topic Re: Futur update of this TA to work with OAuth2-based in All Apps and Add-ons

Future update of this TA to work with OAuth2-based

FloSwiip — Sat, 06 Jun 2020 18:34:32 GMT

Hello,

This TA is using only the deprecated legacy key-based APIs access
Based on your last CS communication, the end date for this kind of access is the October 29th, 2020
Are you planning to update this TA accordingly or it is going to be abandoned and removed from splunkbase ?

Thank you for your support

Re: Futur update of this TA to work with OAuth2-based

knobster — Fri, 08 May 2020 15:24:15 GMT

There will be a OAuth2 version very soon. It's currently being tested.

Re: Futur update of this TA to work with OAuth2-based

javanzato — Wed, 27 May 2020 16:42:13 GMT

Any update on this?

Re: Futur update of this TA to work with OAuth2-based

dileep_ey — Wed, 03 Jun 2020 10:48:51 GMT

Any update on new CrowdStrike Supports OAuth2 based authentications.?

Re: Futur update of this TA to work with OAuth2-based

knobster — Wed, 03 Jun 2020 14:17:03 GMT

Nothing yet. The team is testing it currently but should be released in late July.

Re: Futur update of this TA to work with OAuth2-based

javanzato — Wed, 03 Jun 2020 18:00:42 GMT

Will the new version support Splunk 7.2/7.3?

Re: Future update of this TA to work with OAuth2-based

yeahnah — Thu, 25 Jun 2020 06:04:21 GMT

A see a CrowdStrike Falcon Event Streams Technical Add-On has just been released with oAuth support and is the replacement for CrowdStrike Falcon Endpoint Add-on.

https://splunkbase.splunk.com/app/5082/#/overview

However, it states only version 8 compatibility at the moment, which I hope is just due to the fact they have not tested against older versions yet.

Re: Future update of this TA to work with OAuth2-based

FloSwiip — Fri, 17 Jul 2020 08:21:49 GMT

Hello,

Yes same remark about the splunk 8+ only

I just tried it on a splunk heavy forwarder running version 7.3.6 and I am getting the following error

2020-07-14 16:17:48,687 ERROR pid=22745 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/ta_crowdstrike_falcon_event_streams/aob_py2/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/crowdstrike_event_streams.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/input_module_crowdstrike_event_streams.py", line 321, in collect_events crowdstrike_client() File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/input_module_crowdstrike_event_streams.py", line 189, in crowdstrike_client token_result, token_message, token_url= Stream().get_token(clientid, secret, api_endpoint, proxy) TypeError: 'NoneType' object is not iterable

Edit: I have the same failure with splunk 8.0.4.1and the default setting of python in the server.conf
~~python.version = python2~~ 🤔

Edit2: Still the same error with
~~python.version = python3~~ 😓

Edit3: Ok I have regenerated my api credential and it was the reason of the error ( really bad catch )
Now it is spamming an offset errors but maybe it is normal

2020-07-15 07:46:14,342 INFO pid=15876 tid=Thread-1 file=base_modinput.py:log_info:295 | Event Written 2020-07-15 07:46:14,342 ERROR pid=15876 tid=Thread-1 file=Stream_Attributes.py:record_offsets:116 | Failed to record offsets to offsets file. 2020-07-15 07:46:14,376 INFO pid=15876 tid=Thread-1 file=base_modinput.py:log_info:295 | Offset recording to KV store: XXXX_Detections_feed_num_0 {u'https://firehose.crowdstrike.com/sensors/entities/datafeed/v1/0?appId=splunk_qualif': XXXXX}

Edit4:
For the error in edit3, it is the creation of an empty dir in TA-crowdstrike-falcon-event-streams/bin/offsets that is missing, so python is failing to manage files here.
Note that is app is deployed, it is important to add it to the exclusion to not loose its contain