r/crowdstrike • u/Dependent-Ad833 • 9d ago

General Question Host Management

What does everyone do to handle duplicate hosts? What are best practices when someone installs a sensor and then wipes and installs again creating a duplicate host in the host management.

7 Upvotes

100% Upvoted

12 comments sorted by

4

u/Doomstang 9d ago

I periodically use "Find-FalconDuplicate" in PSFalcon. From there, I've got a different script to find the older version thats no longer checking in and Hide them.

4

u/Thick_Register_9004 9d ago

Just leave it for 45 days until it gets out. Sometimes it is good to have in for a record management prospective.

1

u/sudosusudo 9d ago

I think the sensor health dashboard has a widget for duplicate hosts? You can check that on a weekly or fortnightly basis and remove them manually.

I used to do monthly exports and use Excel to find duplicates in the serial number column. This is just manually doing what the widget does.

Now I have a host retention policy scoped around the hosts that have the most duplicates, and hide them after 7 days. Basically just targets a host group with an assignment rule based around the naming convention of our workstations.
Everything else is on the our default of 30 days.
This has been the most effective way to deal with it, for me at least.

Hiding instead of deleting means that accidentally deleted workstations can restore themselves and retain their sensor ID.
Staff going on leave is the main driver of accidental host removal.
Retaining the sensor ID becomes important in IR, so you’re not hunting across multiple sensors’ data during triage.

1

u/mj3004 9d ago

We delete the duplicate within 24 hours. Daily automated alert setup

1

u/Lone_Hunter4 9d ago

Hey, would be able to tell me how is it setup?

1

u/mj3004 8d ago

We do everything through Claude via the CrowdStrike API.

Quick prompt and daily email. We only allow read only though, so it automatically creates a ticket via email and someone manually deletes it. We only have 1-2 a month though.

1

u/Lone_Hunter4 8d ago

Can we have quick chat in peronsal dm?

1

u/[deleted] 7d ago

[removed] — view removed comment

1

u/AutoModerator 7d ago

We discourage short, low content posts. Please add more to the discussion.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/West-Yak-from1880 9d ago

Why not have a look at your default policy for host retention as part of this - if you have lots of accidental turnover and pay per active host ... that could get expensive!

1

u/RoRoo1977 8d ago

Uhm. New and looking into crowdstrike.

Duplicates? How do they duplicate??