Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Documentation Update for User Management #156

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Documentation Update for User Management #156

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 30 additions & 12 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,19 +183,21 @@ Two types of configuration backends are provided out of the box: the default, wh

Your API keys should have the following scopes enabled in the Falcon dashboard:

| &darr; API Scopes // Commands &rarr; | `host_search` | `shell` | `policies`<br>(Prevention) | `policies`<br>(Response) | `containment`<br>Host Containment | `maintenance_token`<br>Maintenance Tokens |
|--------------------------------------|:-------------:|:-------:|:--------------------------:|:-------------------------:|:---------------------------------:|:-----------------------------------------:|
| &darr; API Scopes // Commands &rarr; | `host_search` | `shell` | `policies`<br>(Prevention) | `policies`<br>(Response) | `containment`<br>Host Containment | `maintenance_token`<br>Maintenance Tokens | `user_modification` |
|--------------------------------------|:-------------:|:-------:|:--------------------------:|:-------------------------:|:---------------------------------:|:-----------------------------------------:| :--------------------: |
| **Falcon Flight Control: Read** | X<br>*When using parent<br>CID API Keys* | X<br>*When using parent<br>CID API Keys* | X<br>*When using parent<br>CID API Keys* | X<br>*When using parent<br>CID API Keys* | | |
| **Hosts: Read** | X | X | | | X | X |
| **Hosts: Write** | | | | | X | |
| **Prevention Policies: Read** | | | X<br>`describe` / `export` sub-commands | | | |
| **Prevention Policies: Write** | | | X<br>`import` sub-command | | | |
| **Real Time Response: Read** | | X | | | | |
| **Real Time Response: Write** | | X | | | | |
| **Real Time Response: Admin** | | X<br>*for admin commands* | | | | |
| **Response Policies: Read** | | | | X<br>`describe` / `export` sub-commands | | |
| **Response Policies: Write** | | | | X<br>`import` sub-command | | |
| **Sensor Update Policies: Write** | | | | | | X |
| **Hosts: Read** | X | X | | | X | X | |
| **Hosts: Write** | | | | | X | | |
| **Prevention Policies: Read** | | | X<br>`describe` / `export` sub-commands | | | | |
| **Prevention Policies: Write** | | | X<br>`import` sub-command | | | | |
| **Real Time Response: Read** | | X | | | | | |
| **Real Time Response: Write** | | X | | | | | |
| **Real Time Response: Admin** | | X<br>*for admin commands* | | | | | |
| **Response Policies: Read** | | | | X<br>`describe` / `export` sub-commands | | | |
| **Response Policies: Write** | | | | X<br>`import` sub-command | | | |
| **Sensor Update Policies: Write** | | | | | | X | |
| **Sensor Download: Read** | | | | | | | X |
| **User Management: Write** | | | | | | | X |

### Showing Your Profiles

Expand Down Expand Up @@ -467,6 +469,22 @@ $ falcon policies -p import MyExportedPolicy.json
...
```

## User Manipulation

You can `add_user`, `delete_user`, and `add_roles` to users within your Falcon instance. These can be applied to the `falcon users` to specify what type of user manipulation you would like to perform. The `import_users` option can also be used to import multiple users from a CSV format.

### CSV Formatting for `import_users`
The CSV must contain the header first_name,last_name,email_address, and optionally may contain the roles field.

first_name,last_name,email_address,roles
alice,example,[email protected]
bob,example,[email protected],risk_manager
eve,example,[email protected]

```shell
$ falcon users import_users NewUsers.csv
```

## Support & Community Forums

Falcon Toolkit is an open source project, and not a formal CrowdStrike product, designed to assist users with managing their Falcon tenants and executing commands at scale. As such, it carries no formal support, express or implied. This project originated out of the CrowdStrike Services Incident Response (IR) team's need to execute commands across Falcon tenants quickly, at scale, and with auditing, and is maintained by [Chris Hammond](mailto:[email protected]).
Expand Down