how modify script "add-a-list-of-combined_id" for removing USB exceptions

[NatchanonBR]

Script
https://github.com/CrowdStrike/psfalcon/blob/master/samples/policies/add-a-list-of-combined_id-exceptions-to-a-device-control-policy.ps1

I want to remove about 100 - 200 USB exceptions.
I don't know much about programming, so I don't know how to modify the code to remove USB exceptions.

Can you provide an example of usage?
thank you.

[bk-cs]

@NatchanonBR Is your goal to remove all exceptions in the policy, or only a subset?

[bk-cs]

There's an example of how to remove exceptions here: https://github.com/crowdstrike/psfalcon/wiki/Edit-FalconDeviceControlPolicy#remove-exceptions-from-a-policy

[NatchanonBR]

@bk-cs
I have Device ID like this "3034_297_20100201396000000", about 100 - 200 devices that are broken or have some problem.
I want to remove some, but not all from USB device policies

I saw an example But I can't figure out how to write the code to delete the Device ID in USB device policies .
https://github.com/crowdstrike/psfalcon/wiki/Edit-FalconDeviceControlPolicy#remove-exceptions-from-a-policy

[bk-cs]

@bk-cs I have Device ID like this "3034_297_20100201396000000", about 100 - 200 devices that are broken or have some problem. I want to remove some, but not all from USB device policies

Do you have a way to determine which ones should be deleted? You can use PSFalcon and PowerShell to filter to the IDs you need. Here's how you can see a list in PowerShell (assuming you're looking for MASS_STORAGE exceptions):

$Policy = Get-FalconDeviceControlPolicy -Filter "name:'my policy'" -Detailed
$Policy.settings.classes.Where({ $_.id -eq 'MASS_STORAGE' }).exceptions

This will output a list of all exceptions. If there's a common criteria between them, you can do something like this to get the required id values:

$Policy.settings.classes.Where({ $_.id -eq 'MASS_STORAGE' }).exceptions.Where({ $_.vendor_name -eq 'my vendor' }).id

Useful properties for filtering might be vendor_name, product_name, or serial_number.

Once you have your entire list of IDs, save them to an array:

$IdList = $Policy.settings.classes.Where({ $_.id -eq 'MASS_STORAGE' }).exceptions.Where({ $_.vendor_name -eq 'my vendor' }).id

Then make a request to modify your policy and remove those IDs:

$Setting = @{ delete_exceptions = $IdList }
Edit-FalconDeviceControlPolicy -Id $Policy.id -Setting $Setting