239 lines
16 KiB
Markdown
239 lines
16 KiB
Markdown
# 2026-07-02 — CrowdStrike (spec+rollout), VWP OneDrive, 365 app-suite docs + consent-audit
|
|
|
|
## User
|
|
- **User:** Mike Swanson (mike)
|
|
- **Machine:** GURU-5070
|
|
- **Role:** admin
|
|
|
|
## Session Summary
|
|
|
|
Large multi-thread session. (1) Built the CrowdStrike Falcon RMM-integration spec via
|
|
/shape-spec and implemented the entire server side (Tasks 1-5) as a vendor-agnostic
|
|
integrations plugin framework in guru-rmm, each task pipeline-verified green. (2) Detoured
|
|
to actually DEPLOY the Falcon sensor to 5 ACG machines with the test CID. (3) Granted Shelly
|
|
Dooley access to Teresa Carpio's OneDrive at VWP (offboarding follow-up), which exposed that
|
|
the 365 app suite lacked SharePoint consent on VWP. (4) Properly DOCUMENTED the 365 app suite
|
|
and built a `consent-audit` command to detect per-tenant consent drift. (5) Billed the VWP
|
|
OneDrive work as a new linked Syncro ticket.
|
|
|
|
CrowdStrike RMM feature (guru-rmm submodule, all pipeline-green via ci-version-bump marker):
|
|
Task 1 migration 065 (5 vendor-agnostic tables: integrations, integration_credentials
|
|
[reuses the credentials TEXT/base64 encryptor], integration_client_mappings,
|
|
integration_sync_state, integration_agent_links). Task 2 IntegrationPlugin trait
|
|
(axum::async_trait) + PluginRegistry + credential encrypt/decrypt chokepoint + runtime-sqlx
|
|
DB layer (codebase uses runtime queries, NOT query! macros -> no .sqlx regen). Task 3 generic
|
|
/api/integrations REST (list/upsert/delete/credentials/test/mappings/sync-state; added
|
|
registry to AppState). Task 4 FalconClient (OAuth2 client-creds, region base-URL map, host
|
|
query+details) + CrowdStrikePlugin (test_connection, sync host.cid->mapped client->agent by
|
|
hostname); registered in PluginRegistry::build(). Task 5 periodic sync worker (60s tick, per-
|
|
integration due-check, parks bad-cred integrations). Server side COMPLETE + running; remaining
|
|
Tasks 6-9 (deploy job, agent installer, dashboard, e2e).
|
|
|
|
Falcon deployment (5/5 operational): installers staged on the RMM downloads server
|
|
(/var/www/gururmm/downloads/crowdstrike/, HTTP-served). Beast/Neptune/DC16 (Windows) via RMM
|
|
PowerShell (FalconSensor_Windows.exe /install /quiet /norestart CID=...); IX (CloudLinux 9)
|
|
via SSH + el9 rpm + falconctl -s --cid (rfm-state=false); Mac (macOS 26) via RMM pkg install +
|
|
falconctl license, then Mike approved the system extension + rebooted -> Sensor operational.
|
|
CID BB56861AF0944B82ACE88C9F68362C23-52 vaulted at infrastructure/crowdstrike-falcon.
|
|
|
|
VWP OneDrive + 365 docs: granted shelly@ site-collection admin on teresa@'s OneDrive
|
|
(~19.8GB) via SPO CSOM SetSiteAdmin. This required fixing VWP's partial consent (had the
|
|
Tenant Admin app but NO SharePoint app-only role) — granted it directly via appRoleAssignment
|
|
(tenant-admin holds AppRoleAssignment.ReadWrite.All). Mike (rightly) flagged the 365 suite as
|
|
under-documented; wrote references/app-suite.md (authoritative live-verified map + the
|
|
consent-drift problem + both fix methods) and built consent-audit.sh (audits a tenant/--all vs
|
|
baseline, grades GREEN/AMBER/RED, prints exact fixes). Verified: BirthBio GREEN, VWP/Cascades
|
|
AMBER (real drift caught). Billed the OneDrive work as new Syncro ticket #32499 linked to
|
|
#32487, 0.5h remote applied to VWP's prepaid block (10.0->9.5, $0 invoice).
