psfalcon VS falconpy

Rather than using flight control, you could consider doing a import/export of your configuration, then mass uninstall and reinstall each individual existing CID into your new single CID. The parent would really only help with policy inheritence/detection rollup/rbac which you would no longer need after converting to a single instance.

Try using PSFalcon and Get-FalconDetection to see what's in a detection record.

Add-FalconSensorTag Get-FalconSensorTag Remove-FalconSensorTag

There's an example of required fields under the New-FalconIoaRule wiki page, along with the values for disposition_id.

https://github.com/CrowdStrike/falconpy/tree/main/samples https://github.com/CrowdStrike/psfalcon/tree/master/samples

Check out Get-FalconQueue. It goes through a few steps:

Could you open an issue and include a PowerShell transcript with $VerbosePreference = 'Continue'?

And for falconpy: https://github.com/CrowdStrike/falconpy/wiki/Identity-Protection

https://github.com/CrowdStrike/falconpy/tree/main/samples https://github.com/CrowdStrike/psfalcon/tree/master/samples

We also have an example that does some sorting and basic aggregation that's a little similar (but does not focus on remediations). Similar to your suggestion, this sample also consumes all available matches at the outset using a pretty expansive query.

Here's a sample that will paginate through all of your hosts. Depending on the API call you're using, you can request up to 5,000 hosts.

Howdy Yall, qq. Does anyone know if it is possible to search not just one CVE but a short list? from the github here https://github.com/CrowdStrike/falconpy/blob/main/samples/spotlight/find_hosts_by_cve.py

Logging in with the parent credentials to the Hosts Service Class will show hosts from child CIDs when you make calls to QueryDevicesByFilter or QueryDevicesByFilterScroll. For an example on how to paginate through the results, you can check out the sample here: https://github.com/CrowdStrike/falconpy/blob/main/samples/hosts/sensor_versions_by_hostname_scrolling.py

start with samples work backward: https://github.com/CrowdStrike/falconpy/tree/main/samples/hosts

I would need to see more of your code to get an idea for why you're running into this error. You may find it easier to review an existing integration that populates Chronicle via the Event Streams API instead. This one leverages our Python SDK: https://github.com/CrowdStrike/falcon-integration-gateway.

Can I see more of your code? Feels like we're missing something. Sample code (queued execute): https://github.com/CrowdStrike/falconpy/blob/main/samples/rtr/queued_execute.py

I think you may be right. It looks like the payload handler for this operation is not looking for the id key. (I will track this fix using the GitHub issue you just created. )