Why different results from ZTA using uber class or not?

[t0uxe]

Hi everyone,

I'm testing falconpy to get the ZTA values. But I get very different outputs, depending on if I use the Uber class or not. Please, could you explain me why?

Thank you.

[jshcodes]

Hi @t0uxe!

Can I see an example of the code you're using? (Please sanitize any API Key or AID values.) I'm not getting this result in my testing but this may be something to do with my test environment, so I'd like to confirm and then test in a couple of other CIDs.

Here's my current test script:

import json
from falconpy.api_complete import APIHarness as Uber
from falconpy.zero_trust_assessment import Zero_Trust_Assessment as ZTA
with open("config.json", "r") as cred_file:
    config = json.loads(cred_file.read())
creds = {
    "client_id": config["falcon_client_id"],
    "client_secret": config["falcon_client_secret"]
}
aid_to_check = "AID_GOES_HERE"
# Connect to the Uber class
falcon = Uber(creds=creds)
# Make the Uber call
uber_response = falcon.command('getAssessmentV1', ids=aid_to_check)
# Connect to the Service class
falcon = ZTA(creds=creds)
# Make the Service call
zta_response = falcon.getAssessmentV1(ids=aid_to_check)

# Compare our results - Metadata for Date, Query_Time and Trace_ID will always vary
# Drop the meta dictionary as we don't need the values for the comparison
uber_response["body"].pop("meta", None)
zta_response["body"].pop("meta", None)
# Headers also will vary and are unnecessary for the comparison, drop the entire dictionary
uber_response.pop("headers", None)
zta_response.pop("headers", None)
compare = ""
# Sort and compare the two dictionaries
if sorted(uber_response.items()) != sorted(zta_response.items()):
    compare = "do not "

print(f"Results from comparing both calls {compare}match")