Retrieved Sensor policy

[waschoo]

Hello,
I used a modified version of sensor_version_by_hostname script to extract info about machines in a csv file.
But I'm not able to extract information about Sensor update policies & prevention policies (hashes)
I tried this without success.
` for device in result["body"]["resources"]:

    res = {}

    res["hostname"] = device.get("hostname", None)

    res["policies.settings_hash"] = device.get("**policies.settings_hash**", None)

    devices.append(res)`

Do you have an idea ?
Thanks :)

[jshcodes]

Hi @waschoo !

You'll probably want to grab the IDs and then feed them to the appropriate "getXYZPolicies" (get_policies) operation. I don't think the settings_hash is what you're looking for.

If you add the following around line #68 of this sample:

            prevent_pol_id = device["device_policies"].get("prevention", {}).get("policy_id", None)
            update_pol_id = device["device_policies"].get("sensor_update", {}).get("policy_id", None)

You'll have the IDs for both your prevention and sensor update policy as the loop iterates. Use these value to call getPreventionPolicies and getSensorUpdatePolicies respectively. At that point you should have the policy details for the host, and you can add the values you prefer to the res dictionary.

Thank you for the question! 😄

[waschoo]

Hi @jshcodes
Strange issue, I was able to launch my script to retrieved update & prevent policies during few days, but since last friday, not possible.
This script works on other CIDs, only difference is the number of hosts (more than 5000 hosts on the CID where I have my script issue.
Do you have an idea ? Maybe some limitation about the quantity of data that can be retrieved (?)
Additional info, If I remove the retrieval of prevent & update policies info, the script works well.

`import json
import csv
import os
from falconpy.hosts import Hosts

def create_file(name, ext):
import datetime
d = datetime.datetime.today()
d_formatdate = d.strftime('%m-%d-%Y-%I-%M-%S')
filename = name + "_" + d_formatdate + "." + ext
import os
f = open(filename, "x")
f.close()
return filename

def device_list(offset: int, limit: int):
"""
I return a list of all devices for the CID, if I max out on the query limit, I can paginate
"""
result = falcon.QueryDevicesByFilter(limit=limit, offset=offset)
new_offset = result["body"]["meta"]["pagination"]["offset"]
total = result["body"]["meta"]["pagination"]["total"]
device_list = result["body"]["resources"]
return new_offset, total, device_list

def device_detail(aids: list):
"""
I return the device_id and agent_version for a list of AIDs I'm provided
"""
result = falcon.GetDeviceDetails(ids=aids)
devices = []
# return just the aid and agent version
for device in result["body"]["resources"]:
res = {}
res["hostname"] = device.get("hostname", None)
res["product_type_desc"] = device.get("product_type_desc", None)
res["platform_name"] = device.get("platform_name", None)
res["os_version"] = device.get("os_version", None)
res["local_ip"] = device.get("local_ip", None)
res["mac_address"] = device.get("mac_address", None)
res["machine_domain"] = device.get("machine_domain", None)
res["last_seen"] = device.get("last_seen", None)
res["agent_version"] = device.get("agent_version", None)
res["prevent_pol_id"] = device["device_policies"].get("prevention", {}).get("policy_id", None)
res["update_pol_id"] = device["device_policies"].get("sensor_update", {}).get("policy_id", None)
res["rfm"] = device.get("reduced_functionality_mode", None)
devices.append(res)
return devices

Local variable:

report_file = create_file("export_cs", "csv")

Grab our config parameters from a local file.

with open('./config.json', 'r') as file_config:
config = json.loads(file_config.read())

falcon = Hosts(creds={
"client_id": config["falcon_client_id"],
"client_secret": config["falcon_client_secret"]
},
base_url = "https://api.XXXX.crowdstrike.com" # Enter your base URL here if it is not US-1
)

offset = 0 # Start at the beginning
displayed = 0 # This is just so we can show a running count
total = 1 # Assume there is at least one
limit = 5000 # Quick limit to prove pagination
all_devices = [] # All devices retrieved
while offset < total:
offset, total, devices = device_list(offset, limit)
details = device_detail(devices)
for detail in details:
displayed += 1
all_devices.append([detail['hostname'], detail['product_type_desc'], detail['platform_name'], detail['os_version'], detail['local_ip'], detail['mac_address'], detail['machine_domain'], detail['last_seen'], detail['agent_version'], detail['prevent_pol_id'], detail['update_pol_id'], detail['rfm']])

Generate a CSV from our results

with open(report_file, "w") as file_handle:
for device in all_devices:
file_handle.write(f"{device[0]},{device[1]},{device[2]},{device[3]},{device[4]},{device[5]},{device[6]},{device[7]},{device[8]},{device[9]},{device[10]},{device[11]}\n")`

The error:

`Traceback (most recent call last):

File "host-info.py", in

details = device_detail(devices)

File "host-info.py", in device_detail

res["prevent_pol_id"] = device["device_policies"].get("prevention", {}).get("policy_id", None)

KeyError: 'device_policies'`

[jshcodes]

Hi @waschoo!

This line is the problem: result = falcon.GetDeviceDetails(ids=aids)

GetDeviceDetails supports a maximum of 500 in versions prior to v1.2. After v1.2, it supports a maximum of 5,000 records. This will need to be chunked. We have a few examples of this, this one does it via the call to QueryDevicesByFilterScroll first, that way it always has the correct amount to feed to GetDeviceDetails.

Note: QueryDevicesByFilter has a maximum return of 10,000 records. You may also have to move your code over to using QueryDevicesByFilterScroll. We will get the base sample code updated to match this. 😄

[waschoo]

Hi @jshcodes :)
Thanks !
I updated to 1.2.1 and used the query_devices_by_filter_scroll, the script:
script
But always an issue on one CID (more than 5000 hosts):
Error:
Traceback (most recent call last): File "/media/test.py", line 77, in <module> details = device_detail(devices) File "/media/test.py", line 48, in device_detail res["update_pol_id"] = device["device_policies"].get("sensor_update", {}).get("policy_id", None) KeyError: 'device_policies'

[jshcodes]

It looks like one of the records doesn't have the device policy branch returning.

Change line #48 to: res["update_pol_id"] = device.get("device_policies", {}).get("sensor_update", {}).get("policy_id", None)

Does that resolve it?

[waschoo]

It works perfectly :) :) :)
Thanks a lot Joshua !