403 Forbidden Error When Using Falcon Discover API with FalconPy

[joseraeiro]

Hello FalconPy Community,

I am encountering an issue with the Falcon Discover API when using FalconPy and was hoping for some guidance or suggestions on how to resolve it.

Issue Description:
I have developed a Flask application that receives JSON data from a webhook and then uses FalconPy to interact with the Falcon Discover API. The application attempts to retrieve the MEMBER_CID for a given device_id. However, I am receiving a 403 Forbidden error during this process.

Code Snippet:
Below is the relevant part of my code where I'm facing the issue:

def get_hosts(device_id, client_id, client_secret):

    falcon = Discover(client_id=client_id, client_secret=client_secret)
    logging.info("Attempting to retrieve MEMBER_CID for device_id: %s", device_id)
    response = falcon.get_hosts(ids=device_id)
    logging.info("Resposta do Endpoint Discover: %s", response)  # For debugging purposes

    # Extract the MEMBER_CID from the response
    try:
        member_cid = response["resources"][0]["cid"]
        return member_cid
    except (KeyError, IndexError):
        # Handle the case where the response does not contain the expected data
        logging.error("Unable to retrieve MEMBER_CID from the response.")
        return None

@app.route('/webhook6', methods=['POST'])
def webhook():
    data = request.json  # Assuming the webhook sends data in JSON format
    logging.info("Dados recebidos: %s", data)

    # Extract relevant information from the webhook data
    target_location = data.get('data', {}).get('detections.file_path', "C:\\Users\\Administrator\\Desktop\\desktop.ini")
    device_id = data.get('data', {}).get('detections.sensor_id', "687012e06b904c918906e0a9534e651b")

    logging.info("Target location: %s, Device ID: %s", target_location, device_id)

    # The rest of your script goes here, using the extracted variables
    SHOW_API_RESPONSES = True               # Turn this off to disable debugging
    CLIENT_ID = ""
    CLIENT_SECRET = ""

    logging.info(f"Final command string: get {target_location}")

    member_cid = get_hosts(device_id, CLIENT_ID, CLIENT_SECRET)

Error Details:
Here's a snippet from my application logs showing the error:

