FalconX - Issue with results from sandbox.get_reports() #523
-
|
I've been having issues with results returned by sandbox.get_reports(), in that when i submit certain files to the sandbox using falconx, when i attempt to get artifact ID's for these using v i get a response that contains '"resources": null' despite the fact that when i look on the GUI the sample has submitted fine and there are plenty of artifacts to download. Example trace-id is "e34014a6-f91a-4026-918a-865d0c6b2ff8". Example response: {
"status_code": 200,
"headers": {
"Content-Encoding": "gzip",
"Content-Length": "204",
"Content-Type": "application/json",
"Date": "Fri, 14 Jan 2022 16:07:59 GMT",
"Strict-Transport-Security": "max-age=31536000; includeSubDomains, max-age=15724800; includeSubDomains",
"X-Cs-Region": "us-1",
"X-Cs-Traceid": "e34014a6-f91a-4026-918a-865d0c6b2ff8",
"X-Ratelimit-Limit": "6000",
"X-Ratelimit-Remaining": "5999"
},
"body": {
"meta": {
"query_time": 1.270521674,
"powered_by": "falconx-api",
"trace_id": "e34014a6-f91a-4026-918a-865d0c6b2ff8",
"quota": {
"total": 500,
"used": 56,
"in_progress": 1
}
},
"resources": null,
"errors": []
}
}This issue seems to be isolated to files detonated in the Windows10 sandbox, when files are detonated in the Ubuntu sandbox the response from sandbox.get_reports() seems to be OK (in that i get details of the detonation and associated IoCs). Example trace-id of submission that returns correct response is "e7e86000-f462-4166-a485-5febfd065c89" The same code has worked earlier today, and the same code is being used for Windows and Ubuntu detonations so this makes me suspect it may be a bug? Is anyone else experiencing this issue? |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 4 replies
-
|
Hi @philldtaylor! I'll try and recreate this. Anything special about the file being detonated in the Windows 10 sandbox? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @jshcodes Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Here's what I've done so far.
|
Beta Was this translation helpful? Give feedback.
-
|
Pull Request #524 is published and will merge to main shortly. You can grab the version from the |
Beta Was this translation helpful? Give feedback.
-
Merged! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @jshcodes, I attempted to run the falconx_scan_example.py however i got an error on line 225 as per below: FLARE 17/01/2022 10:25:33 I think the issue might be with the '%v' in strftime? If i change that to '%V' i get the response below: FLARE 17/01/2022 10:54:26 Interesting strings Source: Process Commandline Type: Ansi Source: Runtime Data Type: Unicode Source: Runtime Data Type: Unicode Source: Runtime Data Type: Unicode Source: Runtime Data Type: Unicode Verdict: malicious |
Beta Was this translation helpful? Give feedback.
-
|
Line #255 of that sample calls Can I see an example of your code? I've been unable to recreate an instance of the API returning an empty resource branch for this call, but I've been mostly using the sample code to test, I might not be matching what you're executing. |
Beta Was this translation helpful? Give feedback.
-
|
Follow up: Will be posting a fix for the time format call on line #225. You're correct this should be a |
Beta Was this translation helpful? Give feedback.
-
|
Hi @jshcodes, Thanks for the above. I hadn't noticed that your sample used get_reports. I used some of your sample above to rework the code i was using and it turns out there was a race condition that was causing issues with some of the report ids. Once i solved the race condition i seem to be getting consistent results. Thanks for your help. Thanks |
Beta Was this translation helpful? Give feedback.
Here's what I've done so far.