configure.yml

---
- name: Linux Block
  when: ansible_facts['distribution'] != "MacOSX"
  block:
    - name: CrowdStrike Falcon | Configure Falcon Sensor Options (Linux)
      crowdstrike.falcon.falconctl:
        cid: "{{ falcon_cid if (falcon_cid != None) else omit }}"
        provisioning_token: "{{ falcon_provisioning_token if (falcon_provisioning_token != None) else omit }}"
        apd: "{{ falcon_apd if (falcon_apd != None) else omit }}"
        aph: "{{ falcon_aph if (falcon_aph != None) else omit }}"
        app: "{{ falcon_app if (falcon_app != None) else omit }}"
        trace: "{{ falcon_trace if (falcon_trace != None) else omit }}"
        feature: "{{ falcon_feature if (falcon_feature != None) else omit }}"
        message_log: "{{ falcon_message_log if (falcon_message_log != None) else omit }}"
        billing: "{{ falcon_billing if (falcon_billing != None) else omit }}"
        tags: "{{ falcon_tags if (falcon_tags != None) else omit }}"
        backend: "{{ falcon_backend if (falcon_backend != None) else omit }}"
        state: "{{ 'present' if falcon_option_set else 'absent' }}"
      register: falconctl_result

    - name: CrowdStrike Falcon | Register Falcon Sensor Options
      crowdstrike.falcon.falconctl_info:
      register: info

    - name: CrowdStrike Falcon | Restart Falcon Sensor on Changes
      ansible.builtin.service:
        name: falcon-sensor
        state: "{{ falcon_service_state | default('restarted') }}"
        enabled: yes
      when:
        - info.falconctl_info.cid
        - falconctl_result.changed
      become: yes
      # noqa args[module]
      # noqa no-handler

# Start of MacOSX Configuration
- name: CrowdStrike Falcon | Stat Falcon Sensor (macOS)
  ansible.builtin.stat:
    path: "/Applications/Falcon.app/Contents/Resources/falconctl"
  register: falconctl_mac
  when: ansible_facts['distribution'] == "MacOSX"

- name: MacOSX Block
  when:
    - ansible_facts['distribution'] == "MacOSX"
    - falconctl_mac.stat.exists
  become: yes
  block:
    - name: CrowdStrike Falcon | Associate Falcon Sensor with your Customer ID (CID) (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl license {{ falcon_cid }}"
      when:
        - falcon_cid != None
        - not falcon_provisioning_token
      failed_when: falconctl_license.rc > 1
      register: falconctl_license
      changed_when: falconctl_license.rc == 0

    - name: CrowdStrike Falcon | Associate Falcon Sensor with your Provisioning Token (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl license {{ falcon_cid }} {{ falcon_provisioning_token }}"
      when:
        - falcon_cid != None
        - falcon_provisioning_token != None
      failed_when: falconctl_license.rc > 1
      register: falconctl_license_prov
      changed_when: falconctl_license_prov.rc == 0

    - name: CrowdStrike Falcon | Check status of Falcon Sensor (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl stats"
      failed_when: falconctl_stats.rc > 1
      register: falconctl_stats
      changed_when: false

    - name: CrowdStrike Falcon | Ensure Falcon Sensor is running (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl load"
      when:
        - falconctl_stats.rc != 0
      # noqa no-changed-when

    - name: CrowdStrike Falcon | Get Grouping Tags (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl grouping-tags get"
      register: falconctl_mac_tags_get
      when:
        - falcon_tags != None
      changed_when: falconctl_mac_tags_get.stdout != grouping_tags
      vars:
        grouping_tags: "Grouping tags: {{ falcon_tags }}"

    - name: CrowdStrike Falcon | Set Grouping Tags (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl grouping-tags set {{ falcon_tags }}"
      when:
        - falcon_tags != None
        - falconctl_mac_tags_get.changed
        - falcon_option_set
      register: falconctl_mac_tags_set
      changed_when: falconctl_mac_tags_set.stdout == "Grouping tags updated successfully."
      # noqa no-handler

    - name: CrowdStrike Falcon | Clear Grouping Tags (macOS)
      ansible.builtin.command: "/Applications/Falcon.app/Contents/Resources/falconctl grouping-tags clear"
      when:
        - falcon_tags != None
        - not falcon_option_set
      register: falconctl_mac_tags_clear
      changed_when: falconctl_mac_tags_clear.stdout == "Grouping tags updated successfully."

    - name: CrowdStrike Falcon | Restart Falcon Sensor on Changes (macOS)
      ansible.builtin.shell: |
        /Applications/Falcon.app/Contents/Resources/falconctl unload
        /Applications/Falcon.app/Contents/Resources/falconctl load
      when:
        - falconctl_mac_tags_set.changed or falconctl_mac_tags_clear.changed
      # noqa no-changed-when
      # noqa no-handler