PS script for a file removal on multiple hosts with RTR

[henryd0]

Hello,

How to remove a file from multiple assets with crowdstrike falcon real-time response API integration using a Powershell script?

[bk-cs]

If it's a static file, you can do something like this using Invoke-FalconRtr:

Invoke-FalconRtr -Command rm -Argument "'C:\path of\my_file.exe'" -HostId <id>,<id>

If it's a dynamic file, create a script that will find and delete it, then run it with the same command.

[henryd0]

Thanks for your response, however I'm not quite sure if I understood correctly. Can you clarify more? Do you require Aid or host names? If hostnames(asset tags) in an excel file, does it still work or do you need to import AIDs?