Get FalconUninstallToken - CrowdStrike/psfalcon GitHub Wiki

Get-FalconUninstallToken

SYNOPSIS

Retrieve an uninstallation or maintenance token

DESCRIPTION

Requires 'Sensor update policies: Write', plus related permission(s) for 'Include' selection(s).

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
AuditMessage String Audit log comment
Include String[] Include additional properties agent_version
cid
external_ip
first_seen
hostname
last_seen
local_ip
mac_address
os_build
os_version
platform_name
product_type
product_type_desc
serial_number
system_manufacturer
system_product_name
tags
Id String Host identifier X X

SYNTAX

Get-FalconUninstallToken [[-AuditMessage] <String>] [[-Include] <String[]>] [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /policy/combined/reveal-uninstall-token/v1

falconpy

revealUninstallToken

USAGE

Finding a token for a host

Get-FalconUninstallToken -Id <id>

Finding the maintenance token that applies to any host within a given policy

Get-FalconUninstallToken -Id MAINTENANCE

Create a CSV of all available uninstall tokens

Get-FalconHost -All | Get-FalconUninstallToken -Include hostname | Export-Csv .\token_list.csv -NoTypeInformation

Create a CSV of uninstall tokens using a list of device_ids in a text file

Get-Content .\device_id.txt | Get-FalconUninstallToken | Export-Csv .\token_list.csv -NoTypeInformation

2023-04-25: PSFalcon v2.2.5

⚠️ **GitHub.com Fallback** ⚠️