From 0386d04c389ea9bf57c8506c68f8a99ae62d9e5b Mon Sep 17 00:00:00 2001
From: v-sabiraj <v-sabiraj@microsoft.com>
Date: Tue, 26 Nov 2024 16:53:50 +0530
Subject: [PATCH] Updated the logic for the warning message

---
 .../CrowdstrikeFalconAPISentinelConn.zip      | Bin 24630923 -> 24630922 bytes
 .../Replicator/main_aws_queue.py              |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn.zip b/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn.zip
index f78fab29def12c851c06e04e46930acf7fd405d4..9878cbaf85918a391a344b0d4ad33006f5af103c 100644
GIT binary patch
delta 1905
zcmY+@=|c{P8U^qk?Hi4xO{GoV6g8wI?VC1KN;{!Qi4rL(oI*Xar7&7$nHoeU>!^s)
z!l-CaiIz!MS-O}cy83uOoZmVBz{xn*A)WpsDIko4Fhn2<F^EF~l8}NlWFU+2m;gEa
zgo%*HBq(4q6rluVs6Z7{payklU@A1B1#Rd+7t^4J=@394GhhHi%)~4h!5BYdHs-(t
zb72ZI%!4`R!vYIn2`gB`2DY$+JsjW&CpcpvT;K{fxWfaBuoz3=2`_kKDSY6IW$=SP
z0uYEG1S15?u>zr3iB(vQFoa_b)*=Gy5Q!+PM>IBIBVrJXO^Cy0Y(YG>A_0lmh9qo9
zGE%SuJFyEuD$=kUd$1Sj$N*y>GO-^Aa1e)Z7+E-iY~<i5j^Q|d!3pFd5BVrSA&PJk
z#W;o2ID@nJ6(uOeZ#akZxPUTT#3hvDGJZz|uHY)J;W}>MCjP)JRH6#ixQ#og!Cl<L
zpSX`&)S(^?cz}oa3y;u<CN$$Qo}dMP<0+ouIa<+%cDz6bUg8xx(S>gG;2-qjHTv)$
zyg@$(@D}gz9v?7>|KcM);WPfl5WZj-UonDj_>R#%#6&!fSeRIZSd>_dSe#gbSdv(Z
zSejUdSeAG^@dRQy;-82o63Y`$B32-tOsq((M667#Laa(Wg;<SPomhi-DzPT97O^(5
z4zVurG-5sC>BItJec~C!2E>NMGl^#r8xb25|4clacn+}%@myk4Vl(1-#OB2Fi7kj1
z5L*&k5nB`65Ze;l5!(|x5IYh(5jztvBz7ToC3YirC-xv-M7)@I39%=!7qK_-Qeq!s
zU*cuNe#HL70mOmCLBzqtA;imxR}hC1uOwbYyqY+SIGlJ5@mk^t;&sH4#8JfS>1H&|
zF_w)>P4FwDptF5aLP8^zHpbBuA)cHO<s@wU40h)XdV}r9*Pgf#di#!0gIc7HTuEkH
zRk6obZYkKFIrO}-H&w<Zvg2?;rBb^3<Yv(t$sW^SIU`OFcJ5c3@FBat?!*pv@n2Fd
zXn#~x4GUa7wW6-Jx7%aki+2Yi4iD+eZjZvuJB5FA8)h6mx=Uxq0?l`GO|~DLoIKLw
z6Vj``|BFp-bxwF@Wc{h}US2IfM(ezcRjtlBxs~xt<eJnky=aJgwRB1Qh|2a)`?UI6
zGaM|^O6ycB6tpg0-&Erj;(cYJgr&EmYm`J?|2o4eO{t9!m2Nq_QM0X|lz&aEq|+-$
z%P!AH<3MEDd!f5i?r%%=^yGg1&TS*f=8J;v2hUf&SKA=GNTRO$q?y5sgsNtj*IlH#
z%RBe1sN?(7;w!X^Wvjf&Io3o|Nx3>mxoEL?Ud@U4h}e6g8D}m#E!8_I5g2pGU%Jw{
zp?A;g`OBV2>$(l+1sht}6#V|?SF@GU@-m~HPO0u{NkyvqkFOmPtZG!#u@{biVlSWE
zFs!%Abh>ZFUtO&(b^H9}I;=*WgcYsbL}%9qbPr`3mKU}N>#nHnyQ_M0&ERio)j7vo
zY~|KA%5JcFP^8eVySE^k67ws&Z=6@z+n{24_0P-E4n~0?HZScqKDutCWxeRiyLo*B
zH<P}V_s-G{7#LY1GVxh;eHV|o+;;l5)p2ri?e{#51Y7T8x2j9m9}IFn*Ay49Gp*d?
