crowdstrike.falcon.fctl_child_cids lookup – fetch Flight Control child CIDs

Note

This lookup plugin is part of the crowdstrike.falcon collection (version 4.7.0).

To install it, use: ansible-galaxy collection install crowdstrike.falcon. You need further requirements to be able to use this lookup plugin, see Requirements for details.

To use it in a playbook, specify: crowdstrike.falcon.fctl_child_cids.

New in crowdstrike.falcon 4.5.0

Synopsis

  • This lookup returns a list of Flight Control child CIDs from your given parent credentials.

  • You can further limit the results by passing in a secondary parent CID.

Requirements

The below requirements are needed on the local controller node that executes this lookup.

  • Flight Control [READ] API scope

  • crowdstrike-falconpy >= 1.3.0

  • python >= 3.6

Terms

Parameter

Comments

Terms

string

Optionally pass in a secondary parent CID to limit the results.

If no terms are passed in, all child CIDs associated with the parent credentials will be returned.

Keyword parameters

This describes keyword parameters of the lookup. These are the values key1=value1, key2=value2 and so on in the following examples: lookup('crowdstrike.falcon.fctl_child_cids', key1=value1, key2=value2, ...) and query('crowdstrike.falcon.fctl_child_cids', key1=value1, key2=value2, ...)

Parameter

Comments

client_id

aliases: falcon_client_id

string

The CrowdStrike API client ID to use.

See the Falcon documentation for more information about API clients.

The FALCON_CLIENT_ID environment variable can also be used.

client_secret

aliases: falcon_client_secret

string

The CrowdStrike API secret that corresponds to the client ID.

See the Falcon documentation for more information about API clients.

The FALCON_CLIENT_SECRET environment variable can also be used.

cloud

string

The CrowdStrike cloud region to use.

All clouds are automatically discovered if not specified, except for the us-gov-1 cloud.

The FALCON_CLOUD environment variable can also be used.

Choices:

  • "us-1" ← (default)

  • "us-2"

  • "us-gov-1"

  • "eu-1"

ext_headers

dictionary

Extended headers that are prepended to the default headers dictionary.

member_cid

string

The CrowdStrike member CID for MSSP authentication.

See the Falcon documentation for more information about API clients.

The FALCON_MEMBER_CID environment variable can also be used.

user_agent

string

Custom User-Agent string to use for requests to the API.

The user agent string is prepended to the default user agent string (crowdstrike-ansible/<version>).

See RFC 7231 for more information.

The FALCON_USER_AGENT environment variable can also be used.

Notes

Note

  • When keyword and positional parameters are used together, positional parameters must be listed before keyword parameters: lookup('crowdstrike.falcon.fctl_child_cids', term1, term2, key1=value1, key2=value2) and query('crowdstrike.falcon.fctl_child_cids', term1, term2, key1=value1, key2=value2)

  • This plugin will automatically handle pagination for you, so you do not need to worry about it.

Examples

- name: Print all child CIDs
  ansible.builtin.debug:
    msg: "{{ lookup('crowdstrike.falcon.fctl_child_cids') }}"

- name: Print all child CIDs for a secondary parent CID
  ansible.builtin.debug:
    msg: "{{ lookup('crowdstrike.falcon.fctl_child_cids', '123456789abcdefg') }}"

- name: Get information about all child CIDs
  crowdstrike.falcon.fctl_child_cid_info:
    cids: "{{ lookup('crowdstrike.falcon.fctl_child_cids') }}"

Return Value

Key

Description

Return value

list / elements=string

A list of Flight Control child CIDs.

Returned: success

Authors

  • Carlos Matos (@carlosmmatos)

Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.