Replies: 3 comments
-
Fantastic, been trying to figure out how to do this - have saved me a BUNCH |
Beta Was this translation helpful? Give feedback.
-
Based on the error message ... Child CID <child_cid> tried to edit parent CID <parent_cid> policy <policy_id> ... it seems something was put in place that prevents you from assigning Custom IOA rule groups to an inherited policy. In that case, you'd need to duplicate the inherited policy and assign the Custom IOA rule groups to that policy instead. This isn't how it always worked, so it's possible that this is not intended. I'll see what I can find out... |
Beta Was this translation helpful? Give feedback.
-
Other test scenarios checked after posting: 1 2 3 Happy to try any suggestions |
Beta Was this translation helpful? Give feedback.
-
How can we import IoaGroup from our MSSP CID 'master' into new CID which only has the Prevention Policies from "Your MSSP" pushed down to it.
Reading through the docs:
https://github.com/CrowdStrike/psfalcon/wiki/Import-FalconConfig
Have tried both:
AssignExisting and ModifyExisting parameters to try and import the Custom IoaGroup and have it applied to the same prevention plan name in the target as it is in source/master CID
But I can only get the IoaGroup to be added, not the Prevention policy assigned the same as in the 'master' CID.
Error received during the command suggesting there is an issue. I have no idea why though.
The Export and import is specifically IoaGroup.
Terminal output below:
Beta Was this translation helpful? Give feedback.
All reactions