psfalcon
psfalcon copied to clipboard
[ BUG ] `Import-FalconConfig` fails to modify and ignores default `SensorUpdatePolicy`
Describe the bug
Import-FalconConfig does not modify default SensorUpdatePolicy. Errors may also occur related to variants sensor values (like missing build, or sensor_version) or scheduler values (missing timezone).
Additional items may fail to import or fail to be modified (especially "default" policies). Users have reported that prevention policy settings were not being modified after creation.
To Reproduce
Attempt to use Import-FalconConfig to modify default SensorUpdatePolicy
Environment (please complete the following information):
- OS: Windows 10
- PowerShell: 5.1
- PSFalcon: 2.2.8
Related causes:
- The "HomeCid" code added in the v2.2.8 release that is designed to prevent attempted modification of inherited policies is causing imports from other CIDs to be skipped when they should be properly modified
- The
variantsproperty underSensorUpdatePolicyis not being properly updated when avariants.buildvalue is no longer available - The
schedulerproperty underSensorUpdatePolicyrequires atimezonevalue when being submitted, but not all imports will have a value
Several changes have been made to fix these issues for the next PSFalcon release. If you'd like to resolve it for your local module before release, you can replace public\psf-config.ps1 using the steps outlined below.
Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/refs/heads/dev/public/psf-config.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) psf-config.ps1)
Please ensure that you close and re-open PowerShell and re-import the PSFalcon module before testing.
This fix was included in the 2.2.9 release. Closing issue now that the release is available.