falconpy icon indicating copy to clipboard operation
falconpy copied to clipboard

FileVantage's createScheduledExclusions missing Keyword Argumment for timezone

Open crowdstrikedcs opened this issue 5 months ago • 0 comments

Discussed in https://github.com/CrowdStrike/falconpy/discussions/1229\

Confirmed with debug logging that timezone is not being sent in request body. Using body_payload adressed the issue.

Originally posted by security-roberts September 16, 2024 I'm using https://www.falconpy.io/Service-Collections/FileVantage.html#createscheduledexclusions, but I keep getting: "field 'timezone' must be provided and be a valid timezone name. See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones". I've tried pretty much every variation I can imagine to try and specify my timezone, and it's just not accepting it. What is the actual "valid timezone name" format I need for this? Thanks!

  • Also, I tried using #getScheduledExclusions to see if the timezone was some unique format, but it's just (in this case) Etc/UTC. I tried that exact string, and it still throws the same error.
  • Also, also, yes, I tried it without the 'timezone' field first, because it wasn't listed in the falconpy.io page. The query errored saying the field was required, and that has lead me to this issue.

Test code that's not working:

response = falcon.createScheduledExclusions(policy_id="Test123",
name="Test1",
users="Test*",
processes="**\Test.exe",
schedule_start="2024-09-17T13:00:00-07:00",
schedule_end="2024-09-17T14:00:00-07:00",
timezone="Etc/UTC"
)
```</div>

crowdstrikedcs avatar Sep 23 '24 14:09 crowdstrikedcs