chore: prefer the use of Host Retention Policies

CrowdStrike · Dec 4, 2024 · 7aef724 · 7aef724
1 parent a697ee4
commit 7aef724
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 18 deletions.
diff --git a/bash/install/README.md b/bash/install/README.md
@@ -39,6 +39,11 @@ Ensure the following API scopes are enabled:
   > Use this scope when configuring the `FALCON_SENSOR_UPDATE_POLICY_NAME` environment variable.
 - (optional) **Hosts** [write]
   > Use this scope when configuring the `FALCON_REMOVE_HOST` environment variable for the uninstall script.
+  >
+  > :warning:
+  > It is recommended to use Host Retention Policies in the Falcon console instead.
+
+
 
 ## Configuration
 
@@ -267,6 +272,7 @@ Other Options:
     - FALCON_REMOVE_HOST                (default: unset)
         Determines whether the host should be removed from the Falcon console after uninstalling the sensor.
         Requires API Authentication.
+        NOTE: It is recommended to use Host Retention Policies in the Falcon console instead.
         Accepted values are ['true', 'false'].
 
     - GET_ACCESS_TOKEN                  (default: unset)
@@ -308,15 +314,6 @@ bash falcon-linux-uninstall.sh
 curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.7.1/bash/install/falcon-linux-uninstall.sh | bash
 ```
 
-#### Uninstall and remove the host from the Falcon console
-
-```bash
-export FALCON_CLIENT_ID="XXXXXXX"
-export FALCON_CLIENT_SECRET="YYYYYYYYY"
-export FALCON_REMOVE_HOST="true"
-curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.7.1/bash/install/falcon-linux-uninstall.sh | bash
-```
-
 ## Troubleshooting
 
 To troubleshoot installation issues, run the script by using `bash -x`:

diff --git a/bash/install/falcon-linux-uninstall.sh b/bash/install/falcon-linux-uninstall.sh
@@ -30,6 +30,7 @@ Other Options:
     - FALCON_REMOVE_HOST                (default: unset)
         Determines whether the host should be removed from the Falcon console after uninstalling the sensor.
         Requires API Authentication.
+        NOTE: It is recommended to use Host Retention Policies in the Falcon console instead.
         Accepted values are ['true', 'false'].
 
     - GET_ACCESS_TOKEN                  (default: unset)

diff --git a/powershell/install/README.md b/powershell/install/README.md
@@ -148,7 +148,7 @@ Delete sensor uninstaller package when complete [default: $true]
 .PARAMETER DeleteScript
 Delete script when complete [default: $false]
 .PARAMETER RemoveHost
-Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken]
+Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken]. It is recommended to use Host Retention Policies to remove hosts from the Falcon console instead of this parameter.
 .PARAMETER FalconCloud
 CrowdStrike Falcon OAuth2 API Hostname [default: autodiscover]
 .PARAMETER FalconClientId
@@ -184,13 +184,6 @@ Basic example that will uninstall the sensor with the provided maintenance token
 .\falcon_windows_uninstall.ps1 -MaintenanceToken <string>
 ```
 
-An example using the Falcon API to retrieve the maintenance token and remove the host from the Falcon console
-after uninstalling.
-
-```pwsh
-.\falcon_windows_uninstall.ps1 -FalconClientId <string> -FalconClientSecret <string> -RemoveHost
-```
-
 ## Troubleshooting
 
 To assist in troubleshooting the installation scripts, you can try the following:

diff --git a/powershell/install/falcon_windows_uninstall.ps1 b/powershell/install/falcon_windows_uninstall.ps1
@@ -26,7 +26,7 @@ Delete sensor uninstaller package when complete [default: $true]
 .PARAMETER DeleteScript
 Delete script when complete [default: $false]
 .PARAMETER RemoveHost
-Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken]
+Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken]. It is recommended to use Host Retention Policies to remove hosts from the Falcon console instead of this parameter.
 .PARAMETER FalconCloud
 CrowdStrike Falcon OAuth2 API Hostname [default: autodiscover]
 .PARAMETER FalconClientId