Get-FalconHost dump to CSV with offset

[NotMaster10]

Hello everyone,

I'm trying to write a script that will allow me to export a list of all of our hosts to a .csv which can then be used for reporting purposes. I used to run this individually on our different CIDs, however we've grown too much and our hosts exceed the max limit for a single pull.

Here's the current script I have, which works okay... but seems to miss some hosts and also duplicates all of them two or three times so I have to remove duplicates and then double check for any that got missed.

Any suggestions on how I can resolve the duplication issue as well as why some of the hosts in CrowdStrike are not being pulled down? The last one I checked there were only a handful that were missed.

Define file paths

$csvFilePath = "C:<filepath>\All Hosts.csv"
$batchSize = 5000

Prompt for authentication using Request-FalconToken

$cloudRegion = "us-1" # Replace with the appropriate cloud region if needed
try {
Request-FalconToken -Cloud $cloudRegion
Write-Host "Authentication successful."
} catch {
Write-Error "Failed to authenticate. Please check your credentials and try again."
exit
}

Initialize the CSV file by creating a header

if (-Not (Test-Path $csvFilePath)) {
# Add header row to the new CSV file
"Hostname" | Out-File -FilePath $csvFilePath -Encoding utf8
}

Fetch hosts and process in batches

$allHosts = Get-FalconHost -Detailed | Select-Object Hostname
$totalHosts = $allHosts.Count
$currentBatchStart = 0

while ($currentBatchStart -lt $totalHosts) {
# Select the current batch
$currentBatch = $allHosts[$currentBatchStart..([Math]::Min($currentBatchStart + $batchSize - 1, $totalHosts - 1))]

# Export the current batch to the CSV file
$currentBatch | Export-Csv -Path $csvFilePath -Append -NoTypeInformation -Encoding utf8

# Move to the next batch
$currentBatchStart += $batchSize

}

Write-Host "Data has been written to $csvFilePath."

[bk-cs]

There is a limit per request--but not in total--for Get-FalconHost. You do not need to use offset. If you're using Flight Control, you can run this from the parent and export everything.

Get-FalconHost -Detailed -All | Select-Object cid,aid,hostname | Export-Csv -Path $csvFilePath -NoTypeInformation -Encoding utf8