CrowdStrike / falcon-scripts

Scripts to streamline the deployment and use of the CrowdStrike Falcon sensor
The Unlicense
146 stars 85 forks source link

Credentials working with bash script but failing for powershell script #56

Closed rameshDG105 closed 2 years ago

rameshDG105 commented 2 years ago

I tried passing the falconclient id and falcon secret and the falcon cid to the bash script and it was able to install the latest falcon sensor, it was able to create the required bearer token and working perfectly but when I try passing the same client id and secret and the membercid (cid) to the powershell script as parameters it's throwing the error

E58BFA2-C8"
Invoke-WebRequest : {
 "meta": {
  "query_time": 0.004716112,
  "powered_by": "csam",
  "trace_id": "xxxxxxxxxxxxxxxxxxxxxx5e6"
 },
 "errors": [
  {
   "code": 403,
   "message": "Failed to generate access token for customer ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxx8."
  }
 ]
}
At C:\Users\Administrator\Desktop\test.ps1:150 char:21
+ ... $Response = Invoke-WebRequest -Uri "$FalconCloud/oauth2/token" -UseBa ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
   eption
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
Failed to retrieve authorization token
At C:\Users\Administrator\Desktop\test.ps1:310 char:9
+         throw $Message
+         ~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (Failed to retrieve authorization token:String) [], RuntimeException
    + FullyQualifiedErrorId : Failed to retrieve authorization token

Have anyone faced this issue before or am I missing something?

redhatrises commented 2 years ago

I have created a bugfix for the memberCID issue. As a reminder if you are using MemberCID as your own CID that doesn't have a parent management CID attached, using a regular non-managed CID won't work.