Reference
Classes
Section titled “Classes”falcon
Section titled “falcon”configures and installs CrowdStrike Falcon Sensor
Examples
Section titled “Examples”Basic usage
Section titled “Basic usage”class { 'falcon': cid => '12345', client_id => '<client_id>', client_secret => '<client_secret>', update_policy => 'platform_default' install_method => 'api'}Parameters
Section titled “Parameters”The following parameters are available in the falcon class:
package_manageconfig_manageservice_managecidinstall_methodclient_idclient_secretversion_managefalcon_cloudupdate_policysensor_tmp_dirversionversion_decrementcleanup_installerprovisioning_tokenpackage_namepackage_optionsservice_enableservice_nameservice_ensureproxy_hostproxy_portproxy_enabledsensor_dl_proxy_hostsensor_dl_proxy_porttagstag_membership
package_manage
Section titled “package_manage”Data type: Optional[Boolean]
Whether to install and manage the falcon sensor. Defaults to true.
Default value: $falcon::params::package_manage
config_manage
Section titled “config_manage”Data type: Optional[Boolean]
Whether to manage the falcon sensor configuration. Defaults to true.
Default value: $falcon::params::config_manage
service_manage
Section titled “service_manage”Data type: Optional[Boolean]
Whether to manage the service. Defaults to true.
Default value: $falcon::params::service_manage
Data type: Optional[Variant[Sensitive[String], String]]
The Customer CID to register the agent with. If not provided, the agent will not be registered. The falcon service can not be started
if cid is not configured. Defaults to undef.
Ignored if config_manage is set to false.
Default value: $falcon::params::cid
install_method
Section titled “install_method”Data type: Optional[Enum['api', 'local']]
The method used to install the falcon sensor. Defaults to api.
Valid values:
apilocal
When api is selected, the falcon api will be used to download the correct version of the falcon sensor.
When local is selected, a package resource is created with the values passed in the package_options parameter.
Default value: $falcon::params::install_method
client_id
Section titled “client_id”Data type: Optional[Sensitive]
The client id used to authenticate with the Falcon API. Defaults to undef.
Required if install_method is set to api and ignored if install_method is set to local.
Default value: $falcon::params::client_id
client_secret
Section titled “client_secret”Data type: Optional[Sensitive]
The client secret used to authenticate with the Falcon API. Defaults to undef.
Required if install_method is set to api and ignored if install_method is set to local.
Default value: $falcon::params::client_secret
version_manage
Section titled “version_manage”Data type: Optional[Boolean]
Rather or not puppet should enforce a specific version and do upgrades/downgrades. Defaults to false.
Ignored if install_method is set to local.
and the falcon platform from conflicting.
Default value: $falcon::params::version_manage
falcon_cloud
Section titled “falcon_cloud”Data type: String
The name of the cloud to use for the Falcon API. Defaults to api.crowdstrike.com
Ignored if install_method is set to local.
Default value: $falcon::params::falcon_cloud
update_policy
Section titled “update_policy”Data type: Optional[String]
The update policy to use to determine the package version to download and install. Defaults to undef.
update_policy takes precedence over version_decrement.
Ignored if install_method is set to local.
Default value: $falcon::params::update_policy
sensor_tmp_dir
Section titled “sensor_tmp_dir”Data type: Optional[String]
The directory to use to stage the sensor package. Defaults to /tmp (or %TEMP% on Windows).
Ignored if install_method is set to local.
Default value: $falcon::params::sensor_tmp_dir
version
Section titled “version”Data type: Optional[String]
The version of the sensor to install. When provided update_policy and version_decrement will be ignored. Defaults to undef.
Ignored if install_method is set to local.
Default value: $falcon::params::version
version_decrement
Section titled “version_decrement”Data type: Optional[Numeric]
The number of versions to decrement from the latest version. When version, update_policy are not provided
this will be used to determine the version to download and install. Defaults to 0.
Ignored if install_method is set to local.
Default value: $falcon::params::version_decrement
cleanup_installer
Section titled “cleanup_installer”Data type: Optional[Boolean]
Rather or not to remove the sensor install package after use. Defaults to true.
Ignored if install_method is set to local.
Default value: $falcon::params::cleanup_installer
provisioning_token
Section titled “provisioning_token”Data type: Optional[String]
The provisioning token to use to register the sensor with the Falcon API. Defaults to undef.
Default value: $falcon::params::provisioning_token
package_name
Section titled “package_name”Data type: Optional[String]
The name of the package to install. Defaults to the valid service name for the OS.
package_options will override if you pass in a package name.
Ignored if install_method is set to local.