2023-12-29 11:33:32 - INFO - root - Dados recebidos: {'data': {'detections.detection_id': 'ldt:bcbb00eac461488cbc4d5523844c8f48:193275784352', 'detections.file_path': '\\Device\\HarddiskVolume3\\ProgramData\\AvastSvcXoF\\AvastSvc.exe', 'detections.sensor_id': 'bcbb00eac461488cbc4d5523844c8f48'}, 'meta': {'event_reference_url': 'https://falcon.eu-1.crowdstrike.com/activity/detections/detail/bcbb00eac461488cbc4d5523844c8f48/193275784352?gcid=g050007je46qojorarnhml4slpk75s5u', 'timestamp': '2023-12-29T10:30:01Z', 'trigger_category': 'Detection', 'trigger_name': 'New detection', 'workflow_id': '668601c6e88e4deda18fe72b1451c06b'}}
2023-12-29 11:33:32 - INFO - root - Target location: \Device\HarddiskVolume3\ProgramData\AvastSvcXoF\AvastSvc.exe, Device ID: bcbb00eac461488cbc4d5523844c8f48
2023-12-29 11:33:32 - INFO - root - Final command string: get \Device\HarddiskVolume3\ProgramData\AvastSvcXoF\AvastSvc.exe
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CREATED: OAuth2 interface class
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Base URL set to https://api.crowdstrike.com
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: SSL verification is set to True
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Timeout set to None seconds
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Proxy dictionary: None
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: User-Agent string set to: None
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Token renewal window set to 120 seconds
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Maximum number of records to log: 100
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Log sanitization is enabled
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - CONFIG: Pythonic responses are disabled
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - OPERATION: oauth2AccessToken
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - ENDPOINT: https://api.crowdstrike.com/oauth2/token (POST)
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - HEADERS: {'User-Agent': 'crowdstrike-falconpy/1.3.3', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.3.3'}
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - PARAMETERS: None
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - BODY: None
2023-12-29 11:33:32 - DEBUG - falconpy._auth_object._falcon_interface - DATA: {'client_id': 'REDACTED', 'client_secret': 'REDACTED'}
2023-12-29 11:33:32 - DEBUG - urllib3.connectionpool - Starting new HTTPS connection (1): api.crowdstrike.com:443
2023-12-29 11:33:33 - DEBUG - urllib3.connectionpool - https://api.crowdstrike.com:443 "POST /oauth2/token HTTP/1.1" 308 0
2023-12-29 11:33:33 - DEBUG - urllib3.connectionpool - Starting new HTTPS connection (1): api.eu-1.crowdstrike.com:443
2023-12-29 11:33:34 - DEBUG - urllib3.connectionpool - https://api.eu-1.crowdstrike.com:443 "POST /oauth2/token HTTP/1.1" 201 1251
2023-12-29 11:33:34 - DEBUG - falconpy._auth_object._falcon_interface - RECEIVED: Content returned in application/json format
2023-12-29 11:33:34 - DEBUG - falconpy._auth_object._falcon_interface - STATUS CODE: 201
2023-12-29 11:33:34 - DEBUG - falconpy._auth_object._falcon_interface - RESULT: {'status_code': 201, 'headers': {'Server': 'nginx', 'Date': 'Fri, 29 Dec 2023 11:33:34 GMT', 'Content-Type': 'application/json', 'Content-Length': '1251', 'Connection': 'keep-alive', 'X-Cs-Region': 'eu-1', 'X-Cs-Traceid': '83b6fff5-283e-4357-bf7e-6c9c6c06452b', 'X-Ratelimit-Limit': '300', 'X-Ratelimit-Remaining': '298', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'}, 'body': {'access_token': 'REDACTED', 'expires_in': 1799, 'token_type': 'bearer'}}
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CREATED: Discover interface class
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Base URL set to https://api.eu-1.crowdstrike.com
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: SSL verification is set to True
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Timeout set to None seconds
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Proxy dictionary: None
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: User-Agent string set to: None
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Token renewal window set to 120 seconds
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Maximum number of records to log: 100
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Log sanitization is enabled
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - CONFIG: Pythonic responses are disabled
2023-12-29 11:33:34 - INFO - root - Attempting to retrieve MEMBER_CID for device_id: bcbb00eac461488cbc4d5523844c8f48
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - OPERATION: get_hosts
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - ENDPOINT: https://api.eu-1.crowdstrike.com/discover/entities/hosts/v1 (GET)
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - HEADERS: {'Authorization': 'Bearer REDACTED', 'User-Agent': 'crowdstrike-falconpy/1.3.3', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.3.3'}
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - PARAMETERS: {'ids': ['bcbb00eac461488cbc4d5523844c8f48']}
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - BODY: None
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - DATA: None
2023-12-29 11:33:34 - DEBUG - urllib3.connectionpool - Starting new HTTPS connection (1): api.eu-1.crowdstrike.com:443
2023-12-29 11:33:34 - DEBUG - urllib3.connectionpool - https://api.eu-1.crowdstrike.com:443 "GET /discover/entities/hosts/v1?ids=bcbb00eac461488cbc4d5523844c8f48 HTTP/1.1" 403 231
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - RECEIVED: Content returned in application/json format
2023-12-29 11:33:34 - ERROR - falconpy._service_class._base_service_class - ERROR: access denied, authorization failed
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - STATUS CODE: 403
2023-12-29 11:33:34 - DEBUG - falconpy._service_class._base_service_class - RESULT: {'status_code': 403, 'headers': {'Server': 'nginx', 'Date': 'Fri, 29 Dec 2023 11:33:34 GMT', 'Content-Type': 'application/json', 'Content-Length': '231', 'Connection': 'keep-alive', 'X-Content-Type-Options': 'nosniff', 'X-Cs-Traceid': '5c6e6e29-7bec-4390-a688-b5f3b30b9261', 'X-Ratelimit-Limit': '15', 'X-Ratelimit-Remaining': '14', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'}, 'body': {'meta': {'query_time': 1.35e-07, 'powered_by': 'crowdstrike-api-gateway', 'trace_id': '5c6e6e29-7bec-4390-a688-b5f3b30b9261'}, 'errors': [{'code': 403, 'message': 'access denied, authorization failed'}]}}
2023-12-29 11:33:34 - INFO - root - Resposta do Endpoint Discover: {'status_code': 403, 'headers': {'Server': 'nginx', 'Date': 'Fri, 29 Dec 2023 11:33:34 GMT', 'Content-Type': 'application/json', 'Content-Length': '231', 'Connection': 'keep-alive', 'X-Content-Type-Options': 'nosniff', 'X-Cs-Traceid': '5c6e6e29-7bec-4390-a688-b5f3b30b9261', 'X-Ratelimit-Limit': '15', 'X-Ratelimit-Remaining': '14', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'}, 'body': {'meta': {'query_time': 1.35e-07, 'powered_by': 'crowdstrike-api-gateway', 'trace_id': '5c6e6e29-7bec-4390-a688-b5f3b30b9261'}, 'errors': [{'code': 403, 'message': 'access denied, authorization failed'}]}}
2023-12-29 11:33:34 - ERROR - root - Unable to retrieve MEMBER_CID from the response.

Steps Taken:

• I have confirmed that the CLIENT_ID and CLIENT_SECRET are correct.
• I am using the EU endpoint (api.eu-1.crowdstrike.com), which matches my account registration.
• I've checked the permissions associated with the API credentials, and they appear to be in order.

Questions:

1. Are there any common pitfalls or known issues that could lead to a 403 error in this context?
2. Is there any additional configuration or setup required for Falcon Discover API access that I might have missed?
3. Any suggestions on what else I could check or try to resolve this issue?

Any help or guidance would be greatly appreciated. Thank you in advance!

[crowdstrikedcs]

Hi @joseraeiro thanks for the question!

Based on my understanding you're looking to understand the CID that a given Device resides in correct? If that's the case I'd be using the Hosts Service Collection over Discover and the get_device_details_v2 operation. Perhaps this is what you meant to use? While both can be used interchangeably for this use case, Discover assets do have a unique ID structure that needs to be met (CID is actually in the ID like <<CID_453909112320126947>). I just wanted to bring this up. Let me know with any questions.

Taking a look at the logs it looks like the API Client in use is imporperly scoped. Can you verify it has the Read permission on the Assets scope as seen here?

[joseraeiro]

@crowdstrikedcs , thank you very much for you helpful answer.

Indeed, using the Hosts service collection is a more straightforward way of obtaining the Member CID for a given device

Especially since using Discover apparently requires an additional license, and that was the reason for my 403 error.

The endpoint you've suggested works! Thanks again!