Add-FalconSensorTag - Not working for some hosts

[ghost]

When I mass apply Add-FalconSensorTag, a few of our hosts doesn't get applied with the new tag (however the API will state that it does). When we go to the console, it still shows the old tag.

Is it a known bug?

Please see this screenshot in chronological order.

[bk-cs]

• Is it possible that the devices disconnect in the middle of the attempt to apply the tag?
• Could the devices be running an older version of .NET?

Add-FalconSensorTag runs a custom script to apply the tag for older sensor versions and uses CsSensorSettings.exe for newer ones.

[ghost]

Thank you! It's weird heh

• For .NET versions we're not so sure what the hosts are on
• But if we keep retrying for 3-4 times, it will eventually apply the correct tags
• As mentioned, the command line will say one thing but the console will still have the old tags.

When you mention about older sensor versions, how far back does that support?

[bk-cs]

Any sensor newer than 6.42 will use CsSensorSettings.exe, and older will use the script. Real-time Response might be timing out when attempting to add the tags, if you're not getting any results back. I'm working on some changes for Invoke-FalconRtr and Invoke-FalconDeploy to avoid timeout issues in the next release. I'll make sure I apply the same code to the SensorTag commands too.

Note that SensorGroupingTags do not apply until the system is rebooted. If the output of Add-FalconSensorTag shows your desired tag, then it worked (because that output is what is contained in the system registry).