Default value: $falcon::params::package_name
package_options
Section titled “package_options”Data type: Hash[String, Any]
Allows you to override any package attribute. Defaults to {}.
Default value: $falcon::params::package_options
service_enable
Section titled “service_enable”Data type: Optional[Boolean]
Whether to enable the service. Defaults to true.
Ignored if service_manage is set to false.
Default value: $falcon::params::service_enable
service_name
Section titled “service_name”Data type: Optional[String]
The name of the service to manage. Defaults to the valid service name for the OS.
Ignored if service_manage is set to false.
Default value: $falcon::params::service_name
service_ensure
Section titled “service_ensure”Data type: Optional[String]
The desired service state. Defaults to running.
Ignored if service_manage is set to false.
Default value: $falcon::params::service_ensure
proxy_host
Section titled “proxy_host”Data type: Optional[String]
The proxy host for the falcon agent to use. Defaults to undef.
Default value: $falcon::params::proxy_host
proxy_port
Section titled “proxy_port”Data type: Optional[Numeric]
The proxy port for the falcon agent to use. Defaults to undef.
Default value: $falcon::params::proxy_port
proxy_enabled
Section titled “proxy_enabled”Data type: Optional[Boolean]
Whether proxy is enabled. Defaults to undef.
Default value: $falcon::params::proxy_enabled
sensor_dl_proxy_host
Section titled “sensor_dl_proxy_host”Data type: Optional[String]
The proxy host to use when downloading the falcon sensor. Defaults to undef.
Default value: $falcon::params::sensor_dl_proxy_host
sensor_dl_proxy_port
Section titled “sensor_dl_proxy_port”Data type: Optional[Numeric]
The proxy port to use when downloading the falcon sensor. Defaults to undef.
Default value: $falcon::params::sensor_dl_proxy_port
Data type: Optional[Array[String]]
List of tags to apply to the sensor. Defaults to undef.
Default value: $falcon::params::tags
tag_membership
Section titled “tag_membership”Data type: Optional[Enum['inclusive', 'minimum']]
Rather specified tags should be treated as a complete list inclusive or as a list of tags to add to the existing list minimum.
inclusive will ensure the sensor has only the tags specified in tags removing any tags that are not specified. minimum will
ensure the sensor has the tags specified in tags but will not remove any existing tags. Defaults to minimum.
Default value: $falcon::params::tag_membership
Resource types
Section titled “Resource types”falconctl
Section titled “falconctl”Configure the Falcon Sensor
Properties
Section titled “Properties”The following properties are available in the falconctl type.
The cid to set for the Falcon Sensor
proxy_enabled
Section titled “proxy_enabled”Valid values: true, false
Enable or disable the proxy for the Falcon Sensor
proxy_host
Section titled “proxy_host”The proxy host to set for the Falcon Sensor
proxy_port
Section titled “proxy_port”The proxy port to set for the Falcon Sensor
List of tags to set for the Falcon Sensor
Parameters
Section titled “Parameters”The following parameters are available in the falconctl type.
namevar
The name of the resource
provider
Section titled “provider”The specific backend to use for this falconctl resource. You will seldom need to specify this --- Puppet will usually
discover the appropriate provider for your platform.
provisioning_token
Section titled “provisioning_token”The provisioning token used to register the sensor
Default value: undef
tag_membership
Section titled “tag_membership”Valid values: inclusive, minimum
Rather specified tags should be treated as a complete list inclusive or as a list of tags to add to the existing list
minimum.
Default value: minimum
sensor_download
Section titled “sensor_download”Download the Falcon Sensor
Properties
Section titled “Properties”The following properties are available in the sensor_download type.
ensure
Section titled “ensure”Valid values: present, absent
The basic property that the resource should be in.
Default value: present
Parameters
Section titled “Parameters”The following parameters are available in the sensor_download type.
bearer_token
Section titled “bearer_token”The bearer token used to authenticate with the Falcon API
falcon_cloud
Section titled “falcon_cloud”The falcon cloud URI to use
file_path
Section titled “file_path”The full path to the file.
provider
Section titled “provider”The specific backend to use for this sensor_download resource. You will seldom need to specify this --- Puppet will
usually discover the appropriate provider for your platform.
proxy_host
Section titled “proxy_host”The proxy host to use for downloading the sensor package
proxy_port
Section titled “proxy_port”The proxy port to use for downloading the sensor package
sha256
Section titled “sha256”namevar
The sha256 of the package to download
version
Section titled “version”The falcon sensor version that should be installed.
version_manage
Section titled “version_manage”If true download the required sensor package if current sensor version does not match desired version. False only download sensor package when no sensor is installed