|
|
|
|
## Key Decisions
|
|
|
|
- CrowdStrike = plugin #1 on a VENDOR-AGNOSTIC framework (5 generic tables + trait + registry),
|
|
not a one-off — matches Mike's "modular, each partner enables their own creds". MSSP-correct
|
|
via per-host cid -> mapped client (single-CID and Flight-Control both work).
|
|
- Pipeline build is the compile gate (local cargo check blocked: no MSVC linker on GURU-5070).
|
|
Each task pushed by explicit SHA, rebased over concurrent CI version-bumps, verified via the
|
|
ci-version-bump marker.
|
|
- Falcon staging: authorized GURU-5070's SSH key on the RMM server via its OWN root RMM agent
|
|
(.30 refuses password SSH) -> scp installers to the HTTP downloads dir. DF-site machines
|
|
(Neptune/DC16/IX) can't reach office-internal 172.16.3.30 -> use public rmm.azcomputerguru.com.
|
|
- Architecture answer to Mike: do NOT split the 365 apps (tier-by-privilege split is correct;
|
|
more apps = more consent drift). The gap was INSTRUMENTATION, not decomposition — extend the
|
|
proven assign-exchange-role --verify pattern to all permissions = consent-audit.sh.
|
|
- Fixed VWP SharePoint gap via direct appRoleAssignment (Method B), not just re-consent — the
|
|
adminconsent flow grants Graph but often skips the SharePoint app-only role.
|
|
- VWP billing: new ticket #32499 (since #32487 already Invoiced), 0.5h remote applied to the
|
|
prepaid block; referenced #32487 in subject/desc (no Syncro API for formal ticket link).
|
|
|
|
## Problems Encountered
|
|
|
|
- ps-encoded.sh (shell->cmd->powershell -EncodedCommand) returns "Access is denied" on Windows
|
|
Server 2016 (DC16); direct command_type=powershell works. Logged as friction.
|
|
- Long Falcon download+install exceeds the RMM command timeout on slow-egress boxes (DC16/Mac)
|
|
-> command reports failed/"Command timeout" but the install COMPLETES in background; verify
|
|
service/state after. Logged.
|
|
- macOS 26 EDR system extension stuck [activated waiting for user] even after FDA enabled —
|
|
extension Allow is a separate toggle (Login Items & Extensions on macOS 26); a REBOOT
|
|
reconciled it to [activated enabled] + Sensor operational.
|
|
- IX first attempt: el8 rpm vs CloudLinux 9 (el9) mismatch — waited for Mike to drop the el9
|
|
rpm; installed clean, rfm-state=false.
|
|
- consent-audit.sh v1 bug: jwt_roles read the token from stdin while the heredoc also claimed
|
|
stdin -> every role decoded empty (false-flagged BirthBio). Fixed to pass the token as argv.
|
|
- My own new block-tmp-path hook correctly blocked a `curl -o /tmp/..` mid-session (dogfood).
|
|
- Two rebase conflicts (errorlog.md + MEMORY.md) from concurrent auto-sync; resolved by union
|
|
(errorlog) and take-origin-then-re-add-line (MEMORY).
|
|
|
|
## Configuration Changes
|
|
|
|
guru-rmm submodule (main, pipeline-green):
|
|
- specs/crowdstrike-falcon/{plan,shape,references,standards}.md
|
|
- server/migrations/065_integrations_framework.sql
|
|
- server/src/db/integrations.rs, server/src/db/mod.rs
|
|
- server/src/integrations/{mod.rs, worker.rs, crowdstrike/mod.rs, crowdstrike/client.rs}
|
|
- server/src/api/integrations.rs, server/src/api/mod.rs
|
|
- server/src/main.rs (AppState.registry + integrations sync worker spawn)
|
|
|
|
claudetools (main):
|
|
- .claude/skills/remediation-tool/scripts/consent-audit.sh (new)
|
|
- .claude/skills/remediation-tool/references/app-suite.md (new)
|
|
- .claude/skills/remediation-tool/scripts/get-token.sh (exchange-op-graph tier, from prior)
|
|
- .claude/skills/remediation-tool/SKILL.md (consent-audit pointer; repo + global)
|
|
- .claude/memory/reference_365_app_suite.md + MEMORY.md index
|
|
- errorlog.md (ps-encoded/server2016, long-install-reaper, consent-drift correction, +others)
|
|
|
|
vault: infrastructure/crowdstrike-falcon.sops.yaml (CID install key) — committed.
|
|
|
|
RMM server .30: appended GURU-5070 ed25519 pubkey to /home/guru/.ssh/authorized_keys (via
|
|
root RMM agent); staged crowdstrike installers under /var/www/gururmm/downloads/crowdstrike/.
|
|
|
|
## Credentials & Secrets
|
|
|
|
- CrowdStrike Falcon CID / install key: `BB56861AF0944B82ACE88C9F68362C23-52` — vaulted at
|
|
`infrastructure/crowdstrike-falcon` field `credentials.cid`. Enrollment key (not an API cred).
|
|
- No other new secrets. VWP SharePoint access granted to the ComputerGuru Tenant Admin app
|
|
(709e6eed) via appRoleAssignment on tenant 5c53ae9f (Mike consented).
|
|
|
|
## Infrastructure & Servers
|
|
|
|
- Falcon targets: Beast GURU-BEAST-ROG (5233d75b, Win11), Neptune NEPTUNE (b3a9b454, WinSvr),
|
|
DC16 ACG-DC16 (77ddf8a1, Server 2016 DC), IX ix.azcomputerguru.com (4ad2e426 / 172.16.3.10,
|
|
CloudLinux 9.8), Mac Mikes-MacBook-Air (0cb6148e, macOS 26.5.2). All enrolled to the CID.
|
|
- RMM server: 172.16.3.30 (Ubuntu 22.04, SSH guru, publickey-only), own root RMM agent
|
|
9b92b187 (hostname gururmm). Downloads dir served at http://172.16.3.30/downloads/ (LAN) +
|
|
https://rmm.azcomputerguru.com/downloads/ (public, Cloudflare).
|
|
- VWP tenant 5c53ae9f-7071-4248-b834-8685b646450f (valleywideplastering.com; onmicrosoft
|
|
prefix valleywideplastering; SPO admin valleywideplastering-admin.sharepoint.com). Users:
|
|
Shelly Dooley da8f7037 (enabled), Teresa Carpio 615d8ef9 (disabled). Tenant Admin SP in VWP:
|
|
fccda86c-77ca-4248-b876-b0cdba8605d4. BirthBio tenant 19a568e8 = fully-consented reference.
|
|
- 365 app suite (App IDs): investigator bfbc12a4, exchange-op b43e7342, user-manager 64fac46b,
|
|
tenant-admin 709e6eed, defender dbf8ad1a, intune 46986910, mailbox 1873b1b0 (ACG-internal).
|
|
SharePoint resource 00000003-0000-0ff1-ce00-000000000000, Sites.FullControl.All role id
|
|
678536fe-1083-478a-9c59-b99265e6b0d3.
|
|
|
|
## Commands & Outputs
|
|
|
|
- consent-audit: `bash .claude/skills/remediation-tool/scripts/consent-audit.sh <domain|guid|--all>`
|
|
- Falcon deploy scripts in scratchpad (cs_install_win.ps1 / cs_install_win_public.ps1 /
|
|
cs_install_mac.sh). Windows install: `FalconSensor_Windows.exe /install /quiet /norestart
|
|
CID=<cid>`; Linux: `dnf install el9.rpm; /opt/CrowdStrike/falconctl -s --cid=<cid>;
|
|
systemctl enable --now falcon-sensor`; mac: `installer -pkg ...; falconctl license <cid>`.
|
|
- Fix partial 365 consent (Method B): POST /servicePrincipals/{recipientSP}/appRoleAssignments
|
|
{principalId, resourceId=SharePoint SP, appRoleId=Sites.FullControl.All} with a tenant-admin token.
|
|
- SPO SetSiteAdmin: POST <admin>/_vti_bin/client.svc/ProcessQuery (CSOM XML) with sharepoint-admin
|
|
cert token.
