Updating/Uninstalling module and api key limitation

[thomaslc66]

Hello,

I was using you module to run a script in order to add some IOC and do some blacklisting on them.
It was working fine, using version 2.0.8, manage to create an API key in a parent entity and add the IOC in more than 20 sub-entities without any problem.

Today, trying to run the script again and it's not working anymore.
I'm always importing the module first.

But here is what I'm facing...

Request-FalconToken : A parameter cannot be found that matches parameter name 'Cloud'.

Then I'm doing, to check the parameters of the "Request-FalconToken" method:

Request-FalconToken -Help
You cannot call a method on a null-valued expression.
At *******\Documents\WindowsPowerShell\Modules\PSFalcon\2.0.8\Private\Private.ps1:426 char:13
+             ($Falcon.GetEndpoint($_).Parameters).foreach{
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
You cannot call a method on a null-valued expression.
At ********\Documents\WindowsPowerShell\Modules\PSFalcon\2.0.8\Private\Private.ps1:426 char:13
+             ($Falcon.GetEndpoint($_).Parameters).foreach{
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

So I'm trying no to start from scratch and removing the old module version and then re-installing the new one.
So I'm doing this like mentioned in your readme:

Uninstall-Module -Name PSFalcon -AllVersions
PackageManagement\Uninstall-Package : Access to the cloud file is denied
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:2194 char:21
+ ...        $null = PackageManagement\Uninstall-Package @PSBoundParameters
+                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Microsoft.Power...ninstallPackage:UninstallPackage) [Uninstall-Package], Exception
    + FullyQualifiedErrorId : System.ComponentModel.Win32Exception,Microsoft.PowerShell.Commands.RemoveItemCommand,Microsoft.PowerShell.PackageManagement.Cmdlets.UninstallPackage

I've also tried with the -Force parameter.
So then, I've tried to use another computer, followed your readme, installed the module and run my script, this time it works, but last time was able to upload the IOC to all my sub-entities, this time after 12 (more or less) the api told me that I've reach the api limit...

My policy is set to "unrestricted" and I'm running all my script using PowerShell in the admin.

I'm just trying to understand why suddenly the version 2.0.8 is not working anymore?

[bk-cs]

There were no changes to v2.0.8.

Request-FalconToken : A parameter cannot be found that matches parameter name 'Cloud'.

The -Cloud parameter is still available and should not be producing this error. Typically when users report errors like these, it's because the module is not installed in the typical user-specific PSModulePath directory (listed here). The next error you received is a symptom of the same problem--PSFalcon not able to read files it needs to gather data from:

Request-FalconToken -Help
You cannot call a method on a null-valued expression.
At *******\Documents\WindowsPowerShell\Modules\PSFalcon\2.0.8\Private\Private.ps1:426 char:13
+             ($Falcon.GetEndpoint($_).Parameters).foreach{
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
You cannot call a method on a null-valued expression.
At ********\Documents\WindowsPowerShell\Modules\PSFalcon\2.0.8\Private\Private.ps1:426 char:13
+             ($Falcon.GetEndpoint($_).Parameters).foreach{
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

This error makes me think something in your networking configuration changed, because it's not PSFalcon related, and is probably tied to PowerShellGet or access to the PowerShell Gallery:

PackageManagement\Uninstall-Package : Access to the cloud file is denied

All of those errors suggest something wrong with your installation of the module, which you seem to have pinpointed with it working during the manual install. PSFalcon v2.0.8 reads from files to get content for commands, and if it can't access those files, things go haywire.

You may consider using the newest release, which is constructed in a more "Best Practices" fashion, with static parameters and less potential for there to be file-access related issues. However, it is currently in a testing phase and could potentially have bugs. I have found a couple minor ones that have been fixed, but not released yet.

So then, I've tried to use another computer, followed your readme, installed the module and run my script, this time it works, but last time was able to upload the IOC to all my sub-entities, this time after 12 (more or less) the api told me that I've reach the api limit...

• How many custom IOCs do you have in your Falcon CID?
• Are you adding them one at a time, or multiple in the same request (-Array)?
• Could you be trying to add an IOC that already exists?

[bk-cs]

I'm closing this issue since I haven't heard from you. Please respond back if you're still having problems!

[thomaslc66]

Hello,

Thank you for your answer.
I manage to do manually, delete the old module, clear everything and reinstall it manually.

To answer your question:

• we have multiple CID and multiple IOC that are block, some only on one subentity other on all subentities.
• We are doing a loop because when we use the -Array command with this array:

$IoCs = @(
    @{
        type = "sha256"
        value = "full_hash"
        source = "bd20201216"
        filename = "filename.exe"
        action = "prevent"
        severity = "high"
        description = "description of the hash"
        platforms = $System
        tags = @("test_tag", "test_tag2")
        applied_globally = $true
    },
    @{
        type = "sha256"
        value = "full_hash"
        source = "bd20201216"
        filename = "filename.exe"
        action = "prevent"
        severity = "high"
        description = "description of the hash"
        platforms = $System
        tags = @("test_tag", "test_tag2")
        applied_globally = $true
    },
)


$System = @(
            "windows",
            "mac",
            "linux"
            )

Then we got this error:

New-FalconIoc : Cannot validate argument on parameter 'Array'. 'type' is required for each indicator.

I'm not sure what is the problem here, my IOC has clearly a type on each of them.
_Please note that on my script full_hash = a real hash and filename.exe is replaced also by the real filename.

Thank you for your answer.

• When the script is adding an already existing hash, there is an error but the script still continues.

Could you please let me know why there is no type detected on my array and also what is the goal of the "source" parameter?

[thomaslc66]

@bk-cs

[bk-cs]

Are you using v2.1.0-alpha from the PowerShell Gallery? If so, I believe this is a bug tied to that alpha release. You can download the latest source if you'd like to use v2.1.0, but it is still a work in progress and not officially released. Most of the remaining changes are documentation/testing/optimization related, though--I don't expect you'll see many issues. Once complete, the PowerShell Gallery's official release will be moved to v2.1.0.

I just tested $IOCs with the code that is currently in the master repository and it did not produce the type error.

source is a field that can be used as a comment to describe where the indicator came from.

[bk-cs]

Also, this might be relevant for iterating through a list of CIDs: https://github.com/CrowdStrike/psfalcon/wiki/Code-Examples#authorize-and-run-commands-in-member-cids