CrowdStrike / psfalcon

PowerShell for CrowdStrike's OAuth2 APIs
The Unlicense
350 stars 66 forks source link

[ BUG ] Adding offset to Get-FalconHost throws an error #349

Closed brimur closed 1 year ago

brimur commented 1 year ago

Describe the bug A clear and concise description of what the bug is.

To Reproduce Add limit and offset and the error will occur

Expected behavior Adding a limit and and an offset should allow manual pagination

Environment (please complete the following information):

Additional context Add any other context about the problem here.

Transcript content

PSVersion      : Desktop [5.1.20348.1850]
ModuleVersion  : v2.2.5 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1}
ModulePath     : C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.5
UserModulePath : C:\Users\svc_onboard.COMMSCOPE.000\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules;D:\Program Files (x86)\Microsoft SQL Server\150\Tools\PowerShell\Modules\
UserHome       : C:\Users\svc_onboard.COMMSCOPE.000
UserAgent      : crowdstrike-psfalcon/2.2.5

VERBOSE: 11:06:10 [Get-FalconHost] /devices/queries/devices-scroll/v1:get
VERBOSE: 11:06:10 [ApiClient.Invoke] GET https://api.us-2.crowdstrike.com/devices/queries/devices-scroll/v1?filter=product_type_desc:"Workstation"%2Bserial_number:!"*VMware*"&limit=1000&offset=1000
VERBOSE: 11:06:10 [ApiClient.Invoke] Accept=application/json
VERBOSE: 11:06:11 [ApiClient.Invoke] 400: BadRequest
VERBOSE: 11:06:11 [ApiClient.Invoke] Connection=keep-alive, Strict-Transport-Security=max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains, X-Cs-Region=us-2, X-Cs-Traceid=4948fb7a-bf02-4807-8eae-daf6e877c4c2, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5997, Date=Fri, 08 Sep 2023 15:06:11 GMT, Server=nginx
VERBOSE: 11:06:11 [Write-Result] query_time=0.001832741, powered_by=device-api, trace_id=4948fb7a-bf02-4807-8eae-daf6e877c4c2
Write-Result : [{"code":400,"message":"Bad request"}]
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.5\private\Private.ps1:624 char:27
+                 $Output = Write-Result $Object
+                           ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
    + FullyQualifiedErrorId : 4948fb7a-bf02-4807-8eae-daf6e877c4c2,Write-Result
Write-Result : [{"code":400,"message":"Bad request"}]
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.5\private\Private.ps1:624 char:27
+                 $Output = Write-Result $Object
+                           ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
    + FullyQualifiedErrorId : 4948fb7a-bf02-4807-8eae-daf6e877c4c2,Write-Result
bk-cs commented 1 year ago

Get-FalconHost uses /devices/queries/devices-scroll/v1 which provides a pagination token, not a numerical offset. If you use $VerbosePreference = 'Continue' when calling Get-FalconHost -All, you can see it.

PSFalcon has the -All parameter to automatically supply the pagination integer/token so that users don't have to manually paginate.