Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CrowdStrike seems to have broken security_theater playbook #5546

Open
VickieKarasic opened this issue Nov 20, 2024 · 2 comments
Open

CrowdStrike seems to have broken security_theater playbook #5546

VickieKarasic opened this issue Nov 20, 2024 · 2 comments
Assignees
Labels

Comments

@VickieKarasic
Copy link
Contributor

VickieKarasic commented Nov 20, 2024

Expected behavior

When we run the security_theater playbook, VMs get checked for CrowdStrike and it installs/updates the agent if not on the machine already.

Actual behavior

Playbook is failing to check VMs with an error in the role crowdstrike.falcon.falcon_install

Error messages

Include any error messages from STDOUT, STDERR, log files, etc., that you did not include under 'Actual behavior' above.

ERROR! the role 'crowdstrike.falcon.falcon_install' was not found in /Users/karasicv/Desktop/Git_Repos/princeton_ansible/playbooks/utils/roles:/Users/karasicv/Desktop/Git_Repos/princeton_ansible/external_roles:/Users/karasicv/Desktop/Git_Repos/princeton_ansible/playbooks/utils

The error appears to be in '/Users/karasicv/Desktop/Git_Repos/princeton_ansible/playbooks/utils/security_theater.yml': line 16, column 5, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

  roles:
  - role: crowdstrike.falcon.falcon_install

Steps to replicate

Run the playbook on any VM. Example:

ansible-playbook playbooks/utils/security_theater.yml --limit sandbox-vkarasic.lib.princeton.edu

Impact of this bug

Security updates are not being installed until this is fixed.

Relevant links and code snippets, if applicable

Implementation notes, if any

@VickieKarasic
Copy link
Contributor Author

Once we get my environment back to running state, we suspect that we will need to install the ansible-galaxy collection for crowdstrike to fix this error, as it seems to be missing from my env to run the playbook successfully:

ansible-galaxy collection install crowdstrike.falcon
(https://galaxy.ansible.com/ui/repo/published/crowdstrike/falcon/)

@VickieKarasic
Copy link
Contributor Author

VickieKarasic commented Dec 2, 2024

security_theater playbook failed to change anything again on today's run on qa and prod (after running successfully last week, 11/25/24). Tower output here: qa, prod.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants