FileVantage's createScheduledExclusions requires 'timezone' field

[security-roberts]

I'm using https://www.falconpy.io/Service-Collections/FileVantage.html#createscheduledexclusions, but I keep getting: "field 'timezone' must be provided and be a valid timezone name. See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones". I've tried pretty much every variation I can imagine to try and specify my timezone, and it's just not accepting it. What is the actual "valid timezone name" format I need for this? Thanks!

• Also, I tried using #getScheduledExclusions to see if the timezone was some unique format, but it's just (in this case) Etc/UTC. I tried that exact string, and it still throws the same error.
• Also, also, yes, I tried it without the 'timezone' field first, because it wasn't listed in the falconpy.io page. The query errored saying the field was required, and that has lead me to this issue.

Test code that's not working:

response = falcon.createScheduledExclusions(policy_id="Test123",
name="Test1",
users="Test*",
processes="**\Test.exe",
schedule_start="2024-09-17T13:00:00-07:00",
schedule_end="2024-09-17T14:00:00-07:00",
timezone="Etc/UTC"
)

[crowdstrikedcs]

Hi @security-roberts thanks for the question!

Let's gather a bit of debug logging to understand what payload is being sent to the API.

Here is a sample of how to enable this at the Service Class level:

import logging
from falconpy import FileVantage

log = logging.basicConfig(level=logging.DEBUG)
falcon = FileVantage(client_id=CLIENT_ID, client_secret=CLIENT_SECRET, debug=True)

# You can use PEP8 or Operation ID syntax for this call
response = falcon.createScheduledExclusions(policy_id="Test123",
name="Test1",
users="Test*",
processes="**\Test.exe",
schedule_start="2024-09-17T13:00:00-07:00",
schedule_end="2024-09-17T14:00:00-07:00",
timezone="Etc/UTC"
)

Once enabled, logging messages will print to stdout. I'm interested in capturing:DEBUG:falconpy._service_class._base_service_class:BODY which will include a dictionary representing the payload sent to this operation.

When I run this on my system I see:
DEBUG:falconpy._service_class._base_service_class:BODY: {'name': 'Test1', 'policy_id': 'Test123', 'processes': '**\\Test.exe', 'schedule_end': '2024-09-17T14:00:00-07:00', 'schedule_start': '2024-09-17T13:00:00-07:00', 'users': 'Test*'}

You'll notice timezone is missing completely. Which is why the response contains a message indicating the field is not present. This appears to be an issue with how the operation handles keyword arguments. An immediate solution to this would be to override using the body parameter. I'm adding a key for policy_id here as well since it is required. Try this out and let us know how it works:

body_payload = {
    "name":"Test1",
    "policy_id": "XXX",
    "users":"Test*",
    "processes":"**\Test.exe",
    "schedule_start":"2024-09-17T13:00:00-07:00",
    "schedule_end":"2024-09-17T14:00:00-07:00",
    "timezone":"America/New_York"
}

response = falcon.createScheduledExclusions(body=body_payload)

[security-roberts]

Ah, yup. That bypass worked immediately. Thank you!

[crowdstrikedcs]

Good to hear, let me get this converted over to an issue and get it fixed. Thanks for the report :)