crowdstrike.falcon.fctl_child_cid_info module – Retrieve details about Flight Control child CIDs

Note

This module is part of the crowdstrike.falcon collection (version 4.7.0).

To install it, use: ansible-galaxy collection install crowdstrike.falcon. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: crowdstrike.falcon.fctl_child_cid_info.

New in crowdstrike.falcon 4.5.0

Synopsis

  • This module fetches and returns detailed information about specified Flight Control child CIDs.

Requirements

The below requirements are needed on the host that executes this module.

  • Flight Control [READ] API scope

  • crowdstrike-falconpy >= 1.3.0

  • python >= 3.6

Parameters

Parameter

Comments

auth

dictionary

The registered result of the crowdstrike.falcon.auth module, or a dictionary containing the access_token and cloud keys.

If provided, the client_id, client_secret, member_cid, and cloud options are ignored.

Useful when needing to make multiple API calls to avoid rate limiting issues.

access_token

string

The OAuth2 access token to use for authentication.

cloud

string

The CrowdStrike cloud region to use.

This can differ from the module’s cloud argument due to autodiscovery.

cids

list / elements=string / required

A list of child CIDs to retrieve information for.

Consider using the crowdstrike.falcon.fctl_child_cids lookup plugin to obtain a list of child CIDs.

client_id

aliases: falcon_client_id

string

The CrowdStrike API client ID to use.

See the Falcon documentation for more information about API clients.

The FALCON_CLIENT_ID environment variable can also be used.

client_secret

aliases: falcon_client_secret

string

The CrowdStrike API secret that corresponds to the client ID.

See the Falcon documentation for more information about API clients.

The FALCON_CLIENT_SECRET environment variable can also be used.

cloud

string

The CrowdStrike cloud region to use.

All clouds are automatically discovered if not specified, except for the us-gov-1 cloud.

The FALCON_CLOUD environment variable can also be used.

Choices:

  • "us-1" ← (default)

  • "us-2"

  • "us-gov-1"

  • "eu-1"

ext_headers

dictionary

Extended headers that are prepended to the default headers dictionary.

member_cid

string

The CrowdStrike member CID for MSSP authentication.

See the Falcon documentation for more information about API clients.

The FALCON_MEMBER_CID environment variable can also be used.

user_agent

string

Custom User-Agent string to use for requests to the API.

The user agent string is prepended to the default user agent string (crowdstrike-ansible/<version>).

See RFC 7231 for more information.

The FALCON_USER_AGENT environment variable can also be used.

Examples

- name: Get information about a single child CID
  crowdstrike.falcon.fctl_child_cid_info:
    cids: "12345678901234567890"

- name: Get information about more than one child CID
  crowdstrike.falcon.fctl_child_cid_info:
    cids:
      - "12345678901234567890"
      - "09876543210987654321"

- name: Get information about all child CIDs (using fctl_child_cids lookup)
  crowdstrike.falcon.fctl_child_cid_info:
    cids: "{{ lookup('crowdstrike.falcon.fctl_child_cids') }}"

- name: Get information about all child CIDs from a secondary parent CID (using fctl_child_cids lookup)
  crowdstrike.falcon.fctl_child_cid_info:
    cids: "{{ lookup('crowdstrike.falcon.fctl_child_cids', '12345678901234567890') }}"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

child_cids

list / elements=dictionary

A list of dictionaries containing information about the child CIDs.

Returned: success

checksum

string

The checksum of the child CID.

Returned: success

Sample: "xy"

child_cid

string

The unique identifier of the child CID.

Returned: success

Sample: "12345678901234567890"

child_gcid

string

The global CID of the child CID.

Returned: success

Sample: "g12345678901234567890"

child_of

string

The unique identifier of the parent CID.

Returned: success

Sample: "09876543210987654321"

domains

list / elements=string

A list of domains associated with the child CID.

Returned: success

Sample: ["example.com"]

name

string

The name of the child CID.

Returned: success

Sample: "Flight Control Child 1"

status

string

The status of the child CID.

Returned: success

Sample: "active"

Authors

  • Carlos Matos (@carlosmmatos)