Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] Import-FalconConfig only creates Script for a single platform #447

Open
bk-cs opened this issue Jan 15, 2025 · 1 comment
Open
Assignees
Labels
bug Something isn't working fix available Self-applied fix available in issue

Comments

@bk-cs
Copy link
Collaborator

bk-cs commented Jan 15, 2025

Describe the bug
Import-FalconConfig is not properly comparing Script files across multiple platform values because it checks the target CID for platform values before comparison. If the target CID does not have any Script files, or they are limited to a single platform, the Script files in the import that don't match the available platform values won't be evaluated for creation or modification.

To Reproduce
Use Import-FalconConfig with a Script file for import, targeting a CID that has no Script files in it currently, or only Script files for a single operating system.

This behavior could manifest in other import types as well, but was reproducible for Script files.

Expected behavior
Each possible operating system should be checked for creation.

Environment

  • PSFalcon: 2.2.8
@bk-cs bk-cs added the bug Something isn't working label Jan 15, 2025
@bk-cs bk-cs self-assigned this Jan 15, 2025
bk-cs added a commit that referenced this issue Jan 15, 2025
Corrected `Compare-ImportData` code under `Import-FalconConfig` to check both target CID and import files for possible `platform` values and ensure that `Script` (and other imports) check all available `platform` values.
@bk-cs bk-cs added the fix available Self-applied fix available in issue label Jan 15, 2025
@bk-cs
Copy link
Collaborator Author

bk-cs commented Jan 15, 2025

A fix has been added for the next PSFalcon release. If you'd like to resolve it for your local module before release, you can replace public\psf-config.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/378fde6d06aca2b06610ddfe1c31a6462237f620/public/psf-config.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) psf-config.ps1)

Please ensure that you close and re-open PowerShell and re-import PSFalcon before testing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working fix available Self-applied fix available in issue
Projects
None yet
Development

No branches or pull requests

1 participant