-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ ENHANCEMENT ] Add command to overwrite SensorTags instead of appending #389
Comments
I'm not sure that I'd rather not change the command by adding the What about a |
I think that would be a good workaround! This issue is similar to the one outlined in the other thread, but it doesn't seem to be an issue with the maintenance token, the tags just aren't passed properly to the "$V" variable in the RTR script. Might be related, might not be. |
You can re-create the issue that If the device currently has no tags, this supposedly works (untested, but someone mentioned it to me), and if the device currently has tags, this does nothing:
It also seems to fail when trying to remove the tags. If you disable sensor uninstall protection, or run this command locally and copy/paste the token when prompted, it works:
The problem is that you can't interact with the prompt using Real-time Response, so until |
Added `Set-FalconSensorTag` to overwrite any existing tags, instead of appending. Re-wrote `Add-FalconSensorTag` and `Remove-FalconSensorTag` to properly evaluate tags for appending across all OSes. Re-wrote `Get-FalconSensorTag` to pull tags directly from devices API result for all OSes, instead of using RTR to check on Linux/Mac.
I added the Thanks for the idea! |
Hi, I wasn't sure if this was the correct place to post this as it's more of a feature request than a bug - apologies in advance if this should be posted elsewhere.
Describe the bug
This is a feature request for an "Append" switch to be added to Add-FalconSensorTag. Currently, this command will take the existing tags and add additional tags; retaining the pre-existing ones. I would like a switch to enable/disable retaining the pre-existing tags.
To Reproduce
Below is a function I created to replace a sensor grouping tag using the "Remove-FalconSensorTag" & "Add-FalconSensorTag" commands. If you run this function, you will notice that the 2nd RTR script is re-adding the previous tags, because the initial RTR script has not finished running.
Expected behavior
Effectively, I would like the below behaviour, with the default value of $true.
If the -append switch is true - previous tags + new tag.
if the -append switch is false - new tag only.
Environment (please complete the following information):
Additional context
We have Flight Control and tag devices within a CID with the services we offer. This allows our analysts to see services offered to each CID. It also allows us to assign Fusion workflows to all CID's and filter by sensor tag (you can't assign workflows to CID groups).
We want to use Sensor tags over Grouping tags so that this can be added to deployment jobs and future devices are automatically tagged.
Transcript content
Not possible.
The text was updated successfully, but these errors were encountered: