### Set Windows Grouping Tags During Installation

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Use the falcon_windows_install_args variable to pass grouping tags during the initial sensor installation.

```yaml
falcon_windows_install_args: "/norestart GROUPING_TAGS=tag1,tag2"
```

--------------------------------

### Install Python Dependencies from requirements.txt

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Install all required Python packages by referencing the requirements.txt file, typically used when cloning the repository. This ensures all dependencies are met.

```terminal
pip install -r requirements.txt
```

--------------------------------

### Install CrowdStrike Falcon Ansible Collection

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Install the collection from Ansible Galaxy using the command-line tool. This is the primary method for obtaining the collection.

```terminal
ansible-galaxy collection install crowdstrike.falcon
```

--------------------------------

### Install Falcon Sensor from Local File

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Installs the Falcon Sensor from a local .deb file and cleans up the file afterward. Requires the path to the local sensor file.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_install_method: file
      falcon_localfile_path: /tmp/falcon.deb
      falcon_localfile_cleanup: yes
```

--------------------------------

### Install Latest Falcon Sensor

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Installs the latest available Falcon Sensor. Requires Falcon Client ID and Secret.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
```

--------------------------------

### Install Falcon Sensor on Windows

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Installs and configures the Falcon Sensor on Windows with custom arguments and credentials. Requires Falcon Client ID, Secret, and CID.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_cid: <FALCON_CID>
      falcon_windows_install_args: "/norestart ProvWaitTime=600"
      falcon_windows_become: true
      falcon_windows_become_method: runas
      falcon_windows_become_user: SYSTEM
```

--------------------------------

### Install Falcon Sensor with Update Policy

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Installs the Falcon Sensor using a named sensor update policy. Requires Falcon Client ID and Secret.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_sensor_update_policy_name: "ACME Policy"
```

--------------------------------

### Install Falcon Sensor Version N-2

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Installs the Falcon Sensor with a version relative to the latest (N-2). Requires Falcon Client ID and Secret.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_sensor_version_decrement: 2
```

--------------------------------

### Install Specific Falcon Sensor Version

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Installs a specific version of the Falcon Sensor (e.g., 6.40.13707). Requires Falcon Client ID and Secret.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_sensor_version: '6.40.13707'
```

--------------------------------

### Configure Pre-obtained Maintenance Token

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Directly provides a static maintenance token string to the installation role.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_maintenance_token: "your-maintenance-token-here"
```

--------------------------------

### Install Latest Sensor and Prepare Golden Image

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Installs the latest CrowdStrike Falcon Sensor and prepares a golden image for deployment. It can also remove the sensor's AID if specified.

```yaml
- hosts: target-host
  vars:
    falcon_client_id: <FALCON_CLIENT_ID>
    falcon_client_secret: <FALCON_CLIENT_SECRET>
  roles:
  - role: crowdstrike.falcon.falcon_install

  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_remove_aid: yes
```

--------------------------------

### Configure Falcon Event Stream in Ansible Rulebook

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/docs/crowdstrike.falcon.eventstream.md

Example configuration for the event source plugin, including authentication and stream filtering options.

```yaml
---
- name: Simple Falcon Event Stream Usage Example
  hosts: all
  sources:
    - crowdstrike.falcon.eventstream:
        falcon_client_id: "{{ FALCON_CLIENT_ID }}"
        falcon_client_secret: "{{ FALCON_CLIENT_SECRET }}"
        falcon_cloud: "us-2"
        # start stream from specified offset
        offset: 12345
        stream_name: "eda-example"
        include_event_types:
          - "DetectionSummaryEvent"

  rules:
    - name: Print High and Critical Severity Detection Events
      condition: event.falcon.event.Severity > 3
      action:
        debug:
```

--------------------------------

### Set Windows Grouping Tags Post-Installation

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Use the falcon_tags variable within the falcon_configure role to manage tags after the sensor is installed.

```yaml
falcon_tags: "tag1,tag2"
```

--------------------------------

### Install CrowdStrike Falcon Ansible Collection via requirements.yml

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Include the collection in a requirements.yml file for automated installation. This is useful for managing dependencies in larger Ansible projects.

```yaml
---
collections:
  - crowdstrike.falcon
```

```terminal
ansible-galaxy collection install -r requirements.yml
```

--------------------------------

### Download Latest Windows Sensor Installers

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Retrieves information about the 2 latest Windows Sensor installers from the CrowdStrike Falcon API. Requires client ID, secret, and cloud region.

