crowdstrike.falcon.host_group_info module – Get information about Falcon host groups

Note

This module is part of the crowdstrike.falcon collection (version 4.9.1).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install crowdstrike.falcon. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: crowdstrike.falcon.host_group_info.

New in crowdstrike.falcon 4.10.0

Synopsis

  • Returns detailed information for one or more host groups.

  • Some of the details returned include group name, description, group type, assignment rules, creation and modification timestamps, and member counts.

  • Can retrieve specific host groups by ID or search for groups using FQL filters.

  • Optionally includes detailed member information for each group.

Requirements

The below requirements are needed on the host that executes this module.

  • Host Groups [READ] API scope

  • crowdstrike-falconpy >= 1.3.0

  • python >= 3.6

Parameters

Parameter

Comments

auth

dictionary

The registered result of the crowdstrike.falcon.auth module, or a dictionary containing the access_token and cloud keys.

If provided, the client_id, client_secret, member_cid, and cloud options are ignored.

Useful when needing to make multiple API calls to avoid rate limiting issues.

access_token

string

The OAuth2 access token to use for authentication.

cloud

string

The CrowdStrike cloud region to use.

This can differ from the module’s cloud argument due to autodiscovery.

client_id

aliases: falcon_client_id

string

The CrowdStrike API client ID to use.

See the Falcon documentation for more information about API clients.

The FALCON_CLIENT_ID environment variable can also be used.

client_secret

aliases: falcon_client_secret

string

The CrowdStrike API secret that corresponds to the client ID.

See the Falcon documentation for more information about API clients.

The FALCON_CLIENT_SECRET environment variable can also be used.

cloud

string

The CrowdStrike cloud region to use.

All clouds are automatically discovered if not specified, except for the us-gov-1 cloud.

The FALCON_CLOUD environment variable can also be used.

Choices:

  • "us-1" ← (default)

  • "us-2"

  • "us-gov-1"

  • "eu-1"

ext_headers

dictionary

Extended headers that are prepended to the default headers dictionary.

filter

string

FQL (Falcon Query Language) filter expression to limit results.

Examples: name:'Production*', group_type:'dynamic', created_timestamp:>'2024-01-01T00:00:00Z'.

Cannot be used together with host_groups.

host_groups

list / elements=string

A list of host group IDs to get information about.

If not provided, all accessible host groups will be returned (subject to filter and pagination).

include_members

boolean

Whether to include detailed member information for each host group.

When enabled, adds a members list to each group with host details.

This may significantly increase response time and size for groups with many members.

Choices:

  • false ← (default)

  • true

limit

integer

Maximum number of host groups to return.

Must be between 1 and 5000.

Default: 100

member_cid

string

The CrowdStrike member CID for MSSP authentication.

See the Falcon documentation for more information about API clients.

The FALCON_MEMBER_CID environment variable can also be used.

offset

integer

Starting index for pagination.

Use with limit to paginate through large result sets.

Default: 0

sort

string

Property to sort results by.

Prefix with - for descending order.

Examples: name, -created_timestamp, group_type.

user_agent

string

Custom User-Agent string to use for requests to the API.

The user agent string is prepended to the default user agent string (crowdstrike-ansible/<version>).

See RFC 7231 for more information.

The FALCON_USER_AGENT environment variable can also be used.

Examples

- name: Get information about all host groups
  crowdstrike.falcon.host_group_info:

- name: Get information about specific host groups
  crowdstrike.falcon.host_group_info:
    host_groups:
      - "12345678901234567890abcdef123456"
      - "abcdef123456789012345678901234"

- name: Search for host groups by name pattern
  crowdstrike.falcon.host_group_info:
    filter: "name:'Production*'"
    limit: 50

- name: Get dynamic host groups created in the last 7 days
  crowdstrike.falcon.host_group_info:
    filter: "group_type:'dynamic'+created_timestamp:>'{{ (ansible_date_time.epoch | int - 604800) }}'"
    sort: "-created_timestamp"

- name: Get host group information including member details
  crowdstrike.falcon.host_group_info:
    host_groups: ["12345678901234567890abcdef123456"]
    include_members: true

- name: Paginate through all host groups
  crowdstrike.falcon.host_group_info:
    limit: 100
    offset: "{{ page * 100 }}"
  loop: "{{ range(0, total_groups // 100 + 1) | list }}"
  loop_control:
    loop_var: page

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

host_groups

list / elements=dictionary

A list of host groups that match the search criteria.

Returned: success

assignment_rule

string

The assignment rule for dynamic groups (FQL filter).

Returned: success

Sample: "platform_name:'Linux'+tags:'production'"

created_by

string

The user who created the host group.

Returned: success

Sample: "user@example.com"

created_timestamp

string

The timestamp when the host group was created.

Returned: success

Sample: "2024-01-15T10:30:00.000000Z"

description

string

The description of the host group.

Returned: success

Sample: "All production server hosts"

group_hash

string

A hash representing the current state of the group.

Returned: success

Sample: "abc123def456789"

group_type

string

The type of host group (static, dynamic, or staticByID).

Returned: success

Sample: "dynamic"

id

string

The unique identifier of the host group.

Returned: success

Sample: "12345678901234567890abcdef123456"

members

list / elements=dictionary

List of host group members (only when include_members=true).

Returned: when include_members=true

device_id

string

The host ID (AID) of the member.

Returned: success

Sample: "d78cd791785442a98ec75249d8c385dd"

hostname

string

The hostname of the member host.

Returned: success

Sample: "web-server-01"

last_seen

string

When the member host was last seen.

Returned: success

Sample: "2024-02-01T15:45:00Z"

platform_name

string

The platform of the member host.

Returned: success

Sample: "Linux"

modified_by

string

The user who last modified the host group.

Returned: success

Sample: "admin@example.com"

modified_timestamp

string

The timestamp when the host group was last modified.

Returned: success

Sample: "2024-02-01T14:22:30.000000Z"

name

string

The name of the host group.

Returned: success

Sample: "Production Servers"

meta

dictionary

Metadata about the query results.

Returned: success

pagination

dictionary

Pagination information.

Returned: success

limit

integer

The limit used for this query.

Returned: success

Sample: 100

offset

integer

The starting index used for this query.

Returned: success

Sample: 0

total

integer

Total number of host groups matching the query.

Returned: success

Sample: 1247

query_time

float

Time taken to execute the query in seconds.

Returned: success

Sample: 0.123

Authors

  • Carlos Matos (@carlosmmatos)