host_hide

Manages the visibility of hosts in the Falcon console. To prevent unnecessary detections from an inactive or a duplicate host,

Added in version 4.0.0

Parameters

Parameter	Type	Required	Default	Description
hidden	bool	No	true	Whether to hide or unhide the hosts.
hosts	list	Yes		A list of host agent IDs (AIDs) to perform the action on. Use the P(crowdstrike.falcon.host_ids#lookup) lookup plugin to get a list of host IDs matching

Examples

- name: Hide a host from the Falcon console
  crowdstrike.falcon.host_hide:
    hosts: "12345678901234567890"

- name: Unhide hosts from the Falcon console
  crowdstrike.falcon.host_hide:
    hosts:
      - "12345678901234567890"
      - "09876543210987654321"
    hidden: false

- name: Hide all stale hosts that have not checked in for 30 days (using host_ids lookup)
  crowdstrike.falcon.host_hide:
    hosts: "{{ lookup('crowdstrike.falcon.host_ids', stale_filter) }}"
  vars:
    stale_filter: 'last_seen:<="now-15d"'

- name: Individually hide hosts with a list from the Falcon console
  crowdstrike.falcon.host_hide:
    auth: "{{ falcon.auth }}"  # Use auth saved from crowdstrike.falcon.auth module
    hosts: "{{ item }}"
  loop: "{{ host_ids }}"
  register: hide_result

- name: Fail if any hosts could not be hidden
  fail:
    msg: "Hosts could not be hidden: {{ hide_result.failed_hosts }}"
  when: hide_result.failed_hosts | length > 0

Return Values

Key	Type	Description
hosts		-
failed_hosts		-