Replies: 1 comment 7 replies
-
|
Hi @nlee-462 thanks for the question! A 401 error will typically indicate that the client in use did not have the proper authorization to make the request. From my experience with correlation rules, this is sometimes due to the new rule having the CID present from the old CID. For example rule X from the parent CID has a column included in it for customer_id. If this is added to the child CID with the column unchanged for the target CID the operation is denied with a 401 error. I would recommend you check the rule before you add it to the target CID by printing it and checking this value. Updating it as needed. If may be useful as well to print the response text in addition to the status_code. As a a side note, the 'member_cid' parameter when provided to the OAuth2 service collection will let a clientid/secret pair perform actions in a child CID. This would allow you to perform operations from the parent API key without needing to create one in the child CID. Here is an example Let us know how things go. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello!
I'm utilizing an MSSP tenant to build a SOC in a Parent / Child architecture. I'm trying to use a Falconpy script to identify correlation rules in the parent tenant and then pass them down to a child tenant. Crowdstrike support informed that I would need to create a script to accomplish this. I have written a script, however it's getting an error 401 when trying to create the rule within the child. I have API's setup in both the parent and child. I have also confirmed the Client Secret and Client ID are correct for both environments and I have also ensured they have all read and write permissions for testing. I initially started with Falcon Console: Read, Write; Correlation Rules Read, Write. but later expanded permissions. Attached below is a copy of my script as well as the output I'm receiving:
Initializing parent tenant...
Fetched 200 parent rules.
--- Syncing rules to [CHILD TENANT NAME HERE] (https://api.us-2.crowdstrike.com) ---
Created (401): [Parent] Microsoft - Entra ID - Service Principal Anomalous PowerShell Usage (Synced)
/Users/[USER]/Documents/ParentRuleExport.py:158: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
"Timestamp": datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S UTC")
Created (401): [Parent] Microsoft - Entra ID - Potential Brute Force Attack through Azure Powershell (Synced)
Created (401): [Parent] Mimecast - Email Security - DLP Policy Violation for Outbound Message (Synced)
Created (401): [Parent] Microsoft - M365 SharePoint - Downloaded Files Added to Removable Storage (Synced)
Created (401): [Parent] Microsoft - Entra ID - Impossible Travel (Synced)
Created (400): [Parent] Mimecast - Email Security - Spam Message Delivered (Synced)
Created (400): [Parent] Mimecast - Email Security - Spam Message Delivered (Synced)
Created (401): [Parent] Zscaler - ZIA - Firewall Filtering Rule Deleted (Synced)
Created (401): [Parent] Microsoft - M365 Exchange Online - Email Forwarding Inbox Rule (Synced)
ParentRuleExportGithub.py
Beta Was this translation helpful? Give feedback.
All reactions