search

CrowdStrike / psfalcon

PowerShell for CrowdStrike's OAuth2 APIs
The Unlicense
350 stars 66 forks source link

[ BUG ] `New-FalconIoaRule` generates `400` error when following wiki example #399

Closed bk-cs closed 1 week ago

bk-cs commented 4 months ago

Describe the bug Unable to create a custom IOA rule inside of of an IOA group following the New-FalconIoaRule wiki example.

New-FalconIoaRule is failing to pass field_values as an array when submitting the rule creation request, causing a 400 response.

Environment (please complete the following information):

bk-cs commented 4 months ago

This bug has been fixed for the next release. If you'd like to resolve it for your local module before release, you can replace public\ioarules.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/9f90b0a63a2d6196a8a380a713ca92ac26f0562d/public/ioarules.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) ioarules.ps1)
bk-cs commented 1 week ago

This fix is included in the 2.2.7 release.