RTR "batch_init_session" using Falcon.py

[ITjoyboy]

Hi,
I was trying to execute "run" command on multiple hosts at the same time using "batch_admin_command" but in order to that I first need to initiate a batch session using "batch_init_session" falcon.py script but when i am running the python script it showing the below error=

code:
from falconpy import RealTimeResponse
falcon = RealTimeResponse(client_id="###############################",
client_secret="############################"
)
target_hosts = ["######################", "#######################"]
response = falcon.batch_init_sessions(host_ids=target_hosts,
timeout_duration="10m"
)
print(response)

Output :
{'status_code': 500, 'headers': {}, 'body': {'errors': [{'message': "HTTPSConnectionPool(host='api.crowdstrike.com', port=443): Max retries exceeded with url: /real-time-response/combined/batch-init-session/v1?timeout_duration=10m (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)')))"}], 'resources': []}}

I can see this is a SSL certificate error but I am no expert nether in python nor in API so if you guys just help me I would be really thankful.

[jshcodes]

Hi @ITjoyboy -

For environments where SSL verification cannot be performed, you can disable it by passing the ssl_verify keyword and setting it to False.

An example of this can be found here: https://falconpy.io/Usage/Environment-Configuration.html#ssl-verify

Thank you for the question!

[jshcodes]

You shouldn't need to run the script again. Once the command is queued, the agent will wait up to 7 days to execute the command.

So the process from a high level would be:

• Create a batch session with queue_offline enabled.
• Issue your command against the host group.
• Run a loop for a brief period of time to collect the responses from all the hosts that are online. (i.e. Give the commands time to execute and return a response back to you via RTR_CheckCommandStatus or RTR_CheckAdminCommandStatus.)
• If any are still pending, log the IDs and Batch IDs somewhere (or however you wish to track this), then schedule a cron job (or some other process) to check again after an hour or so.
  • At the end of the 7th day, have the scheduled job report back any AIDs that did not return to service and then delete itself.

[ITjoyboy]

Thanks josh for the valuable information.
Could you tell me if the script listed in this article "https://github.com/CrowdStrike/falconpy/blob/main/samples/rtr/queued_execute.py" can be used to do the same or I have modify the script to get the above work done for me

[jshcodes]

It's more of a discussion example, so you'll want to modify it. It was coded to wait until the first host in the batch returns to service, and does not implement follow up scheduling.

[ITjoyboy]

Ok got it, I will try to modify and run it in case I need any help I will get back to you.
Thanks again

[ITjoyboy]

Hi josh,
I was trying to read and understand what changes should be made on the script in order to get the desired results.
There was argument "-f" to find hostnames matching the string provided in it. But what if the group doesn't have similar pattern for the hostnames.