Splunk Search

Crowdstrike TA error

warrenkobalt
New Member

Hi,

Running into this error trying to setup the Streaming API:

04-03-2020 11:37:21.473 +0000 INFO  TcpOutputProc - Connected to idx=3.225.177.214:9997, pset=0, reuse=0.
04-03-2020 11:37:34.438 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':  Traceback (most recent call last):
04-03-2020 11:37:34.438 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/bin/runScript.py", line 78, in <module>
04-03-2020 11:37:34.438 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      execfile(REAL_SCRIPT_NAME)
04-03-2020 11:37:34.438 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike_rh_falcon_host_accounts.py", line 136, in <module>
04-03-2020 11:37:34.438 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      admin.init(base.ResourceHandler(Servers), admin.CONTEXT_APP_AND_USER)
04-03-2020 11:37:34.438 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 130, in init
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      hand.execute(info)
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 593, in execute
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      if self.requestedAction == ACTION_CREATE:   self.handleCreate(confInfo)
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/base.py", line 253, in handleCreate
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      args = self.encode(self.callerArgs.data)
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/base.py", line 299, in encode
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      args = self.validate(args)
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/base.py", line 659, in validate
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      logLevel=logging.INFO)
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/error_ctl.py", line 150, in ctl
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      raise BaseException(err)
04-03-2020 11:37:34.439 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':  BaseException: REST ERROR[1100]: Unsupported value in request arguments - Authorization Failed! Please verify API UUID and API Key of Streaming API - field=api_key
04-03-2020 11:37:34.450 +0000 ERROR AdminManagerExternal - External handler failed with code '1' and output: 'REST ERROR[1100]: Unsupported value in request arguments - Authorization Failed! Please verify API UUID and API Key of Streaming API - field=api_key'.  See splunkd.log for stderr output.
04-03-2020 11:37:40.640 +0000 WARN  TcpOutputProc - Cooked connection to ip=52.22.200.180:9997 timed out
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':  Traceback (most recent call last):
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/bin/runScript.py", line 78, in <module>
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      execfile(REAL_SCRIPT_NAME)
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike_rh_falcon_host_accounts.py", line 136, in <module>
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      admin.init(base.ResourceHandler(Servers), admin.CONTEXT_APP_AND_USER)
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 130, in init
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      hand.execute(info)
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 593, in execute
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      if self.requestedAction == ACTION_CREATE:   self.handleCreate(confInfo)
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/base.py", line 253, in handleCreate
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      args = self.encode(self.callerArgs.data)
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/base.py", line 299, in encode
04-03-2020 11:37:51.207 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      args = self.validate(args)
04-03-2020 11:37:51.208 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/base.py", line 659, in validate
04-03-2020 11:37:51.208 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      logLevel=logging.INFO)
04-03-2020 11:37:51.208 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':    File "/opt/splunk/etc/apps/TA-crowdstrike/bin/ta_crowdstrike/splunktaucclib/rest_handler/error_ctl.py", line 150, in ctl
04-03-2020 11:37:51.208 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':      raise BaseException(err)
04-03-2020 11:37:51.208 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py execute':  BaseException: REST ERROR[1100]: Unsupported value in request arguments - Authorization Failed! Please verify Username and Password of Query API - field=api_key
04-03-2020 11:37:51.219 +0000 ERROR AdminManagerExternal - External handler failed with code '1' and output: 'REST ERROR[1100]: Unsupported value in request arguments - Authorization Failed! Please verify Username and Password of Query API - field=api_key'.  See splunkd.log for stderr output.

Any ideas would be welcome.

Cheers
W

0 Karma

tsullivan06
Explorer

The CrowdStrike Streaming API TA uses their legacy API creds which use certificate pinning. That error typically means that something is getting in the way of the communication between Splunk and the API endpoint. This is probably something like a proxy. If the proxy is actively proxying that connection then CrowdStrike's API gateway will reject that authentication because it's essentially a MIM attack.

You should make sure that you have an exception (whitelist) in any network devices that the connection will traverse so that that doesn't happen.

0 Karma

cmerriman
Super Champion

do you have valid creds? the last line mention that the authorization failed and to verify the username and password for the api.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...