diff --git a/bash/install/README.md b/bash/install/README.md index 78b8b1d..1962d62 100644 --- a/bash/install/README.md +++ b/bash/install/README.md @@ -39,6 +39,11 @@ Ensure the following API scopes are enabled: > Use this scope when configuring the `FALCON_SENSOR_UPDATE_POLICY_NAME` environment variable. - (optional) **Hosts** [write] > Use this scope when configuring the `FALCON_REMOVE_HOST` environment variable for the uninstall script. + > + > :warning: + > It is recommended to use Host Retention Policies in the Falcon console instead. + + ## Configuration @@ -267,6 +272,7 @@ Other Options: - FALCON_REMOVE_HOST (default: unset) Determines whether the host should be removed from the Falcon console after uninstalling the sensor. Requires API Authentication. + NOTE: It is recommended to use Host Retention Policies in the Falcon console instead. Accepted values are ['true', 'false']. - GET_ACCESS_TOKEN (default: unset) @@ -308,15 +314,6 @@ bash falcon-linux-uninstall.sh curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.7.1/bash/install/falcon-linux-uninstall.sh | bash ``` -#### Uninstall and remove the host from the Falcon console - -```bash -export FALCON_CLIENT_ID="XXXXXXX" -export FALCON_CLIENT_SECRET="YYYYYYYYY" -export FALCON_REMOVE_HOST="true" -curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.7.1/bash/install/falcon-linux-uninstall.sh | bash -``` - ## Troubleshooting To troubleshoot installation issues, run the script by using `bash -x`: diff --git a/bash/install/falcon-linux-uninstall.sh b/bash/install/falcon-linux-uninstall.sh index 6d07be5..f5e817c 100755 --- a/bash/install/falcon-linux-uninstall.sh +++ b/bash/install/falcon-linux-uninstall.sh @@ -30,6 +30,7 @@ Other Options: - FALCON_REMOVE_HOST (default: unset) Determines whether the host should be removed from the Falcon console after uninstalling the sensor. Requires API Authentication. + NOTE: It is recommended to use Host Retention Policies in the Falcon console instead. Accepted values are ['true', 'false']. - GET_ACCESS_TOKEN (default: unset) diff --git a/powershell/install/README.md b/powershell/install/README.md index e9369e7..f38a163 100644 --- a/powershell/install/README.md +++ b/powershell/install/README.md @@ -148,7 +148,7 @@ Delete sensor uninstaller package when complete [default: $true] .PARAMETER DeleteScript Delete script when complete [default: $false] .PARAMETER RemoveHost -Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken] +Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken]. It is recommended to use Host Retention Policies to remove hosts from the Falcon console instead of this parameter. .PARAMETER FalconCloud CrowdStrike Falcon OAuth2 API Hostname [default: autodiscover] .PARAMETER FalconClientId @@ -184,13 +184,6 @@ Basic example that will uninstall the sensor with the provided maintenance token .\falcon_windows_uninstall.ps1 -MaintenanceToken ``` -An example using the Falcon API to retrieve the maintenance token and remove the host from the Falcon console -after uninstalling. - -```pwsh -.\falcon_windows_uninstall.ps1 -FalconClientId -FalconClientSecret -RemoveHost -``` - ## Troubleshooting To assist in troubleshooting the installation scripts, you can try the following: diff --git a/powershell/install/falcon_windows_uninstall.ps1 b/powershell/install/falcon_windows_uninstall.ps1 index 624262d..563c6be 100755 --- a/powershell/install/falcon_windows_uninstall.ps1 +++ b/powershell/install/falcon_windows_uninstall.ps1 @@ -26,7 +26,7 @@ Delete sensor uninstaller package when complete [default: $true] .PARAMETER DeleteScript Delete script when complete [default: $false] .PARAMETER RemoveHost -Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken] +Remove host from CrowdStrike Falcon [requires either FalconClientId|FalconClientSecret or FalconAccessToken]. It is recommended to use Host Retention Policies to remove hosts from the Falcon console instead of this parameter. .PARAMETER FalconCloud CrowdStrike Falcon OAuth2 API Hostname [default: autodiscover] .PARAMETER FalconClientId