Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] Get-FalconAlert -All -Detailed returns 413 - Request Too Large #396

Closed
datorr2 opened this issue Mar 25, 2024 · 3 comments
Closed
Assignees
Labels
bug Something isn't working fix available Self-applied fix available in issue

Comments

@datorr2
Copy link
Contributor

datorr2 commented Mar 25, 2024

Describe the bug
Get-FalconAlert -All -Detailed produces an HTTP error 413 - Request Too Large

To Reproduce
Get-FalconAlert -All -Detailed

Expected behavior
All Falcon alerts returned with details.

Environment (please complete the following information):

  • OS: Microsoft Windows 10.0.19045
  • PowerShell: 7.4.1
  • PSFalcon: 2.2.6

Additional context
Ran command with -Verbose flag and then copied the POST body to check the length. The length of the request was 1058849 bytes, which is over 1 MiB.

Transcript content

**********************
PowerShell transcript start
Start time: 20240325190440
Username: USERNAME
RunAs User: USERNAME
Configuration Name: 
Machine: HOSTNAME (Microsoft Windows NT 10.0.19045.0)
Host Application: C:\Program Files\PowerShell\7\pwsh.dll
Process ID: 14612
PSVersion: 7.4.1
PSEdition: Core
GitCommitId: 7.4.1
OS: Microsoft Windows 10.0.19045
Platform: Win32NT
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1, 6.0, 7.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
WSManStackVersion: 3.0
**********************
Transcript started, output file is .\bug.log
PS>Show-FalconModule

PSVersion      : Core [7.4.1]
ModuleVersion  : v2.2.6 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1}
ModulePath     : C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6
UserModulePath : C:\Users\USERNAME\Documents\PowerShell\Modules;C:\Program Files\PowerShell\Modules;c:\program files\powershell\7\Modules;C:\Program
                 Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
UserHome       : C:\Users\USERNAME
UserAgent      : crowdstrike-psfalcon/2.2.6

PS>Get-FalconAlert -All -Detailed
VERBOSE: 19:04:46 [Get-FalconAlert] /alerts/queries/alerts/v1:get
VERBOSE: 19:04:46 [ApiClient.Invoke] GET https://api.laggar.gcw.crowdstrike.com/alerts/queries/alerts/v1?limit=10000
VERBOSE: 19:04:46 [ApiClient.Invoke] Accept=application/json
VERBOSE: 19:04:49 [ApiClient.Invoke] 200: OK
VERBOSE: 19:04:49 [ApiClient.Invoke] Server=nginx, Date=Mon, 25 Mar 2024 23:04:49 GMT, Transfer-Encoding=chunked, Connection=keep-alive, Strict-Transport-Security=max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains, X-Cs-Region=us-gov-1, X-Cs-Traceid=74c156d2-dbcd-4243-8def-572f4860a8e5, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5999
VERBOSE: 19:04:49 [Write-Result] query_time=0.704189434, pagination.offset=0, pagination.limit=10000, pagination.total=12735, writes=, powered_by=detectsapi, trace_id=74c156d2-dbcd-4243-8def-572f4860a8e5
VERBOSE: 19:04:55 [Get-FalconAlert] /alerts/entities/alerts/v2:post
VERBOSE: 19:04:55 [ApiClient.Invoke] POST https://api.laggar.gcw.crowdstrike.com/alerts/entities/alerts/v2
VERBOSE: 19:04:55 [ApiClient.Invoke] ContentType=application/json, Accept=application/json
VERBOSE: 19:04:55 [ApiClient.Invoke] {"composite_ids":[ <IDS REMOVED FOR BREVITY AND DUE TO SENSITIVITY> ]}
VERBOSE: 19:04:56 [ApiClient.Invoke] 413: RequestEntityTooLarge
VERBOSE: 19:04:56 [ApiClient.Invoke] Server=nginx, Date=Mon, 25 Mar 2024 23:04:56 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains, X-Cs-Region=us-gov-1, X-Cs-Traceid=79ed51c1-ab3d-459f-b8b9-1362f4156cfb, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 19:04:56 [Write-Result] query_time=0.018427306, writes=, powered_by=detectsapi, trace_id=79ed51c1-ab3d-459f-b8b9-1362f4156cfb
Write-Result: C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\private\Private.ps1:663
Line |
 663 |          Write-Result $Object
     |          ~~~~~~~~~~~~~~~~~~~~
     | {"code":413,"message":"request too large"}
Write-Result: C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\private\Private.ps1:663
Line |
 663 |          Write-Result $Object
     |          ~~~~~~~~~~~~~~~~~~~~
     | {"code":413,"message":"request too large"}

PS>Stop-Transcript
**********************
PowerShell transcript end
End time: 20240325190501
**********************
@datorr2 datorr2 added the bug Something isn't working label Mar 25, 2024
@bk-cs
Copy link
Collaborator

bk-cs commented Mar 25, 2024

Thanks for the report!

It looks like GET /alerts/queries/alerts/v2 returns 10,000 ids, but POST /alerts/entities/alerts/v2 only accepts a maximum of 1,000. PSFalcon isn't breaking up the identifier list into groups of 1,000. Until I fix that, you can work around the problem by retrieving the available alerts like this:

Get-FalconAlert -Limit 1000 -Detailed -All

bk-cs added a commit that referenced this issue Mar 26, 2024
Added maximum count of 1000 when building body content during requests for `Get-FalconAlert`
@bk-cs
Copy link
Collaborator

bk-cs commented Mar 26, 2024

I've implemented a fix to ensure that only 1,000 ids are submitted per request when retrieving details of alerts. This fix will be included in the next PSFalcon release. If you'd like to resolve it for your local module before release, you can replace public\alerts.ps1 and private\Private.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/a6a777a3a3e52462ee572d869990beb93b5bc838/public/alerts.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) alerts.ps1)
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/a6a777a3a3e52462ee572d869990beb93b5bc838/private/Private.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath private) Private.ps1)

Once these steps have been completed, please close and re-open PowerShell and re-import PSFalcon to ensure that the issue is resolved. Leaving this open for others to apply the fix until the next release.

@bk-cs bk-cs added the fix available Self-applied fix available in issue label Mar 26, 2024
@bk-cs
Copy link
Collaborator

bk-cs commented Sep 4, 2024

This fix is included in the 2.2.7 release.

@bk-cs bk-cs closed this as completed Sep 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working fix available Self-applied fix available in issue
Projects
None yet
Development

No branches or pull requests

2 participants