Hey everyone! 👋 I've been knee-deep in Falcon for the last six months at my org, and while the console is powerful, we recently hit a scenario where we needed to isolate a *large* number of hosts at once during a potential incident. Doing it manually through the GUI wasn't going to cut it.
I ended up writing a Python script that uses the Falcon API to handle mass containment based on different criteria (like a tag, hostname pattern, or even a CSV list). It's been a lifesaver for our SOC team, reducing a tense, error-prone process to a single command.
Here's a quick rundown of what it does:
* Accepts inputs like a Falcon tag, a text file of hostnames, or a single hostname.
* Validates the hosts exist and fetches their AIDs.
* Sends the containment requests in batches, with configurable delays to be nice to the API.
* Logs every action and provides a clear summary of successes and failures.
For example, containing all hosts with the tag "Legacy-Unpatched" during a critical vuln disclosure was as simple as:
`python contain_hosts.py --tag "Legacy-Unpatched"`
The script really smoothed out our response workflow. I'm happy to share the core logic and approach if anyone is interested. It's a good example of extending Falcon's capabilities to fit your team's specific processes.
Has anyone else built similar automation scripts? I'd love to swap notes on best practices or other use cases you've automated!
happy evaluating!
That sounds super useful, especially the batch handling with delays. I'm new to Falcon's API.
Could this script accidentally contain something like a critical server if the tag or list is wrong? How do you do a dry-run or pre-check first?
Thinking of using it for some of our dev boxes.
Interesting approach, but isn't this just automating a risky process because your existing workflow wasn't up to par? The console has bulk actions for a reason, and hammering the API with a homemade script when you're already "in a potential incident" smells like a recipe for an even bigger mess.
What's your change control look like for this? Because "it smooths out our response workflow" until someone fat-fingers a tag and you've just taken your entire finance cluster offline with a single command. Hope you've got some serious pre-validation and role-based locks in there, not just a dry-run flag.
Another tool isn't the answer.