psfalcon icon indicating copy to clipboard operation
psfalcon copied to clipboard

[ BUG ] `Import-FalconConfig` fails to modify and ignores default `SensorUpdatePolicy`

Open bk-cs opened this issue 10 months ago • 2 comments

Describe the bug Import-FalconConfig does not modify default SensorUpdatePolicy. Errors may also occur related to variants sensor values (like missing build, or sensor_version) or scheduler values (missing timezone).

Additional items may fail to import or fail to be modified (especially "default" policies). Users have reported that prevention policy settings were not being modified after creation.

To Reproduce Attempt to use Import-FalconConfig to modify default SensorUpdatePolicy

Environment (please complete the following information):

  • OS: Windows 10
  • PowerShell: 5.1
  • PSFalcon: 2.2.8

bk-cs avatar Jan 10 '25 19:01 bk-cs

Related causes:

  • The "HomeCid" code added in the v2.2.8 release that is designed to prevent attempted modification of inherited policies is causing imports from other CIDs to be skipped when they should be properly modified
  • The variants property under SensorUpdatePolicy is not being properly updated when a variants.build value is no longer available
  • The scheduler property under SensorUpdatePolicy requires a timezone value when being submitted, but not all imports will have a value

bk-cs avatar Jan 10 '25 19:01 bk-cs

Several changes have been made to fix these issues for the next PSFalcon release. If you'd like to resolve it for your local module before release, you can replace public\psf-config.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/refs/heads/dev/public/psf-config.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) psf-config.ps1)

Please ensure that you close and re-open PowerShell and re-import the PSFalcon module before testing.

bk-cs avatar Jan 10 '25 20:01 bk-cs

This fix was included in the 2.2.9 release. Closing issue now that the release is available.

bk-cs avatar Sep 13 '25 01:09 bk-cs