parameter definition
Restructured to have single path values with method under it, instead of `path:method`, as used by PSFalcon
Updated `Get-EndpointFormat` to match the way endpoint values are stored (method under path, instead of `path:method`)
Added `CustomUrl` to `Request-FalconToken` for internal troubleshooting
Bugfix for `Get-EndpointFormat` when an endpoint is provided that has no parameters
Fixed bug where a single returned 'Get-FalconAsset' result would not append 'login_event' history with 'Include'
Re-ordered file content related parameters and added descriptions
Updated how host_groups/rule_groups are assigned when creating/modifying FileVantagePolicy Still need to add functionality to remove assigned rule_groups/host_groups when they don't make the config archive being imported and analyze policy for settings/rule changes beyond groups/enablement status
A couple more changes for how rule_groups/host_groups are assigned to FileVantagePolicy to match existing structure
Updated Export-FalconConfig to add FileVantageRuleGroup when exporting FileVantagePolicy
Added validation of properties in `repeated` object and defined formatting for body payload so that `repeated` was properly submitted during a request when using `New-FalconFileVantageExclusion`
* Import-FalconConfig Suppressed output of verbose message when old identifier did not change to a new identifier. Added creation of `exclusions` when creating `FileVantagePolicy`. Compressed creation of `rule_groups` and `host_groups` for `FileVantagePolicy`.
Added validation and body format for `Edit-FalconFileVantageExclusion`
Updated `Set-Property` to avoid errors checking for existing properties under certain conditions when using `Import-FalconConfig`
Removed validation for `ScheduleStart` and `ScheduleEnd` for `New-FalconFileVantageExclusion` and `Edit-FalconFileVantageExclusion`
Added code to `Import-FalconConfig` to evaluate and modify exclusions assigned to `FileVantagePolicy`
Added `precedence` to `Edit-FalconFileVantageRule` and fixed typo in parameter description for `New-FalconFileVantageRule`
Added support for modification of `FileVantageRuleGroup`, `FileVantageRule` and corrected some bugs with `FileVantageExclusion` under `FileVantagePolicy`
Added code to compensate and still properly match when importing into a new cloud and the "latest" tagged build is renamed for a SensorUpdatePolicy. Added "Ignored" message when a `FileVantageRuleGroup` is ignored due to a lack of required changes.
Updated `Invoke-FalconAlertAction` to use new `/alerts/entities/alerts/v3:patch` endpoint.
Updated `Get-FalconHost -Login` to use `v2` endpoint and added appropriate limit.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
2.2.6
Updates for 2.2.6 release
Added features and functionality
Added Commands
cloud-connect-azure
configuration-assessment
falcon-complete-dashboards
filevantage
identity-protection
real-time-response
Removed Commands
cloud-connect-aws (deprecated)
cloud-connect-azure (deprecated)
cloud-connect-gcp (deprecated)
discover
settings-discover (deprecated)
Issues resolved
Get-FalconRole
andGet-FalconUser
return incorrect roles #313: Reorganized parameters forGet-FalconRole
and removedUserId
from a specific ParameterSet toensure proper output.
Uninstall-FalconSensor
fails on some 64-bit Windows machines and returns no status #315: Modified script used byUninstall-FalconSensor
tomatch 64
instead ofequal 64-bit
to correcterror caused when bit value is reported as
64 bit
instead of64-bit
.Get-FalconContainerVulnerability
validation ofPackage
fails in PowerShell Core #316: Addedif
check toConfirm-Parameter
for$Required
and$Allowed
to ensure that blank valuesdo not count when verifying objects under PowerShell Core.
Invoke-FalconDeploy
#327: ModifiedInvoke-FalconDeploy
to properly change directories and execute scripts when working with.cmd
and.bat
files. Thanks @MatthewCKelly!Invoke-FalconMalQuery
,Get-FalconMalQuery
andSearch-FalconMalQueryHash
not returning results #342: ModifiedInvoke-FalconMalQuery
andGet-FalconMalQuery
to select thereqid
,reqtype
and/orstatus
properties in their final output, when present.Get-FalconAsset
does not appendlogin_event
when usingInclude
with a single result #360: Fixed bug whereGet-FalconAsset
would not append results when using-Include login_event
with asingle asset result.
critical
withEdit-FalconHorizonPolicy
#363: Addedcritical
as a severity forEdit-FalconHorizonPolicy
.Other
General Changes
expire within 4 minutes instead of 1 minute. This should help reduce the number of expired authorization
tokens during long-running requests (like
Get-FalconVulnerability
).Wait-RetryAfter
function fromprivate\Private.ps1
toclass\Class.ps1
underApiClient.Invoke()
function.
ApiClient.Invoke()
underclass\Class.ps1
in an effort to improve verbose logging andperformance.
Invoke-Falcon
andRequest-FalconToken
to compensate for changes toApiClient.Invoke()
.Write-Result
to ensure each error will be individually produced when a single API call generatesmultiple errors.
ApiClient.Invoke()
downloads files to eliminate "index out of range" error.format\format.json
to contain API endpoint body/formdata/query parameters for easier updates when largenumbers of API endpoints are modified at once.
Get-EndpointFormat
toprivate\Private.ps1
to read body/formdata/query parameters fromformat.json
.private
Invoke-Falcon
function into the privateBuild-Content
function.Inputs
variable (and accompanying parameter for theInvoke-Falcon
function, used by commands whenmaking a request) to
UserInput
in keeping with PowerShell style.Compare-FalconPreventionPhase
.Write-Result
to removemeta
from output whenmeta.pagination.total
equals 0 to account forsome
-Detailed
results returningmeta
information instead of an empty response (unlike a non-Detailed
result, which would return nothing, as expected).