```yaml
---
  - name: Get a list of the 2 latest Windows Sensor Installers
    crowdstrike.falcon.sensor_download_info:
      client_id: <FALCON_CLIENT_ID>
      client_secret: <FALCON_CLIENT_SECRET>
      cloud: us-2
      limit: 2
      filter: "platform_name:'windows'"
      sort: "version|desc"
    delegate_to: localhost
```

--------------------------------

### Install and Configure CrowdStrike Falcon Sensor (N-2)

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Installs and configures the CrowdStrike Falcon Sensor at version N-2 using built-in Ansible roles. Requires Falcon client ID and secret for authentication.

```yaml
- hosts: all
  vars:
    falcon_client_id: <FALCON_CLIENT_ID>
    falcon_client_secret: <FALCON_CLIENT_SECRET>
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_sensor_version_decrement: 2

  - role: crowdstrike.falcon.falcon_configure
    vars:
      # falcon_cid is autodetected using falcon_client_id|secret vars
      falcon_tags: 'falcon,example,tags'
```

--------------------------------

### Install Python Dependencies for CrowdStrike FalconPy

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Install the necessary Python packages, including crowdstrike-falconpy and aiohttp, directly using pip. This is required for the collection to function correctly.

```terminal
pip install crowdstrike-falconpy aiohttp
```

--------------------------------

### Get Information About Windows Hosts

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Fetches information about all Windows hosts using the host_ids lookup plugin. Requires a filter to specify Windows hosts.

```yaml
---
  - name: Get information about all Windows hosts (using host_ids lookup)
    crowdstrike.falcon.host_info:
      hosts: "{{ lookup('crowdstrike.falcon.host_ids', windows_host_filter) }}"
    vars:
      windows_host_filter: 'platform_name:"Windows"'
```

--------------------------------

### Install Specific Version of CrowdStrike Falcon Ansible Collection

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Install a particular version of the collection, useful for downgrading or ensuring compatibility with specific environments. Specify the version using the '==' operator.

```terminal
ansible-galaxy collection install crowdstrike.falcon:==0.1.0
```

--------------------------------

### Uninstall Falcon Sensor with Pre-obtained Maintenance Token

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_uninstall/README.md

This example shows how to uninstall the Falcon Sensor using a pre-obtained maintenance token. This is useful when you have already retrieved the token through other means.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_uninstall
    vars:
      falcon_maintenance_token: "your-maintenance-token-here"

```

--------------------------------

### React to Security Events with EDA Event Source

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Integrates CrowdStrike Falcon event streams with Ansible Event-Driven Automation (EDA). Requires Ansible EDA to be installed and Falcon credentials.

```shell
ansible-rulebook -i inventory -r crowdstrike.falcon.event_stream_example -E FALCON_CLIENT_ID,FALCON_CLIENT_SECRET
```

--------------------------------

### Upgrade CrowdStrike Falcon Ansible Collection

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Manually upgrade the collection to the latest version when installed from Ansible Galaxy. This ensures you have the most recent features and bug fixes.

```terminal
ansible-galaxy collection install crowdstrike.falcon --upgrade
```

--------------------------------

### Set Additional Configuration Options

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Configures tags, billing mode, and logging settings.

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_tags: 'falcon,example,tags'
      falcon_billing: 'metered'
      falcon_message_log: yes
```

--------------------------------

### Configure with Pre-obtained Maintenance Token

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Directly provides a static maintenance token string to the configuration role.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_maintenance_token: "your-maintenance-token-here"
```

--------------------------------

### Discover Linux Hosts in Reduced Functionality Mode

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Generates a dynamic inventory for all Linux hosts running in reduced functionality mode. Uses the falcon_hosts plugin with specific filters.

```yaml
# sample file: linux_rfm.falcon_hosts.yml
plugin: crowdstrike.falcon.falcon_hosts
filter: "platform_name:'Linux' + reduced_functionality_mode:'yes'"
```

--------------------------------

### Discover Unmanaged Systems Not Seen Recently

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/README.md

Generates a dynamic inventory for unmanaged systems that have not been seen in the last day. Uses the falcon_discover plugin with time-based filtering.

```yaml
# sample file: sketchy_hosts.falcon_discover.yml
plugin: crowdstrike.falcon.falcon_discover
filter: "entity_type:'unmanaged'+first_seen_timestamp:>'now-1d'"
```

--------------------------------

### Configure Falcon Sensor Proxy

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Sets proxy settings for the Falcon sensor communication.

