falcon_discover dynamic inventory - ssh and winrm variables

[aaron-hodges-state-of-missouri]

Hello,

When creating the dynamic inventory through the falcon_discover plugin, where can I add the SSH and WinRM variables for connection purposes?

[carlosmmatos]

@aaron-hodges-state-of-missouri you can do this a couple of ways but it's really up to you. Check out https://docs.ansible.com/ansible/latest/inventory_guide/intro_inventory.html# for general ideas. I think the easiest method is to use group vars or some form of logical grouping. If you look at the examples in the falcon_discover you will get some idea.. but maybe you want to have a linux group and a windows group.. you can do something like:

plugin: crowdstrike.falcon.falcon_discover
# authentication credentials (required if not using environment variables)
#client_id: 1234567890abcdef12345678
#client_secret: 1234567890abcdef1234567890abcdef12345
#cloud: us-1
# place hosts in named groups based on conditional statements <evaluated as true>
groups:
  linux_assets: "platform_name == 'Linux'"
  windows_assets: "platform_name == 'Windows'"

Now you will have 2 groups that you can then assign group vars to like this:

• group_vars/linux_assets.yml:

ansible_connection: ssh
ansible_user: your_linux_user
ansible_ssh_private_key_file: /path/to/your/private/key

• group_vars/windows_assets.yml:

ansible_connection: winrm
ansible_user: your_windows_user
ansible_password: your_windows_password
ansible_port: 5986
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore

I hope this gives you a better idea of one way to accomplish this.

[aaron-hodges-state-of-missouri]

Thank you!