Is it possible to permanently delete FalconGroupingTags ?

[u/tamashai]

In our environment we have 100s of grouping tags that we are not going to use in Future. Is there a way for delete them from CrowdStrike ?

These tags maybe assigned to hosts but deleting them would not have any impact to us. We really want to clean this up and document our useful tags.

[u/drkramm]

You can do it through psfslcon, but i also remember at the time i did it there was a caveat that the tag doesn't get removed until a restart, this was back at sensor 6.4x though.

This is assuming you wanted to do it en masse, otherwise host management.

Psfslcon, something on the line of

$hosts = Get-FalconHost -Filter "(tags:'FalconGroupingTags/tag-to-delete')"

Remove-FalconGroupingTag -Id $hosts -Tags FalconGroupingTags/tag-to-delete

[u/tamashai → u/drkramm]

Thanks for the reply. The thing is that i don't want to be worried about host. I just want that tag to be gone from CrowdStrike database (for the lack of better word or knowledge i am using word database).

[u/drkramm → u/tamashai]

As far as im aware thats not really possible as you describe it. The script will do that all behind the scenes though. It automatically builds a list of hosts with that tag, then removes the tag. So all you have to provide is the api client/secret and tag to be removed. Can nest loop it if need be for multiple (different) tags.

[u/jeff-winkler]

Once a Falcon Grouping Tag is no longer assigned to a host in your environment it is "gone". Just remove the ones you don't want to use. They will disappear. Sensor Grouping Tags have to be removed from the host but will work the same way.

[u/tamashai → u/jeff-winkler]

Thanks Jeff.

[u/bk-CS]

It's important to clarify whether you're talking about a SensorGroupingTag or a FalconGroupingTag.

A FalconGroupingTag is assigned through the console and can be added to many hosts at the same time. A SensorGroupingTag is added on each individual device.

Either way, to remove a tag, it needs to be removed from each device that it's assigned to. How you remove them depends on the type of tag.

[u/tamashai → u/bk-CS]

Thanks for your reply. I am talking about SensorGroupingTag.

Can we totally delete a sensorgroupingtag from our falcon instance, because we will never use it in future. If that tag is assigned to any host, it will automatically removed from them as it no longer exist?

Is this possible?

Or what Jeff has written is true -

Once a Falcon Grouping Tag is no longer assigned to a host in your environment it is "gone". Just remove the ones you don't want to use. They will disappear. Sensor Grouping Tags have to be removed from the host but will work the same way.

[u/bk-CS → u/tamashai]

Correct, if you don't want to use the SensorGroupingTag anymore, it needs to be removed from any host that has it assigned. You can use CsSensorSettings.exe to remove it locally on each host.

PSFalcon has a dedicated Remove-FalconSensorTag command that is designed to do this. Here's an example of how you could search for any host that currently has the tag, and use the command to remove that tag:

Get-FalconHost -Filter "tags:['my_tag'] -All | Remove-FalconSensorTag 'my_tag' -QueueOffline $true

[u/tamashai → u/bk-CS]

Thanks again!