zLrmex#a-<-6?<L?Dnr!wr|o)mL&oXq&aUgW$$LZJhFfc=m$m&X$TXLJK5S{*p7b*I
zf^+X@{RH3VGeYK+`X{+&4IT@9{_v?^+vnSX(pIHrYDZje<qMW4W>-~B5viLn%Vx)Q
zr%_Ao<Y`5^J(?o!Dqk!Lo-L^OHdp*i!Ol;KA=RS(^<w6wp3No|9fc_e1|)qFrR#Fn
zm+c(r37>a7+oxIHa^<tYQwyEL`h3HO2lZxa@7|o4xB7gJorr?x-I#wW%&c0~&wGcJ
z#ec05FFzvCi#hza%%QeJvlLQJ&9vHe`ElX2SFW*78<RauF2%L&b=f*@)TJk@ytz}e
zrlL5)p}47BYPhVYQ?OfL^~I>zprNQ=Nmw>7Wx<|DVt%>4`k@A;5jyXLTF$=Fjxwpc
z>6Inv=KEGFd`fMOMe4^>4+^_Kn&~+hC|0$(t^O`j)Ns-F>DuCTVc7<zvYV8j4wfWE
zG-xPgQP$9B!Po4X9JhAgvg0NF!}bq_M0UJccv{ONvt!e%NvCTBO*VRWf<1=?p`+sa
zJuIT>2OGxNI7ZAEv14o+BW{e%ROw-{h1MSX|F`GYJlR44<eopZWeeGmNq*>$))u>A
J8BIb${{tu{Q6>NY

delta 1906
zcmY+@=_3^g8wGF=6_G?F#UM(gLJhLSwNy%^T!pfP$UahJ2|3j*PbDFup(aIArnCty
zs*y2Ns%i0ta>vrlw3u$GrY0ZX59fEzKX7(cbt+_iOF9VBkiiIy#3;x@4x=Ft1&o0r
z#zG0>pbQm^hbq)C0qU3t4NSshXhI9$K^r>I#T4j4A5$?62AB>*7-0sCF%z>e8zwM?
z8RlRvzK1z1V2OFKf;DVli}|pFJp^!oBb?xj1z3nhaKU0Mfh(564enS54=l$DctQv-
zti&pK!w0@tjWzItKLQYlwFp8mLa+{@2*Y}WBLb0#LNsC!iysh&4T#4^Y(fGOu^CB7
zMha4~1!+h}2DTy-z&32h4v4T5yO0IOZtTHcWMdz4upha|Lp~0m0EIY+A{65genbgM
zaTrJN6ON(`$8a3wsK5zS;v}kY3a3$xpK%6fQG;_hj|;enOQ^+V)S(^?xPq&=hU;j=
z4cx>n{DLOjMl*gz3w}c@+HePVaS!ddj|X^&-|+~K@dQuNf&bwdI?;u0JjV<4K#V`o
zi$3&Y059<;{=(mQh1Yn4w;04fcn1mI;{%595uflG|Kbb2iin9=nplQ-1o24XQN*&u
za>S#F<%t!D#}F$Lk0n+j9!IQ9tU^4VSe00fcmlCH@kC+`;z`7li8YC}h`%G&Ce|U=
zC7wd8N32ggm3SJl0r7NVLt-Q18N|lKGl^#r&n7k@HYGMAo<lsB_<Le=VhdtR;(5eY
z#MZ<%#J0rqiS3B(i3P+C#E!&H#LmPEh!+wsB6cBOOuU5Hm3S$!8?ig_GGY(n<-{w9
zJ&A?HUc@VjR}p&?`w;sQuO?nY>__ZR96%gMyp}kKIG8wucpY&laTxJ>;&9>!;z;5s
z;%KUip}D4tN1_&a_r5z@HXtu0HFQN_8bjf-X}(_ZA-=kKvD0(K9a&Afg@Z!Z#EI!u
znHeJ-)b5VUyRW?0LqoMq+28tOb+#b&uVj^6b;p~HYirYW4j122klwC)S7B#;m+rGT
z??RL6{zc<oZ$#_bAg(;wm~T0R4nvoZTFax9{L30nE4GDL)@0R%D39Ne9b7iKC-vAZ
z!+UArS2}uLro1pUC_gKCTeC0fQeB{Y^T%()`gnHa<o<($>a*n?o;W@%x-_fK;6#ys
z<LL%B{nX@2QE05trSZJOL@$dyi9J~ZUeecgG%u@A6cnabjkI*qZPjSJ5LWLPR``5Q
zg1s<hz$&<@{ho}OqL)@_flT3S_r*s0);JgMP4n-qP<U)@&}dn>xofnbFhzC8%^6CG
zKBH631A?-RRL)(M^BdHOL=6?3_!4$XXM~>K#i@>}12y{#UbscIUJQ66l9UguQq5Sh
z$0MR!edmy-aw=6O9p2*7*`B=3K(1z!ty*ZLaBH{!=kn@`4es%d+pJd3-ez2z85t&Z
