crowdstrike-falcon-devices

Lists the devices registered in CrowdStrike Falcon with their details.

Syntax

crowdstrike-falcon-devices [profile=STRING] [duration=STRING] [from=DATETIME] [to=DATETIME] [order=STRING] [time-filter=STRING] [os=STRING] [only-online=BOOL]

Options

profile=STRING: Optional. Connect profile code of CrowdStrike Falcon
duration=STRING: Optional. Retrieve only devices within the recent time range, based on the field selected by the time-filter option. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means the last 10 seconds. The from option takes precedence when both are given.
from=DATETIME: Optional. Start time of range, applied to the field selected by the time-filter option. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=DATETIME: Optional. End time of range, applied to the field selected by the time-filter option. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
order=STRING: Optional. Retrieve direction of the field selected by the time-filter option. desc or asc. desc by default.
time-filter=STRING: Optional. Reference field of the duration, from, to and order options. 'updated' uses the time the device record was last updated, 'last_seen' uses the time the device was last seen. updated by default.
os=STRING: Optional. Filter by operating system. Available values: 'windows', 'mac', 'linux'. Specify only one value, multiple values are not supported. All devices are retrieved if omitted.
only-online=BOOL: Optional. Specify t to output only online devices. t or f (default: f, both online and offline devices are retrieved)

Output fields

Field	Type	Name	Description
profile	String	Connect profile	CrowdStrike Falcon connect profile code
device_id	String	Device ID	Unique device identifier
cid	String	Customer ID	Customer identifier
agent_load_flags	String	Agent Load Flags	Agent load flags value
agent_local_time	Date	Agent Local Time
agent_version	String	Agent Version	Falcon agent version
bios_manufacturer	String	BIOS Manufacturer	BIOS manufacturer name
bios_version	String	BIOS Version	BIOS version number
os_build_number	String	OS Build Number	OS build number
config_id_base	String	Config ID Base	Configuration ID base value
config_id_build	String	Config ID Build	Configuration ID build value
config_id_platform	String	Config ID Platform	Configuration ID platform value
cpu_signature	String	CPU Signature	CPU signature
cpu_vendor	String	CPU Vendor	CPU vendor name
host_ip	IP	Host IP	External IP address of the host
mac	String	Mac	MAC address
hostname	String	Hostname	Host name
first_seen	Date	First Seen
last_seen	Date	Last Seen
last_login_timestamp	Date	Last Login Timestamp	Last user login time
last_login_user	String	Last Login User	Username of last login
last_login_user_sid	String	Last Login User SID	Security identifier of last login user
last_login_uid	String	Last Login UID	User ID of last login
first_login_timestamp	Date	First Login Timestamp	First user login time
first_login_user	String	First Login User	Username of first login
local_ip	IP	Local IP	Internal IP address of the host
machine_domain	String	Machine Domain	Domain name of the machine
os_major_version	String	OS Major Version	OS major version number
os_minor_version	String	OS Minor Version	OS minor version number
os_version	String	OS Version	Operating system version
os_build	String	OS Build	OS build identifier
os_product_name	String	OS Product Name	Full OS product name
platform_id	String	Platform ID	Platform identifier
os_family	String	OS Family	e.g. Windows, Mac, Linux
product_type	String	Product Type	Product type identifier
product_type_desc	String	Product Type Description	Product type description
provision_status	String	Provision Status	Device provisioning status
reduced_functionality_mode	String	Reduced Functionality Mode	Reduced functionality mode status
rtr_state	String	RTR State	Real Time Response connection state
serial_number	String	Serial Number	Device serial number
os_service_pack_minor	String	OS Service Pack Minor	Service pack minor version
pointer_size	String	Pointer Size	System pointer size (32/64 bit)
site_name	String	Site Name	Device site name
status	String	Status	Device status
system_manufacturer	String	System Manufacturer	System manufacturer name
system_product_name	String	System Product Name	System product name
updated	Date	Updated	Last updated
last_reboot	Date	Last Reboot	Last system reboot time
connection_ip	IP	Connection IP	Current connection IP address
default_gateway_ip	IP	Default Gateway IP	Default gateway IP address
connection_mac	String	Connection MAC	Current connection MAC address
chassis_type	String	Chassis Type	Hardware chassis type identifier
chassis_type_desc	String	Chassis Type Description	Hardware chassis type description
groups	List	Groups	Device groups
group_hash	String	Group Hash	Hash value of device groups
tags	List	Tags	Device tags
meta	Map	Meta	Additional metadata information
kernel_version	String	Kernel Version	Operating system kernel version
policies	List	Policies	applied policies
device_policies	List	Device Policies	device-specific policies