falcon.query_devices_by_filter results in IndexError: list index out of range

[Wulluby]

Hello,

I am using Python 3.10.6 to run an example given here, https://falconpy.io/Usage/Falcon-Query-Language.html.

I substitute the client id, secret and hostname but I find I am getting an index error in return:
IndexError: list index out of range

I also notice that this runs quite slowly, the authentication takes close to a minute whereas I can normally authenticate to API in single digit seconds.

Would be grateful if anyone had any pointers on what I might be missing to make this work.

Thanks in advance

Usage example
This example will retrieve the first AID returned for any host with a hostname property starting with our search string.

from falconpy.hosts import Hosts

falcon = Hosts(client_id="CLIENT_ID_HERE",
               client_secret="CLIENT_SECRET_HERE"
               )

hostname = "search-string"

aid = falcon.query_devices_by_filter(
                    filter=f"hostname:'{hostname}*'"
                    )["body"]["resources"][0]

print(aid)

[jshcodes]

This list index out of range error is due to our not returning a match for the search filter (specified above as search-string). Since the follow up call doesn't check the contents of the resources array, when it tries to pull the first record of an empty array, it throws an error. Try adjusting this to a simple hostname pattern that matches your environment and post us the filter you tried here if it still isn't working. (If you're trying for an exact match on hostname, remove the wildcard.)

The login delay is not something we've heard before, authentication happens within a second typically. Can you provide us more detail regarding your environment? Are you passing any environment configuration parameters (such as proxy) to the Service Class when you instantiate it? Does this delay still occur if you try it from a different machine / network location?

[jshcodes]

The first issue may be a problem with the logic of the sample code. It assumes a wildcard match. If you remove the wildcard from the f-string for the filter keyword, does it return a match?

Same error:

aid = falcon.query_devices_by_filter(
... filter=f"hostname:'{hostname}'"
... )["body"]["resources"][0]
Traceback (most recent call last):
File "", line 1, in
IndexError: list index out of range

Can we see a sample of what the search string value is set to? (Feel free to obfuscate characters a bit, just looking for something to jump out.) I'm going to put together an expanded version of this for you to try in the interim.

[Wulluby]

Same delay when using base_url, took about a minute.

[Wulluby]

It would be difficult for me to post anything resembling the string on a public forum

[jshcodes]

If you open a support ticket and reference this GitHub post they can assist with getting us in direct contact.

For now, try this sample, you can specify the search string dynamically via the command line:
python3 question-752.py -k CLIENT_ID_HERE -s CLIENT_SECRET_HERE -f SEARCH_STRING_HERE

Try a few different variations of your search string (trim it down to be really expansive and then slowly refine. I'm curious if this is somehow an issue with the search string itself...)

from falconpy import Hosts
from argparse import ArgumentParser
from falconpy import Hosts


parser = ArgumentParser(description="Quick example")
parser.add_argument("-k", "--falcon_client_id",
                    help="CrowdStrike Falcon API ID", required=True)
parser.add_argument("-s", "--falcon_client_secret",
                    help="CrowdStrike Falcon API Secret", required=True)
parser.add_argument("-f", "--find",
                    help="Hostname to find", required=True)

args = parser.parse_args()

falcon = Hosts(client_id=args.falcon_client_id,
               client_secret=args.falcon_client_secret
               )

aid_search = falcon.query_devices_by_filter(
                    filter=f"hostname:'{args.find}*'"
                    )

if aid_search["status_code"] != 200:
    raise SystemExit("Unexpected status code received: %s", aid_search["status_code"])

if aid_search["body"]["resources"]:
    returned = aid_search["body"]["resources"]
    ret_len = len(returned)
    print(f"{ret_len} match{'es' if ret_len > 1 else ''} found")
    for host in returned:
        print(f"Matched host AID: {host}")

[jshcodes]

Same delay when using base_url, took about a minute.

I'm going to try and recreate this. 🤔 Let us know if you get better speeds from your office location.

[Wulluby]

I think you can close this Josh, I think this is something at our end