From 857313c93e30b263bf61c9cc01e701da8498ffba Mon Sep 17 00:00:00 2001 From: bk-cs <54042976+bk-cs@users.noreply.github.com> Date: Thu, 28 Oct 2021 09:46:50 -0700 Subject: [PATCH] v2.1.5 --- PSFalcon.psd1 | 4 +++- Public/psf-sensors.ps1 | 7 +++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/PSFalcon.psd1 b/PSFalcon.psd1 index 74cbd967..60a0b3a2 100644 --- a/PSFalcon.psd1 +++ b/PSFalcon.psd1 @@ -453,7 +453,9 @@ Command Changes Added '-Ids' parameter for multi-host support Modified output to include 'cid', 'device_id', and 'tags' - * Modified output of 'Uninstall-FalconSensor' to include 'cid', 'device_id' and 'status'. + * Updated 'Uninstall-FalconSensor': + Modified output to include include 'cid', 'device_id' and 'status' + Added error message when command is used with Linux/Mac hosts until support is added in the future * Updated 'Start-FalconSession' to a maximum of 10,000 identifiers to match API changes. diff --git a/Public/psf-sensors.ps1 b/Public/psf-sensors.ps1 index a36ed363..47d219db 100644 --- a/Public/psf-sensors.ps1 +++ b/Public/psf-sensors.ps1 @@ -336,8 +336,8 @@ function Uninstall-FalconSensor { ) begin { $Scripts = @{ - Linux = 'echo "not_supported_in_psfalcon"' - Mac = 'echo "not_supported_in_psfalcon"' + Linux = $null + Mac = $null Windows = 'Start-Sleep -Seconds 5; $RegPath = if ((Get-WmiObject win32_operatingsystem).osarchitectu' + 're -eq "64-bit") { "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" } el' + 'se { "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" }; if (Test-Path $RegPath) { $' + @@ -353,6 +353,9 @@ function Uninstall-FalconSensor { try { $HostInfo = Get-FalconHost -Ids $PSBoundParameters.Id | Select-Object cid, device_id, platform_name, device_policies + if ($HostInfo.platform_name -ne 'Windows') { + throw 'Only Windows hosts are currently supported in PSFalcon.' + } $IdValue = switch ($HostInfo.device_policies.sensor_update.uninstall_protection) { 'ENABLED' { $HostInfo.device_id } 'MAINTENANCE_MODE' { 'MAINTENANCE' }