Skip to content

Instantly share code, notes, and snippets.

@YSaxon
Created August 19, 2022 20:30
Show Gist options
  • Save YSaxon/cf0b46d4a965e370fd7ccdf6a4c7b3ce to your computer and use it in GitHub Desktop.
Save YSaxon/cf0b46d4a965e370fd7ccdf6a4c7b3ce to your computer and use it in GitHub Desktop.
script to get list of all supported falcon kernels
#!/bin/bash
#dependencies
#libarchive-tools (if not on mac/bsd)
#jq
#rpm2cpio
#dpkg
apitoken="GenerateAnAPITokenWithPrivilegesLimitedToSensorDownloadsAndThenPasteItHere=="
mkdir -p ~/.supported_kernels_checker
cd ~/.supported_kernels_checker || exit
header=$(echo "authorization: Bearer $(curl -s https://api.crowdstrike.com/oauth2/token -H "Authorization: Basic $apitoken" --data 'grant_type=client_credentials' | jq -r .access_token)" | tee /dev/stderr)
echo "$header" >/dev/stderr
curl -s -X GET "https://api.crowdstrike.com/sensors/combined/installers/v1?sort=release_date%7Cdesc&filter=platform%3A%22linux%22" -H "accept: application/json" -H "$header" | tee /dev/stderr | jq -cr '.resources | group_by(.version)[-1] | .[] | .file_type + ","+ .sha256 + "," + .version' | sort -u | tee /dev/stderr | while read typetabsha; do
echo "$typetabsha" >/dev/stderr
sha=$(
echo -n 'sha: ' >/dev/stderr
echo "$typetabsha" | cut -d ',' -f 2 | tee /dev/stderr
)
cat "$sha" || curl -X GET "https://api.crowdstrike.com/sensors/entities/download-installer/v1?id=$sha" -H "accept: application/json" -H "$header" | case $(echo "$typetabsha" | cut -d ',' -f 1 | tee /dev/stderr) in rpm) rpm2cpio ;; deb) dpkg-deb --fsys-tarfile /dev/stdin ;; *) echo neither_one_found >/dev/stderr ;; esac | bsdtar -xO -f - opt/CrowdStrike/falcon-kernel-check$(echo "$typetabsha" | cut -d ',' -f 3 | tee /dev/stderr | cut -d '.' -f 3 | tee /dev/stderr) | grep ^kernels | cut -d '"' -f 2 | perl -pe 's/\\n/\n/g' | tee "$sha"
done | sort -u
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment