psfalcon icon indicating copy to clipboard operation
psfalcon copied to clipboard

[ BUG ] `New-FalconIoaRule` generates `400` error when following wiki example

Open bk-cs opened this issue 10 months ago • 1 comments

Describe the bug Unable to create a custom IOA rule inside of of an IOA group following the New-FalconIoaRule wiki example.

New-FalconIoaRule is failing to pass field_values as an array when submitting the rule creation request, causing a 400 response.

Environment (please complete the following information):

  • OS: Windows 11
  • PowerShell: 5.1
  • PSFalcon: 2.2.6

bk-cs avatar Apr 19 '24 21:04 bk-cs

This bug has been fixed for the next release. If you'd like to resolve it for your local module before release, you can replace public\ioarules.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/9f90b0a63a2d6196a8a380a713ca92ac26f0562d/public/ioarules.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) ioarules.ps1)

bk-cs avatar Apr 19 '24 22:04 bk-cs

This fix is included in the 2.2.7 release.

bk-cs avatar Sep 04 '24 16:09 bk-cs