{"id":20666190,"url":"https://github.com/hazcod/cscleanup","last_synced_at":"2025-09-27T00:32:11.152Z","repository":{"id":206149207,"uuid":"715966220","full_name":"hazcod/cscleanup","owner":"hazcod","description":"CrowdStrike host cleanup script to keep your estate tidy.","archived":false,"fork":false,"pushed_at":"2025-01-13T07:30:54.000Z","size":89,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-13T08:30:35.695Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hazcod.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-08T07:41:58.000Z","updated_at":"2025-01-13T07:30:22.000Z","dependencies_parsed_at":"2023-11-21T07:56:13.246Z","dependency_job_id":"1ad743b4-6ee0-4ffd-831b-6fb55737f3dc","html_url":"https://github.com/hazcod/cscleanup","commit_stats":null,"previous_names":["hazcod/cscleanup"],"tags_count":18,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazcod%2Fcscleanup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazcod%2Fcscleanup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazcod%2Fcscleanup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hazcod%2Fcscleanup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hazcod","download_url":"https://codeload.github.com/hazcod/cscleanup/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234364888,"owners_count":18820561,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-16T19:35:47.287Z","updated_at":"2025-09-27T00:32:05.808Z","avatar_url":"https://github.com/hazcod.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cscleanup\n\nA Go program that cleans up your estate of CrowdStrike cloud and endpoint sensors.\n\n## How does it work?\n\nThe program follows following logic for determining if a sensor is faulty and shrouds your dashboard:\n\n1. Any CrowdStrike sensor that was only momentarily online (max. 5 minutes), did not have the chance to donwload any policies and did not report a Hostname.\n2. Any CrowdStrike endpoint sensor that does not have an `email/` tag. (e.g. to use with [security-slacker](https://github.com/hazcod/security-slacker/))\n3. Any CrowdStrike sensor that is in RFM mode and was last seen over 24 hours ago.\n4. Any CrowdStrike cloud sensor that has not been seen for 24 hours. (VMs were most likely destroyed)\n5. Any hidden CrowdStrike sensor that was still recently seen, e.g. was most likely hidden by accident.\n\n## Running\n\nFirst, ensure you get CrowdStrike API credentials that can do `Hosts:read` and `Hosts:write`.\nThen create the following YAML configuration file:\n\n```yaml\nlog:\n  level: INFO\n\nslack:\n  webhook: \"https://hooks.slack.com/services/XXX\"\n\ncrowdstrike:\n  region: eu-1\n  client_id: \"XXXX\"\n  client_secret: \"XXXX\"\n\n```\n\nYou can use following arguments:\n\n```shell\n./cscleanup -config=config.yml\n```\n\nAnd if you don't want to hide any sensor nor send to Slack:\n\n```shell\n./cscleanup -config=config.yml -preview\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhazcod%2Fcscleanup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhazcod%2Fcscleanup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhazcod%2Fcscleanup/lists"}