Sample for revealing maintenance token.

[JayBabs]

Does anyone have the sample for revealing the maintenance token ? I would like to upgrade our workflow when troubleshooting a agent who's been offline and won't connect to the console.

[jshcodes]

Hi @JayBabs!

Try this and let us know if you have any questions or problems:

from falconpy.sensor_update_policy import Sensor_Update_Policy as SensorPolicies

creds = {
    "client_id": "API_CLIENT_ID_HERE",
    "client_secret": "API_CLIENT_SECRET_HERE"
}
falcon = SensorPolicies(creds=creds)

result = falcon.revealUninstallToken(body={"device_id": "MAINTENANCE"})
try:
    maint_token = result["body"]["resources"][0]["uninstall_token"]
except KeyError:
    maint_token = "Unable to retrieve maintenance token, check that your API key has access to the Sensor Update Policy API."

print(f"Result: {maint_token}")

[JayBabs]

Does this work with any agent that felt out of sync ?

[jshcodes]

I checked the Sensor Update Policy documentation. Depending on the sensor policy settings currently enabled, I believe it should.

• Bulk maintenance mode must be enabled within the sensor update policy.
  • This option is available when Uninstall and maintenance protection is enabled and the sensor version is set to Sensor version updates off.
• Sensors must either be connected to the cloud or have connected to the cloud after Bulk maintenance mode was enabled to receive the bulk maintenance token.

Note: If you pass a device AID instead of the string MAINTENANCE in the body payload, you should be able to retrieve a device specific token using the same code. (Which should not need the policy settings specified above.)