Where to add the AgentID to performGroupAction

[Emarples]

I'm trying to use the performGroupAction endpoint to add a specific asset to a certain group with the service class, but am having issues with how I specify the agentID I would like to add. Is it a parameter I should add? Any help would be greatly appreciated.

[jshcodes]

Hi @Emarples!

We'll need to use the action_parameters keyword to add a host to a static group. Try this sample code and let us know if you have any questions.

You will need to use updateHostGroups if you want to update the assignment rule for a dynamic group.

Example

from falconpy import HostGroup

groups = HostGroup(client_id="API_CLIENT_ID", client_secret="API_CLIENT_SECRET")

host_aids_to_add = ['HOST_AID_1', 'HOST_AID_2', 'etc.']

action_parameter = [{
    "name": "filter",
    "value": f"(device_id:{host_aids_to_add})"
}]

result = groups.perform_group_action(action_name="add-hosts", ids="HOST_GROUP_ID_HERE", action_parameters=action_parameter)

print(result)

[Emarples]

Thank you for the swift support on this! The code above is resulting in the following error?

r2 = falconGroup.perform_group_action(action_name=action, ids="4eaf5ac30d18419488510440e568bb53", action_parameters=action_parameter)
TypeError: perform_group_action() missing 1 required positional argument: 'body'

What am I missing here?

[jshcodes]

Can I see your entire code block?

Also - what version of FalconPy are you using?

Make sure to redact any CID or AID values and your API keys.

[Emarples]

Name: crowdstrike-falconpy
Version: 0.7.0
Summary: The CrowdStrike Falcon OAuth2 API SDK for Python 3
Home-page: https://github.com/CrowdStrike/falconpy
Author: CrowdStrike
Author-email: [email protected]
License: UNKNOWN
Location: /Users/user/Documents/cs_api/venv/lib/python3.9/site-packages
Requires: requests, urllib3
Required-by:

#!/usr/bin/env python3

import os
import json
import argparse
from falconpy import Hosts
from falconpy import HostGroup
from dotenv import load_dotenv

# Setup Argument Parser
parser = argparse.ArgumentParser("Script that leverages Falcon API to block USB devices from text file 'PCName.txt'")
parser.add_argument('-r', '--remove', dest='remove_hosts', action="store_true", help='Remove host from USB Block group', default=False)

args = parser.parse_args() # Parse Ingested Args

# Default Action to contain
if args.remove_hosts:
    action = "remove-hosts"
else:
    action = "add-hosts"

# Load API Creds
load_dotenv()
falcon_client_id = os.getenv('falcon_client_id')
falcon_client_secret = os.getenv('falcon_client_secret')

# Load Auth
falcon = Hosts(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

falconGroup = HostGroup(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})
    

with open('PCName.txt') as f:
    for line in f:
        host = line.rstrip()
        PARAMS = {
                'filter': f"hostname:'{host}'",
                'sort': 'last_seen.desc'
                }
        response = falcon.QueryDevicesByFilter(parameters=PARAMS) # Search by Hostname
        print(response)
        if response['status_code'] == 200:
            print(response)
            if response['body']['resources']:
                target_aid = response['body']['resources'][0] # Set Target AID to be found AID
                print(target_aid)

                host_aids_to_add = [target_aid]

                action_parameter = [{
                    "name": "filter",
                    "value": f"(device_id:{host_aids_to_add})"
                }]


                # Write action
                if action == "add-hosts":
                    print(f"\n[+] Blocking USB: {host}\n")
                else:
                    print(f"\n[+] Removing Block: {host}\n")

                r2 = falconGroup.perform_group_action(action_name=action,ids="group_id", action_parameters=action_parameter)
                if r2['status_code'] == 200: # Test for Success
                    print(f"Sucessfully {action} from USB Block Group for {host}")
                else:
                    ecode = r2['status_code']
                    e = r2['body']['errors'][0]['message']
                    print(f"Error code {ecode} generated error: {e}")

[jshcodes]

Is upgrading to the latest version an option? My example above leveraged Body payload abstraction which was not released for this service class until v0.7.1.

If upgrading isn't possible, we'll need to tweak our code to pass the body payload directly, similar to the following:

#!/usr/bin/env python3

import os
import json
import argparse
from falconpy import Hosts
from falconpy import HostGroup
from dotenv import load_dotenv

# Setup Argument Parser
parser = argparse.ArgumentParser("Script that leverages Falcon API to block USB devices from text file 'PCName.txt'")
parser.add_argument('-r', '--remove', dest='remove_hosts', action="store_true", help='Remove host from USB Block group', default=False)

args = parser.parse_args() # Parse Ingested Args

# Default Action to contain
if args.remove_hosts:
    action = "remove-hosts"
else:
    action = "add-hosts"

# Load API Creds
load_dotenv()
falcon_client_id = os.getenv('falcon_client_id')
falcon_client_secret = os.getenv('falcon_client_secret')

# Load Auth
falcon = Hosts(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

falconGroup = HostGroup(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})
    

with open('PCName.txt') as f:
    for line in f:
        host = line.rstrip()
        PARAMS = {
                'filter': f"hostname:'{host}'",
                'sort': 'last_seen.desc'
                }
        response = falcon.QueryDevicesByFilter(parameters=PARAMS) # Search by Hostname
        print(response)
        if response['status_code'] == 200:
            print(response)
            if response['body']['resources']:
                target_aid = response['body']['resources'][0] # Set Target AID to be found AID
                print(target_aid)

                host_aids_to_add = [target_aid]

                action_parameter = [{
                    "name": "filter",
                    "value": f"(device_id:{host_aids_to_add})"
                }]

                body_payload = {
                    "ids": "GROUP_ID_HERE",
                    "action_parameters": action_parameter
                }
                # Write action
                if action == "add-hosts":
                    print(f"\n[+] Blocking USB: {host}\n")
                else:
                    print(f"\n[+] Removing Block: {host}\n")

                r2 = falconGroup.perform_group_action(action_name=action, body=body_payload)
                if r2['status_code'] == 200: # Test for Success
                    print(f"Sucessfully {action} from USB Block Group for {host}")
                else:
                    ecode = r2['status_code']
                    e = r2['body']['errors'][0]['message']
                    print(f"Error code {ecode} generated error: {e}")

[Emarples]

Upgrading to the latest version worked! Thank you for the help, much appreciated :)

[brucelourenco]

Hello guys!
I have an issue near to this, however, I'm facing error 400 as follows:

If I don't use f-strings and pass the device ids directly works fine

Follow falconpy version:
Name: crowdstrike-falconpy
Version: 1.2.10
Summary: The CrowdStrike Falcon SDK for Python 3
Home-page: https://github.com/CrowdStrike/falconpy
Author: CrowdStrike
Author-email: [email protected]
License:
Location: /root/miniconda3/lib/python3.9/site-packages
Requires: urllib3, requests
Required-by:

What I'm doing wrong?

Thank you everyone!

[jshcodes]

Hi @brucelourenco !

I've moved this to a new discussion.