From 8c52a6e30ae6a5fa0fbed9e50c6a3de210123b6e Mon Sep 17 00:00:00 2001 From: Freddy Wieffering Date: Fri, 9 May 2025 13:29:47 -0500 Subject: [PATCH 1/2] fix: update doc strings and parameter validation to support us-gov-2 --- .../falcon-container-sensor-pull/README.md | 4 ++-- .../falcon-container-sensor-pull.sh | 2 +- bash/install/README.md | 17 +++++++++++++---- bash/install/falcon-linux-install.sh | 2 +- bash/install/falcon-linux-uninstall.sh | 2 +- bash/migrate/README.md | 6 +++--- bash/migrate/falcon-linux-migrate.sh | 4 ++-- powershell/install/falcon_windows_install.ps1 | 2 +- powershell/install/falcon_windows_uninstall.ps1 | 2 +- powershell/migrate/falcon_windows_migrate.ps1 | 4 ++-- 10 files changed, 27 insertions(+), 18 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/README.md b/bash/containers/falcon-container-sensor-pull/README.md index ebf6fc62..6f7280c3 100644 --- a/bash/containers/falcon-container-sensor-pull/README.md +++ b/bash/containers/falcon-container-sensor-pull/README.md @@ -79,7 +79,7 @@ The script supports auto-discovery of the Falcon cloud region. If the cloud regi ## Usage ```terminal -Usage: falcon-container-sensor-pull.sh [options] +Usage: ./falcon-container-sensor-pull.sh [options] Version: 1.8.0 Required Flags: @@ -88,7 +88,7 @@ Required Flags: Optional Flags: -f, --cid Falcon Customer ID - -r, --region Falcon Cloud Region [us-1|us-2|eu-1|us-gov-1] (Default: us-1) + -r, --region Falcon Cloud Region [us-1|us-2|eu-1|us-gov-1|us-gov-2] (Default: us-1) -c, --copy Registry to copy the image to, e.g., myregistry.com/mynamespace By default, the image name and tag are appended. Use --copy-omit-image-name and/or --copy-custom-tag to change that behavior. diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index 0cdad192..039a90c4 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -18,7 +18,7 @@ Required Flags: Optional Flags: -f, --cid Falcon Customer ID - -r, --region Falcon Cloud Region [us-1|us-2|eu-1|us-gov-1] (Default: us-1) + -r, --region Falcon Cloud Region [us-1|us-2|eu-1|us-gov-1|us-gov-2] (Default: us-1) -c, --copy Registry to copy the image to, e.g., myregistry.com/mynamespace By default, the image name and tag are appended. Use --copy-omit-image-name and/or --copy-custom-tag to change that behavior. diff --git a/bash/install/README.md b/bash/install/README.md index b2b0f033..22e4abf1 100644 --- a/bash/install/README.md +++ b/bash/install/README.md @@ -103,7 +103,7 @@ The installer is AWS SSM aware, if `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` ## Install Script ```terminal -Usage: falcon-linux-install.sh [-h|--help] +Usage: ./falcon-linux-install.sh [-h|--help] Installs and configures the CrowdStrike Falcon Sensor for Linux. Version: 1.8.0 @@ -124,7 +124,7 @@ Authentication: - FALCON_CLOUD (default: unset) The cloud region where your CrowdStrike Falcon instance is hosted. Required if using FALCON_ACCESS_TOKEN. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. Other Options - FALCON_CID (default: auto) @@ -133,6 +133,7 @@ Other Options - FALCON_SENSOR_VERSION_DECREMENT (default: 0 [latest]) The number of versions prior to the latest release to install. + For example, 1 would install version N-1. - FALCON_PROVISIONING_TOKEN (default: unset) The provisioning token to use for installing the sensor. @@ -191,6 +192,10 @@ Other Options To prepare the sensor to be used in a golden image. Accepted values are ['true', 'false']. + - USER_AGENT (default: unset) + User agent string to append to the User-Agent header when making + requests to the CrowdStrike API. + This script recognizes the following argument: -h, --help Print this help message and exit. @@ -252,7 +257,7 @@ curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.8.0/bash ## Uninstall Script ```terminal -Usage: falcon-linux-uninstall.sh [-h|--help] +Usage: ./falcon-linux-uninstall.sh [-h|--help] Uninstalls the CrowdStrike Falcon Sensor from Linux operating systems. Version: 1.8.0 @@ -273,7 +278,7 @@ Authentication: - FALCON_CLOUD (default: unset) The cloud region where your CrowdStrike Falcon instance is hosted. Required if using FALCON_ACCESS_TOKEN. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. Other Options: - FALCON_MAINTENANCE_TOKEN (default: unset) @@ -298,6 +303,10 @@ Other Options: - FALCON_APP (default: unset) The proxy port for the sensor to use when communicating with CrowdStrike. + - USER_AGENT (default: unset) + User agent string to append to the User-Agent header when making + requests to the CrowdStrike API. + This script recognizes the following argument: -h, --help Print this help message and exit. diff --git a/bash/install/falcon-linux-install.sh b/bash/install/falcon-linux-install.sh index a084bfb8..41dcb4f7 100755 --- a/bash/install/falcon-linux-install.sh +++ b/bash/install/falcon-linux-install.sh @@ -24,7 +24,7 @@ Authentication: - FALCON_CLOUD (default: unset) The cloud region where your CrowdStrike Falcon instance is hosted. Required if using FALCON_ACCESS_TOKEN. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. Other Options - FALCON_CID (default: auto) diff --git a/bash/install/falcon-linux-uninstall.sh b/bash/install/falcon-linux-uninstall.sh index 61fda977..b26ce2a6 100755 --- a/bash/install/falcon-linux-uninstall.sh +++ b/bash/install/falcon-linux-uninstall.sh @@ -24,7 +24,7 @@ Authentication: - FALCON_CLOUD (default: unset) The cloud region where your CrowdStrike Falcon instance is hosted. Required if using FALCON_ACCESS_TOKEN. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. Other Options: - FALCON_MAINTENANCE_TOKEN (default: unset) diff --git a/bash/migrate/README.md b/bash/migrate/README.md index b715c5f9..2c3bf8c0 100644 --- a/bash/migrate/README.md +++ b/bash/migrate/README.md @@ -81,7 +81,7 @@ export [OLD|NEW]FALCON_CLOUD="us-gov-1" ## Usage ```terminal -Usage: falcon-linux-migrate.sh [-h|--help] +Usage: ./falcon-linux-migrate.sh [-h|--help] Migrates the Falcon sensor to another Falcon CID. Version: 1.8.0 @@ -101,7 +101,7 @@ Old CID Authentication: - OLD_FALCON_CLOUD (default: 'us-1') The cloud region where your old CrowdStrike Falcon instance is hosted. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. New CID Authentication: - NEW_FALCON_CLIENT_ID (default: unset) [Required] @@ -116,7 +116,7 @@ New CID Authentication: - NEW_FALCON_CLOUD (default: 'us-1') The cloud region where your new CrowdStrike Falcon instance is hosted. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. - NEW_FALCON_CID (default: unset) Your CrowdStrike Falcon customer ID (CID) for the new CID. diff --git a/bash/migrate/falcon-linux-migrate.sh b/bash/migrate/falcon-linux-migrate.sh index af9a737b..0215186e 100755 --- a/bash/migrate/falcon-linux-migrate.sh +++ b/bash/migrate/falcon-linux-migrate.sh @@ -28,7 +28,7 @@ Old CID Authentication: - OLD_FALCON_CLOUD (default: 'us-1') The cloud region where your old CrowdStrike Falcon instance is hosted. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. New CID Authentication: - NEW_FALCON_CLIENT_ID (default: unset) [Required] @@ -43,7 +43,7 @@ New CID Authentication: - NEW_FALCON_CLOUD (default: 'us-1') The cloud region where your new CrowdStrike Falcon instance is hosted. - Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1']. + Accepted values are ['us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2']. - NEW_FALCON_CID (default: unset) Your CrowdStrike Falcon customer ID (CID) for the new CID. diff --git a/powershell/install/falcon_windows_install.ps1 b/powershell/install/falcon_windows_install.ps1 index eb5f6da3..8fdfdbb0 100755 --- a/powershell/install/falcon_windows_install.ps1 +++ b/powershell/install/falcon_windows_install.ps1 @@ -76,7 +76,7 @@ Updated 2021-10-22 to include 'sensor_version' property when matching policy to [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', 'DeleteScript')] param( [Parameter(Position = 1)] - [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1')] + [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2')] [string] $FalconCloud = 'autodiscover', [Parameter(Position = 2)] diff --git a/powershell/install/falcon_windows_uninstall.ps1 b/powershell/install/falcon_windows_uninstall.ps1 index 37b508cb..8fc85755 100755 --- a/powershell/install/falcon_windows_uninstall.ps1 +++ b/powershell/install/falcon_windows_uninstall.ps1 @@ -85,7 +85,7 @@ param( [switch] $RemoveHost, [Parameter(Position = 8)] - [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1')] + [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2')] [string] $FalconCloud = 'autodiscover', [Parameter(Position = 9)] diff --git a/powershell/migrate/falcon_windows_migrate.ps1 b/powershell/migrate/falcon_windows_migrate.ps1 index 654097bc..6cfc5a64 100644 --- a/powershell/migrate/falcon_windows_migrate.ps1 +++ b/powershell/migrate/falcon_windows_migrate.ps1 @@ -76,7 +76,7 @@ param( [ValidatePattern('\w{40}')] [string] $NewFalconClientSecret, [Parameter(Position = 3)] - [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1')] + [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2')] [string] $NewFalconCloud = 'autodiscover', [Parameter(Position = 4)] [string] $NewMemberCid, @@ -87,7 +87,7 @@ param( [ValidatePattern('\w{40}')] [string] $OldFalconClientSecret, [Parameter(Position = 7)] - [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1')] + [ValidateSet('autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1', 'us-gov-2')] [string] $OldFalconCloud = 'autodiscover', [Parameter(Position = 8)] [string] $OldMemberCid, From 753d765e2bcc166972ce9427464ad7bb482e8da3 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Fri, 9 May 2025 14:56:46 -0400 Subject: [PATCH 2/2] chore: putting usage back This is because most examples show: `bash