|
|
|
|
## Pending / Incomplete Tasks
|
|
|
|
- CrowdStrike RMM feature: Tasks 6 (deploy job + migration 066), 7 (agent installer, Win first),
|
|
8 (dashboard Integrations page + Falcon panels), 9 (e2e verification). Spec plan.md is the
|
|
source of truth (Tasks 1-5 marked DONE).
|
|
- VWP is AMBER on consent-audit: investigator (missing User.Read.All, Sites.Read.All),
|
|
exchange-op-graph (Mail.ReadWrite, MailboxSettings.ReadWrite), user-manager
|
|
(Directory.ReadWrite.All) still on old partial grants -> full re-consent sweep recommended.
|
|
- Cascades AMBER: missing SharePoint app-only role (same class as VWP) -> Method B or re-consent.
|
|
- Optional follow-up (Mike's call, not built): consent-audit --all to regenerate tenants.md as
|
|
a live matrix; schedule a fleet audit via coord todo.
|
|
- guru-rmm parent gitlink lags; advance on a later /sync if desired.
|
|
|
|
## Reference Information
|
|
|
|
- guru-rmm commits: spec dd646f6; T1 8b75274; T2 cac7e1d; T3 6c83a03; T4 847cff6; T5 5f38ef3.
|
|
- claudetools consent-audit commit 8152476e.
|
|
- Syncro: VWP customer 31694734; new ticket #32499 (id 113383258) invoice 1650932291 ($0,
|
|
applied 0.5 prepay, block 10.0->9.5); linked-ref offboarding ticket #32487 (id 113195707,
|
|
Invoiced). Remote labor product 1190473 @ $150 (category Labor).
|
|
- Docs: .claude/skills/remediation-tool/references/app-suite.md (authoritative 365 map).
|
|
|
|
---
|
|
|
|
## Update: 17:29 PT — PST "Mara audit log" relocation + fast wiki-compile update mode
|
|
|
|
### Summary
|
|
Two follow-on threads after the earlier save. (1) **Peaceful Spirit — "the Mara audit log":**
|
|
Mike asked to change its location to `G:\Shares\Private\Partner Review\Legal Documents - DO NOT
|
|
DELETE\_Deletion Reports`. No such mechanism was in our notes/wiki/coord — located it live via
|
|
GuruRMM (site SSH was down, no L2TP VPN). It is a scheduled task **`PST Deletion Report (Daily)`**
|
|
on PST-SERVER running `C:\PST-Tools\PST-DeletionReport.ps1` (SYSTEM, 06:30), harvesting Security
|
|
events 4660/4663 (SACL on `G:\Shares\Scanned`) into a per-day HTML deletion report — the standing
|
|
record Mara reviews after the mass-deletion incident. Repointed only `$OutDir` to the legal folder
|
|
(left `$Root = G:\Shares\Scanned` — the monitored scope — unchanged), backed up the script, and
|
|
validated by a test run (report written, 6 items) + confirmed the daily task unchanged.
|
|
(2) **wiki-compile speed:** Mike flagged the wiki rebuild as terribly slow and wanted update-vs-
|
|
rebuild. Root cause: the no-flag "refresh" only touched Syncro fields (useless for knowledge), so
|
|
capturing real work forced `--full` (reads ALL logs + Sonnet full-article regen). Added a real
|
|
**update mode** (new default) and did the PST wiki edit surgically as the exemplar.
|
|
|
|
### Key Decisions
|
|
- Located the audit mechanism via GuruRMM read-only discovery rather than guessing or asking —
|
|
SSH to the CC site needs the L2TP VPN (down); PST-SERVER is a GuruRMM agent (87293069), reachable.
|
|
- Changed ONLY `$OutDir`; `$Root` (audited folder) stays `G:\Shares\Scanned`. Backup kept
|
|
(`PST-DeletionReport.ps1.bak-20260702`) — reversible one-line change on a HIPAA DC.
