Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] New-FalconIoaRule generates 400 error when following wiki example #399

Open
bk-cs opened this issue Apr 19, 2024 · 1 comment
Open
Assignees
Labels
bug Something isn't working fix available Self-applied fix available in issue

Comments

@bk-cs
Copy link
Collaborator

bk-cs commented Apr 19, 2024

Describe the bug
Unable to create a custom IOA rule inside of of an IOA group following the New-FalconIoaRule wiki example.

New-FalconIoaRule is failing to pass field_values as an array when submitting the rule creation request, causing a 400 response.

Environment (please complete the following information):

  • OS: Windows 11
  • PowerShell: 5.1
  • PSFalcon: 2.2.6
@bk-cs bk-cs added the bug Something isn't working label Apr 19, 2024
@bk-cs bk-cs self-assigned this Apr 19, 2024
bk-cs added a commit that referenced this issue Apr 19, 2024
Updated how `field_values` properties are selected to ensure that they're correctly passed as an array
@bk-cs
Copy link
Collaborator Author

bk-cs commented Apr 19, 2024

This bug has been fixed for the next release. If you'd like to resolve it for your local module before release, you can replace public\ioarules.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/9f90b0a63a2d6196a8a380a713ca92ac26f0562d/public/ioarules.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) ioarules.ps1)

@bk-cs bk-cs added the fix available Self-applied fix available in issue label Apr 19, 2024
@bk-cs bk-cs changed the title [ BUG ] Unable to create custom IOA rule inside IOA group [ BUG ] New-FalconIoaRule generates 400 error when following wiki example Apr 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working fix available Self-applied fix available in issue
Projects
None yet
Development

No branches or pull requests

1 participant