'update_detects_by_ids' returns "Failed to validate resource"

[jartigag]

Hi,

I'm starting to work with this library. It's great:)

I've just tried to update a detection following the example, but this error is returned and I don't understand it:

Python 3.9.2 (default, Feb 28 2021, 17:03:44) 
[GCC 10.2.1 20210110] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from falconpy import Detects
>>> falcon = Detects(client_id="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", client_secret="yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy")
>>> id_list = "ldt:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:99999999999"
>>> response = falcon.update_detects_by_ids(assigned_to_uuid="string", comment="string", ids=id_list, show_in_ui=True, status="string")
>>> print(response)
{
    'status_code': 400,
    'headers':
    {
        'Server': 'nginx',
        'Date': 'Tue, 18 Jan 2022 12:50:03 GMT',
        'Content-Type': 'application/json',
        'Content-Length': '179',
        'Connection': 'keep-alive',
        'Content-Encoding': 'gzip',
        'Strict-Transport-Security': 'max-age=15724800; includeSubDomains, max-age=31536000;   includeSubDomains',
        'X-Cs-Region': 'eu-1',
        'X-Cs-Traceid': '8ace6ede-9be3-4e5b-94d0-185d3699a301',
        'X-Ratelimit-Limit': '6000',
        'X-Ratelimit-         Remaining': '5998'
    },
    'body':
    {
        'meta':
        {
            'query_time': 0,
            'writes':
            {
                'resources_affected': 0
            },
            'powered_by': 'msa-api',
            'trace_id': '8ace6ede-9be3-4e5b-94d0-185d3699a301'
        },
        'errors': [
        {
            'code': 400,
            'message': 'Failed to validate resource'
        }]
    }
}

Thanks in advance!

[jshcodes]

Hi @jartigag!

While the example code is syntactically correct, the API is confirming your request and cannot find one of the resources your request specifies.

Are you passing one of the valid values for status? (List can be found here.) You will also need to pass a valid UUID for the assigned_to_uuid keyword. ids can be a list of detection IDs, or a single one as you show above.

[jartigag]

I'm trying with (assigned_to_uuid and detection id sanitized):

>>> response = falcon.update_detects_by_ids(
  assigned_to_uuid="a_valid_user_email@company.com", comment="string",
  ids="ltd:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:99999999999", show_in_ui=True,
  status="in_progress"); print(response)

{'status_code': 400, 'headers': {'Server': 'nginx', 'Date': 'Tue, 18 Jan 2022 16:40:12 GMT', 'Content-Type': 'application/json', 'Content-Length': '180', 'Connection': 'keep-alive', 'Content-Encoding': 'gzip', 'Strict-Transport-Security': 'max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains', 'X-Cs-Region': 'eu-1', 'X-Cs-Traceid': 'fa5a805b-2cb3-4d2a-95b8-df8036b63f58', 'X-Ratelimit-Limit': '6000', 'X-Ratelimit-Remaining': '5994'}, 'body': {'meta': {'query_time': 0, 'writes': {'resources_affected': 0}, 'powered_by': 'msa-api', 'trace_id': 'fa5a805b-2cb3-4d2a-95b8-df8036b63f58'}, 'errors': [{'code': 400, 'message': 'Failed to validate resource'}]}}

[jshcodes]

Hi @jartigag!

You'll need to lookup the UUID for the user you want to assign this to first. Try the following and let us know what you get back.

from falconpy import OAuth2, Detects, UserManagement

auth = OAuth2(client_id="CLIENT_ID_HERE", client_secret="CLIENT_SECRET_HERE")
detects = Detects(auth_object=auth)
users = UserManagement(auth_object=auth)

user_detail = users.retrieve_user_uuid(uid="a_valid_user_email@company.com")
if user_detail["status_code"] != 200:
    raise SystemExit(f"User UUID not retrieved: {user_detail['body']['errors'][0]['message']}")

user_uuid = user_detail["body"]["resources"][0]  # Should only be the one

# Now that we have the UUID, we should be able to assign the detection
result = detects.update_detects_by_ids(assigned_to_uuid=user_uuid,
                                       show_in_ui=True,
                                       comment="Comment here",
                                       status="in_progress",
                                       ids="ltd:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:99999999999"
                                       )

print(result)

[jartigag]

Aaah, ok. Thanks a lot!

Another thing 😅 I couldn't find how to query the comment field in a detection. It's not in the get_detect_summaries response... Where can I request it?

[jshcodes]

Querying with comment as a filter is not currently available. Here is a complete list of available FQL filters for this method. Let us know if you have more questions! 😄

[jartigag]

Sorry, I didn't express myself correctly. I meant how to request the comment field of a detection (I didn't find it in the get_detect_summaries response)

[jshcodes]

Comment data is only available in the Falcon Console and is not exposed as an API property, so you will not be able to read this data with FalconPy (but you will be able to set it).

[jartigag]

I see. Thanks for your help!