|
|
- wiki-compile: made **update** the no-flag default = Syncro refresh + incremental merge of ONLY
|
|
logs newer than `last_compiled`, via targeted section edits (main agent/Haiku, no Sonnet, no full
|
|
regen). `--full` = explicit Rebuild; `--syncro` = instant Syncro-only. Folded old "refresh" into
|
|
update. Speedup = small input (new logs only) + small output (surgical edits) + no Sonnet pass.
|
|
- Applied the PST wiki edit directly (not via the staged/locked Phase 5 flow) — single known change,
|
|
faster; next `--full` reconciles.
|
|
|
|
### Problems Encountered
|
|
- Wrong RMM status endpoint first (`/api/agents/commands/{id}` returned empty) → correct is
|
|
`GET /api/commands/{id}` (from the /rmm command doc). Self-corrected.
|
|
- Flagged (not fixed): the target legal folder `...\Legal Documents - DO NOT DELETE\` contains
|
|
client-stored credentials in the clear (`passwords`, `Employee password list 2019-01-15.docx`) —
|
|
surfaced to Mike for a separate cleanup decision.
|
|
|
|
### Configuration Changes
|
|
- PST-SERVER (via GuruRMM, agent 87293069): edited `C:\PST-Tools\PST-DeletionReport.ps1`
|
|
(`$OutDir` -> legal folder); backup `C:\PST-Tools\PST-DeletionReport.ps1.bak-20260702`.
|
|
Scheduled task `PST Deletion Report (Daily)` unchanged.
|
|
- claudetools (main, commit 59b5f1f5): `wiki/clients/peaceful-spirit.md` (Deletion Investigation
|
|
paragraph + 2026-07-02 History row + frontmatter date), `wiki/index.md` (PST date bump),
|
|
`.claude/commands/wiki-compile.md` (+ global copy) — new update/rebuild/syncro modes.
|
|
|
|
### Infrastructure & Servers
|
|
- PST-SERVER (Peaceful Spirit CC): LAN 192.168.0.2, Server 2016 Essentials DC/file server,
|
|
GuruRMM agent `87293069-33b6-45e8-a68f-6811216cdb96` (online). G: is a local drive; SYSTEM has
|
|
full access. Site SSH (`sysadmin@192.168.0.2`) requires L2TP VPN to CC (was down this session).
|
|
- Audit basis: object-access auditing (File System) = Success+Failure; SACL Everyone/Delete+DC/
|
|
Success on `G:\Shares\Scanned`. Report retention 90 days, generated ~06:30 daily.
|
|
|
|
### Commands & Outputs
|
|
- Find PST-SERVER agent: `bash .claude/scripts/rmm-search.sh -c "peaceful spirit"`.
|
|
- RMM dispatch: `POST $RMM/api/agents/$AGENT/command` {command_type:"powershell", command, timeout_seconds};
|
|
poll `GET $RMM/api/commands/$CID` (.status/.stdout). Server 2016 -> use plain `powershell`
|
|
command_type (not ps-encoded EncodedCommand).
|
|
- Validation output: `Report written: G:\Shares\Private\Partner Review\Legal Documents - DO NOT
|
|
DELETE\_Deletion Reports\Deletion-Report-2026-07-02.html (6 items)`; task LastResult=0, NextRun 07/03 06:30.
|
|
|
|
### Pending / Incomplete Tasks
|
|
- (unchanged CrowdStrike Tasks 6-9, VWP/Cascades consent AMBERs from earlier.)
|
|
- Peaceful Spirit: client credentials stored in the clear in the Legal Documents share — Mike to
|
|
decide on cleanup/vaulting separately.
|
|
- Optional: run `/wiki-compile client:peaceful-spirit` (now fast update mode) to confirm the new
|
|
path end-to-end on the real article next time.
|
|
|
|
### Reference Information
|
|
- Commit 59b5f1f5 (wiki + wiki-compile update mode). PST-SERVER GuruRMM agent 87293069.
|
|
- Script: `C:\PST-Tools\PST-DeletionReport.ps1` (task "PST Deletion Report (Daily)").
|
|
- New report path: `G:\Shares\Private\Partner Review\Legal Documents - DO NOT DELETE\_Deletion Reports`.
|