get_detections_entities: #37430
Open
get_detections_entities: #37430
+6
−9
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
removed mentions of LEGACY_VERSION and the incorrect new API endpoint. /alerts/entities/alerts/v2 is for fetching alert details but this function is meant to fetch detection details. Corrected the argument description for cs-falcon-list-incident-summaries: ids this command fetches incident details and subsequently takes incident IDs, not detection IDs
removed mentions of LEGACY_VERSION and the incorrect new API endpoint. /alerts/entities/alerts/v2 is for fetching alert details but this function is meant to fetch detection details. list_detection_summaries_command: removed mentions of LEGACY_VERSION Corrected the argument description for cs-falcon-list-incident-summaries: ids this command fetches incident details and subsequently takes incident IDs, not detection IDs
…ct_summaries_fetching' into bdanjoux-crowdstrikefalcon-correct_summaries_fetching
removed mentions to LEGACY_VERSION
content-bot
added
Contribution
content-bot
changed the base branch from
master
to
contrib/bdanjoux_bdanjoux-crowdstrikefalcon-correct_summaries_fetching
|
Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @amshamah419 will know the proposed changes are ready to be reviewed. |
content-bot
added
Community
Contribution Form Filled
amshamah419
reviewed
Nov 25, 2024
Comment on lines
+1593
to
+1595
| ids_json = {'ids': detections_ids} | ||
| url = '/detects/entities/summaries/GET/v1' | ||
| demisto.debug(f"Getting detections entities from {url} with {ids_json=}.") |
There was a problem hiding this comment.
Hi @bdanjoux I'm not sure if we should remove the support for legacy version. Is there a specific issue you are experiencing?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Contributing to Cortex XSOAR Content
Make sure to register your contribution by filling the contribution registration form
The Pull Request will be reviewed only after the contribution registration form is filled.
Status
Related Issues
fixes: CASE 03318743
Description
The July commit f53aa87 related to then upcoming Crowdstrike Raptor release incorrectly updated the mechanism by which detection summaries are fetched.
The "legacy" API for fetching detection summaries: /detects/entities/summaries/GET/v1
was incorrectly amended to use /alerts/entities/alerts/v2 for clients who didn't tick the "legacy API" integration instance configuration boolean.
This was incorrect because the endpoint /detects/entities/summaries/GET/v1 is not deprecated in the CrowdStrike API documentation and also because /alerts/entities/alerts/v2 is for fetching alerts summaries, not detection summaries.
Subsequently, passing a valid detection id to an instance configured to use the new API endpoints fails when it works if you tick "use legacy API".
I removed mentions of LEGACY_VERSION and the incorrect new API endpoint.
I also corrected the argument description for cs-falcon-list-incident-summaries: ids
this command fetches incident details and subsequently takes incident IDs, not detection IDs
Must have