z`e0bvR`0L4Kk8hwBrwI-<&vqw^H05B!@8tJ6#>&WXK8l+9AbVysZ{@@MSWuC1=k-R
zn0#2??jtv4W-Ub@^R78^Szq~|nE|f`52XAq)Z6F%Vw6RJq)Kl4%NcSh)5rR#FBs9+
zFR?YKKlJ`on&fp^aLFON9rjbK6E_s^^LP1BZr9S3Hsx{WprgCUsNEv*f!Y~`3Sn*Z
zk~^^v4WAjutA^KEHhJB#7Qg@X#obtwlmp#zD`Qu$>}y-rA|4awq@4fB@}`HZz*l==
zd6rVj-)j9Ge$Fv2$>OYa!phU4<?~m#KGm?!dipFsqB~UW_)l@Sf0;8fvQ1@TL8kps
z_tfdj-uHEerrmI=IckGa7rheMxtFh<*Z!kR)w6obs~H#VBOcp_3d3t}N%U05ow02Q
zj}csISM;i`|7^Ul{a$#|^-$xY%DJO&8~;1t>i;EpUC*89wzDno;zXqmCswttR_hIY
zx<9XZ%!HT{Nx*qCu~YQhgMu92w`J1R_r;;v`Br!JQ`Wm#r9G)waK6>b!_d9UzoIy9
zlaEctqkPXQk!O;ZKwIK#BQ_BmXm8Km=AEk*RC;ZEwXE_Joyx(*&Kx4#-J^AN(#F)I
zRSOCec9~`LH?Qeoy&*oH-B2?xS5vF^s7NebP*l-UVxK!tB5%Dr{<oGK@v)3qGQNK2
z+;<PjWSXU`bQ*2x$oY^{@k!omMc$f{CXIBRSlip4H*UWvnpJ!~*V5UlFZj`t#dgkr
zewEt0)Fy_$5j)He!^91<VVL+~HV(6it}L}lp!J3SfA^Bc2MOd$ZYA0e6G%YjC4t{s
MZ&cm<7?P6u4*`W#4FCWD

diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/Replicator/main_aws_queue.py b/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/Replicator/main_aws_queue.py
index cc24aa45cdf..bce10d3d3af 100644
--- a/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/Replicator/main_aws_queue.py	
+++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/Replicator/main_aws_queue.py	
@@ -107,7 +107,7 @@ async def main(mytimer: func.TimerRequest):
                         logging.info("Got message with MessageId {}. Start processing {} files from Bucket: {}. Path prefix: {}. Timestamp: {}.".format(msg["MessageId"], body_obj["fileCount"], body_obj["bucket"], body_obj["pathPrefix"], body_obj["timestamp"]))
                         
                         diffFromNow = int(time.time()*1000) - int(body_obj["timestamp"])
-                        if diffFromNow >= 3600:
+                        if diffFromNow >= 3600000:
                             logging.warn("More than 1 hour old records are getting processed now. This indicates requirement for additional function app.")
                         await download_message_files_queue(mainQueueHelper, backlogQueueHelper, msg["MessageId"], body_obj)