search

carbonblack / carbon-black-cloud-sdk-python

VMware Carbon Black Cloud Python SDK
MIT License
40 stars 23 forks source link

[BUG] Process Search Validation method still hits the deprecated v1 endpoint and return 410 Errors #541

Closed signaledge closed 17 hours ago

signaledge commented 1 month ago

I am seeing this behaviour on: (please complete the following information):

Describe the bug We have an automation framework for our detection as code platform that allows us to validate queries developer right by leveraging the process validation method CBCloudAPI.validate_process_query() @ https://github.com/carbonblack/carbon-black-cloud-sdk-python/blob/develop/src/cbc_sdk/rest_api.py#L477.

Since a couple of weeks ago, we encountered 410 errors when hitting that endpoint. After some digging, I found this knowledge article : https://knowledge.broadcom.com/external/article/292040/api-errors-in-custom-applications-andor.html

  • Alerts v6 API
    • Sensor Update Services v2 API
    • Enriched Events Search API
    • Process Search Suggestions v1
    • GET Process Search Validation v1
    • Policy v3 REST API
    • Devices v3 REST API
    • Live Response v3 API
    • Data Forwarder Alert Schema v1
  • Deactivation of listed APIs listed above.
  • Automatic upgrade of active Alert Forwarders that were using Alert Schema v1 to Alert Schema v2.
  • As of July 31st 2024 Data Forwarder Alert Schema v1 will be removed and unavailable for customer use.

image

As you will gather, the SDK failed to update the endpoint of this particular method. I would also suggest reviewing dependencies on the different API versions, to ensure there are no other broken behaviours, but this issue scope is for validate_process_query() as this is the only break I investigated

image

The v2 version is listed here https://developer.carbonblack.com/reference/carbon-black-cloud/platform/latest/platform-search-api-processes/#process-search-validation-v2 but requires to switch to a POST instead of a GET.

signaledge commented 1 month ago

I have opened a small proposal @ #542 which implements the v2 API from documentation.

signaledge commented 4 weeks ago

Can this be followed up on ? It's a pretty big oversight if some methods can just die in the SDK.

avanbrunt-cb commented 17 hours ago

Appreciate you calling this out and we'll work on monitoring the issue list more closely. This has been fixed in 1.5.7