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_apd: no
      falcon_aph: 'example.com'
      falcon_app: 8080
```

--------------------------------

### Basic Falcon Sensor Uninstall

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_uninstall/README.md

Use this playbook to perform a standard uninstallation of the Falcon Sensor from all hosts.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_uninstall

```

--------------------------------

### Perform per-task authentication

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/docs/authentication.md

Authenticate directly within a task using explicit credentials or environment variables.

```yaml
- crowdstrike.falcon.cid_info:
    client_id: "API CLIENT ID"
    client_secret: "API CLIENT SECRET"
    # Optional
    member_cid: "MEMBER CID"
    cloud: "eu-1"
  register: cid_info
```

```yaml
# assumes FALCON_CLIENT_ID and FALCON_CLIENT_SECRET have been set
- crowdstrike.falcon.cid_info:
  register: cid_info
```

--------------------------------

### Define OS-Specific Grouping Tags

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Use inventory group variables to apply different grouping tags based on the target operating system.

```yaml
# group_vars/linux.yml
falcon_tags: "linux-servers,production"

# group_vars/windows.yml
falcon_tags: "windows-servers,production"
```

--------------------------------

### Delete Configuration Options

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Clears specific configuration settings by setting them to empty or disabling the option set.

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_option_set: no
      falcon_cid: ""
      falcon_tags: ""
```

--------------------------------

### Set Falcon Customer ID (CID)

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Configures the CID using known credentials or API authentication.

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_cid: 1234567890ABCDEF1234567890ABCDEF-12
```

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
```

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_cid: 1234567890ABCDEF1234567890ABCDEF-12
      falcon_provisioning_token: 12345678
```

--------------------------------

### Use authentication token in tasks

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/docs/authentication.md

Pass the registered authentication object to subsequent Falcon modules.

```yaml
- name: Individually hide hosts with a list from the Falcon console
  crowdstrike.falcon.host_hide:
    auth: "{{ falcon.auth }}"
    hosts: "{{ item }}"
  loop: "{{ host_ids }}"
```

--------------------------------

### Uninstall Falcon Sensor on Windows with Maintenance Token

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_uninstall/README.md

This playbook uses a maintenance token to uninstall the Falcon Sensor specifically on Windows hosts. The token is passed as a command-line argument.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_uninstall
    vars:
      falcon_windows_uninstall_args: "/norestart MAINTENANCE_TOKEN=<Falcon_Maintenance_Token>"

```

--------------------------------

### crowdstrike.falcon.eventstream

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/docs/crowdstrike.falcon.eventstream.md

Configuration parameters for the Falcon Event Stream event source plugin.

```APIDOC
## crowdstrike.falcon.eventstream

### Description
An ansible-rulebook event source plugin for generating events from the Falcon Event Stream API.

### Parameters
#### Configuration Parameters
- **falcon_client_id** (string) - Required - CrowdStrike OAUTH Client ID
- **falcon_client_secret** (string) - Required - CrowdStrike OAUTH Client Secret
- **falcon_cloud** (string) - Required - CrowdStrike Cloud Region (Choices: us-1, us-2, eu-1, us-gov-1; Default: us-1)
- **stream_name** (string) - Optional - Label that identifies your connection (Max: 32 alphanumeric characters; Default: eda)
- **include_event_types** (list) - Optional - List of event types to include
- **exclude_event_types** (list) - Optional - List of event types to exclude
- **offset** (int) - Optional - Specifies where in the event stream you want to begin processing (Mutually exclusive with latest)
- **latest** (bool) - Optional - Start the stream from the latest event (Mutually exclusive with offset; Default: false)
- **delay** (float) - Optional - Introduce a delay between each event (Default: 0)

### Request Example
```yaml
- name: Simple Falcon Event Stream Usage Example
  hosts: all
  sources:
    - crowdstrike.falcon.eventstream:
        falcon_client_id: "{{ FALCON_CLIENT_ID }}"
        falcon_client_secret: "{{ FALCON_CLIENT_SECRET }}"
        falcon_cloud: "us-2"
        offset: 12345
        stream_name: "eda-example"
        include_event_types:
          - "DetectionSummaryEvent"
```
```

--------------------------------

### Configure Falcon module arguments

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/docs/authentication.md

Pass Falcon API credentials directly as module arguments in an Ansible task.

```yaml
- crowdstrike.falcon.example_module:
    client_id: abcd1234 # required
    client_secret: abcd5678 # required
    cloud: us-gov-1 # optional for us-1, us-2, and eu-1; required for gov clouds
    member_cid: abcd2468 # optional (only for Flight Control users)
```

--------------------------------

### Configure Sensor Cloud Region

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Specifies the sensor cloud region to optimize connectivity and prevent timeout issues.