Add-Include
function to provide error messages when unable to pull results instead of a silentfailure with no output in the related
-Include
property.Compare-FalconPreventionPhase
.Command Changes
Add-FalconSensorTag
n
was being split into separate tags due to an incorrect quote. Thanks @soggysec!CsSensorSettings.exe
.script
folder.Edit-FalconHorizonAwsAccount
CloudTrailRegion
.IamRoleArn
,BehaviorAssessmentEnabled
,SensorManagementEnabled
,RemediationRegion
, andRemediationTouAccepted
.Edit-FalconHorizonPolicy
AccountId
to accept multiple identifiers.Edit-FalconReconNotification
IdpSendStatus
andMessage
.Edit-FalconFirewallLocationSetting
LocationPrecedence
.Edit-FalconIoc
Array
parameter for submitting many IOCs for modification, and set as the default parameter set whenutilizing the pipeline.
Array
.Export-FalconConfig
FileVantagePolicy
(includingFileVantageExclusion
) andFileVantageRuleGroup
(includingFileVantageRule
). CrowdStrike-created policies and rule groups are excluded from the exportbecause they are auto-generated and can not be modified.
HostGroup
when exportingFileVantagePolicy
to evaluatehost_groups
.FileVantageRuleGroup
when exportingFileVantagePolicy
to evaluaterule_groups
andassign them to policies.
Get-FalconAlert
Id
parameter, due to new varying identifier types found in testing.Get-FalconBuild
Stage
.Get-FalconContainerAccount
Location
to correctly submit aslocations
to the API endpoint.Get-FalconContainerAwsAccount
IsHorizonAcct
.Get-FalconContainerCluster
Status
.Get-FalconContainerVulnerability
applicationPackages
.Get-FalconFimChange
v3
endpoint, replacingOffset
withAfter
.Get-FalconFileVantageChange
, but keptGet-FalconFimChange
as an alias.Get-FalconHorizonAwsAccount
IamRoleArn
andMigrated
.Get-FalconHorizonAzureAccount
TenantId
.Get-FalconHorizonAzureCertificate
YearsValid
.Get-FalconHorizonIoa
ResourceId
,ResourceUuid
, andSince
.Get-FalconHost
Login
switch to use newv2
endpoint. The initial API is limited to 10ids
values perrequest, which means that using
-Include login_history
will be substantially slower until the API limitis increased.
Get-FalconHostGroup
Include
to use a filteredGet-FalconHost
search when addingmembers
which avoids the 10kmaximum limit from the previously used
Get-FalconHostGroupMember
command.Get-FalconRole
Id
values when matching aCid
(because it also matches custom roleidentifiers).
UserId
as a parameter for the/user-management/queries/roles/v1:get
endpoint because the same datais returned by the
/combined/
endpoint and they have overlapping parameters.DirectOnly
parameter toGet-FalconRole
.Get-FalconScan
/ods/entities/scans/v2:get
endpoint.Get-FalconSensorTag
script
folder.Get-FalconSession
Cid
andCommandInfo
, which facilitate the display of all Real-time Response sessions within theauthorized CID.
Import-FalconConfig
by
Export-FalconConfig
. Thanks @JFresh15 and @soggysec!id
values forgroups
andrule_groups
objects.build
values for Sensor Update policies.build
for LinuxArm64policy variants.
FileVantagePolicy
andFileVantageRuleGroup
asModifyExisting
options.Comment
output to specify why certain items were ignored usingNoModifyDefault
andNoModifyExisting
.renamed for a
SensorUpdatePolicy
.Invoke-FalconAdminCommand
falconscript
as aCommand
option.Invoke-FalconAlertAction
Id
due to new varying identifier types found in testing.v3
endpoint.Invoke-FalconContainerScan
scan-type
toscan_type
during submission.Invoke-FalconDeploy
put
step.GroupId
to use a filteredGet-FalconHost
search which avoids the 10k maximum limit from thepreviously used
Get-FalconHostGroupMember
command.Invoke-FalconRtr
falconscript
as aCommand
option.GroupId
to use a filteredGet-FalconHost
search which avoids the 10k maximum limit from thepreviously used
Get-FalconHostGroupMember
command.New-FalconHorizonAwsAccount
CloudTrailRegion
.AccountType
,BehaviorAssessmentEnabled
,IamRoleArn
,IsMaster
,SensorManagementEnabled
, andUseExistingCloudtrail
.New-FalconHorizonAzureAccount
ClientId
,AccountType
,DefaultSubscription
, andYearsValid
.New-FalconIoc
Array
.New-FalconScheduledScan
ScanInclusion
.Receive-FalconContainerYaml
IsSelfManagedCluster
.Receive-FalconHorizonAwsScript
Id
.Receive-FalconHorizonAzureScript
SubscriptionId
,Template
, andAccountType
.Receive-FalconRule
IfNoneMatch
andIfModifiedSince
.Remove-FalconCidGroupMember
/mssp/entities/cid-group-members/v2:delete
endpoint.Remove-FalconHorizonAzureAccount
TenantId
andRetainTenant
.Remove-FalconReconRule
DeleteNotification
.Remove-FalconSample
Id
to accept asha256
value when passed through the pipeline.Remove-FalconSensorTag
CsSensorSettings.exe
.script
folder.Send-FalconPutFile
Name
.Send-FalconScript
Name
.Start-FalconScan
ScanInclusion
.Uninstall-FalconSensor
Windows host.
script
folder.