[ BUG ] Get-FalconHorizonIom and Get-FalconHorizonIoa - Cannot convert JSON because of duplicated keys

[guy-user]

Describe the bug
When I run Get-FalconHorizonIom -All -Detailed, the following error is produced. The same behavior occurs when using Get-FalconHorizonIoa, but the affected fields may be different.

Invoke-Falcon : Cannot convert the JSON string because a dictionary that was converted from the string contains the duplicated keys 'Name' and 'name'.
At C:\Users\XXX\Documents\WindowsPowerShell\Modules\psfalcon\2.2.5\public\detects.ps1:301 char:9
+         Invoke-Falcon @Param -Inputs $PSBoundParameters
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Invoke-Falcon], InvalidOperationException
    + FullyQualifiedErrorId : DuplicateKeysInJsonString,Invoke-Falcon

Environment (please complete the following information):
OS Name: Microsoft Windows Server 2016 Standard
OS Version: 10.0.14393 N/A Build 14393

PowerShell: 5.1.14393.5582
PSFalcon: 2.2.5
PowerShell_transcript.YYY.aVhUzt8n.20230510224339.txt

[bk-cs]

Thanks for the report, and I'm sorry for the trouble this has caused. This error is caused by the results returned from the APIs below, and it's not strictly a PSFalcon problem.

GET /detects/entities/iom/v2
GET /detects/entities/ioa/v1

Some of the individual results are returning with varying case, which causes an error when PowerShell attempts to convert the result from JSON to an object. The API shouldn't be doing this, so I'm going to investigate this within CrowdStrike. Additionally, I'll investigate whether there's a way to correct the problem using PSFalcon.

[guy-user]

Thank you – my CISO wants to present the data to the business so I need to be able to get access to the data asap 👍 I have also raised a support case (01055899 ) if you want to also reference that. Thought a support case from a customer might help get resource time assigned to the issue. Much apprecited

[bk-cs]

Thanks for your patience as I worked with internal teams to resolve this issue. We believe this is fixed and you should have been asked to re-test. Please let me know if this is still a problem.

[guy-user]

Unfortunately I am still seeing the same errors originally reported for both IOA and IOM:

IOA: Cannot convert the JSON string because a dictionary that was converted from the string contains the duplicated keys 'Tagging' and 'tagging'.

IOM: Cannot convert the JSON string because a dictionary that was converted from the string contains the duplicated keys 'Name' and 'name'.

[bk-cs]

After doing some investigating with CrowdStrike support and the development team, the core issue seems to be that the data we're receiving with varying case is coming directly from the cloud provider (AWS in this case). CrowdStrike isn't in control of the case provided in the results, because it's passing the data through.

PowerShell Core includes the ability to -ConvertAsHashtable when using ConvertFrom-Json which supposedly would resolve this, but PSFalcon also supports PowerShell Desktop--meaning that fix can't be used. I'll either need to redesign how PSFalcon converts Json results using some other method, or do some sort of string search to find and replace these results when they occur.

[guy-user]

Let me know if you have a beta version I can try out 👍

[guy-user]

Hi there - do you have any sort of indication on how long a fix might take? Just want to have a feel how much longer we may be impacted on this one so I can report to mgmt.

I realise anything you can indicate here is not a commitment or guarantee of any sort.

[bk-cs]

Unfortunately, no. PSFalcon uses ConvertTo-Json which is unable to deal with this varying case. There's only one other way that I've seen that will convert from Json, and I tried using it early in PSFalcon development but found it unreliable.

Between regular PSFalcon updates/fixes and my preparation for Fal.Con in September, I'm not sure when this will be complete.

[bk-cs]

I still have this on my to-do list if I can figure out a way to solve it...