```yaml
# API-based workflow with explicit sensor cloud region
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_sensor_cloud: us-2  # Explicit sensor cloud region
      # falcon_cloud can autodiscover any region for API operations

# Non-API workflow with sensor cloud region
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_cid: 1234567890ABCDEF1234567890ABCDEF-12
      falcon_sensor_cloud: us-2  # No dependency on API configuration
```

--------------------------------

### Generate Falcon authentication token

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/docs/authentication.md

Use the auth module to retrieve a temporary token for subsequent API interactions.

```yaml
- name: Generate Authentication Object
  crowdstrike.falcon.auth:
    # If not using ENV variables, use module args here
  register: falcon
```

--------------------------------

### Configure Maintenance Token via API Lookup

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_install/README.md

Uses the CrowdStrike lookup plugin to dynamically retrieve a bulk maintenance token for sensor operations.

```yaml
---
- hosts: all
  vars:
    falcon_client_id: <FALCON_CLIENT_ID>
    falcon_client_secret: <FALCON_CLIENT_SECRET>
  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_maintenance_token: "{{ lookup('crowdstrike.falcon.maintenance_token',
                                          bulk=true,
                                          client_id=falcon_client_id,
                                          client_secret=falcon_client_secret) }}"
```

--------------------------------

### Uninstall Falcon Sensor and Remove Host

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_uninstall/README.md

This playbook uninstalls the Falcon Sensor and also removes the host from the CrowdStrike console. Ensure you have your Falcon API credentials configured.

```yaml
---
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_uninstall
    vars:
      falcon_client_id: <FALCON_CLIENT_ID>
      falcon_client_secret: <FALCON_CLIENT_SECRET>
      falcon_cloud: us-2
      falcon_remove_host: true

```

--------------------------------

### Retrieve Maintenance Token via API

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Uses the lookup plugin to fetch a bulk maintenance token from the CrowdStrike API.

```yaml
---
- hosts: all
  vars:
    falcon_client_id: <FALCON_CLIENT_ID>
    falcon_client_secret: <FALCON_CLIENT_SECRET>
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_maintenance_token: "{{ lookup('crowdstrike.falcon.maintenance_token',
                                          bulk=true,
                                          client_id=falcon_client_id,
                                          client_secret=falcon_client_secret) }}"
```

--------------------------------

### Uninstall Falcon Sensor with Bulk Maintenance Token

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_uninstall/README.md

This playbook utilizes a bulk maintenance token for uninstalling the Falcon Sensor across all hosts. Ensure bulk tokens are enabled in your policy and provide your API credentials.

```yaml
---
- hosts: all
  vars:
    falcon_client_id: <FALCON_CLIENT_ID>
    falcon_client_secret: <FALCON_CLIENT_SECRET>
  roles:
  - role: crowdstrike.falcon.falcon_uninstall
    vars:
      falcon_maintenance_token: "{{ lookup('crowdstrike.falcon.maintenance_token',
                                  bulk=true,
                                  client_id=falcon_client_id,
                                  client_secret=falcon_client_secret) }}"

```

--------------------------------

### Apply Conditional Grouping Tags in Playbooks

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Use Jinja2 conditionals within a playbook to dynamically assign tags based on the ansible_os_family fact.

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_tags: "{{ 'windows-tag' if ansible_os_family == 'Windows' else 'linux-tag' }}"
```

--------------------------------

### Uninstall Falcon Sensor with Maintenance Token Lookup

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_uninstall/README.md

Use this snippet to uninstall the Falcon Sensor when protection is armed and API credentials are available. It retrieves a bulk maintenance token using the lookup plugin.

```yaml
---
- hosts: all
  vars:
    falcon_client_id: <FALCON_CLIENT_ID>
    falcon_client_secret: <FALCON_CLIENT_SECRET>
  roles:
  - role: crowdstrike.falcon.falcon_uninstall
    vars:
      falcon_remove_host: true
      falcon_maintenance_token: "{{ lookup('crowdstrike.falcon.maintenance_token',
                                  bulk=true,
                                  client_id=falcon_client_id,
                                  client_secret=falcon_client_secret) }}"

```

--------------------------------

### Manage Agent ID (AID) Removal

Source: https://github.com/crowdstrike/ansible_collection_falcon/blob/main/roles/falcon_configure/README.md

Removes the Agent ID for image preparation or as a standalone maintenance task.

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_option_set: yes
      falcon_cid: 1234567890ABCDEF1234567890ABCDEF-12
      falcon_remove_aid: yes
```

```yaml
- hosts: all
  roles:
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_remove_aid: yes
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.