SampleUploads API - getting 403 when trying to download a sample

[jkozlowicz]

Hi,
I have been working on building an integration with CrowdStrike for my client who joined CrowdStrike's Partner Program and I've run into some technical issues. Namely, I get an authorization error (HTTP 403) when trying to download a sample by sending a request to this endpoint:

GET /samples/entites/samples/v3?file_ids=<sha256>&password_protected=false

Before doing that I upload samples by calling the following endpoints:

• POST /real-time-response/combined/batch-get-command/v1
• GET /real-time-response/combined/batch-get-command/v1

These two work without any problems and they return sha256 ids of the samples that I want to download. I also ssh-ed into the target hosts and double checked that the files, which get uploaded, are in place. The files are gzip files with the .cst.gz extension.

But the download using this endpoint:
GET /samples/entites/samples/v3?file_ids=<sha256>&password_protected=false

always fails, even though I am 100% sure that I use the very same OAuth token and that I had uploaded the samples to CrowdStrike before. I'd expect to get HTTP 400 if there was something wrong with the request or HTTP 404 if the sample to be downloaded didn't exist, but I get HTTP 403.

Is it possible that the SampleUploads API is not enabled for us? I am using a freshly created API client with all the possible OAuth Scopes selected. This looks strange as ALL the other REST endpoints that I needed to use work properly.

[jshcodes]

Hi @jkozlowicz -

Thank you for the question!

API operations mentioned above:

GetSampleV3 (GET, /samples/entities/samples/v3) [Sample Uploads]
BatchGetCmd (POST, /real-time-response/combined/batch-get-command/v1) [Real Time Response]
BatchGetCmdStatus (GET, /real-time-response/combined/batch-get-command/v1) [Real Time Response]

To retrieve files uploaded to a cloud session via Real Time Response, you will need to leverage the RTR_GetExtractedFileContents operation instead (these files are not stored in the Falcon Intelligence Sandbox).

An example of this can be found in this sample.

Let us know if you run into problems. 😄

[jkozlowicz]

Hi @jshcodes,
thank you for the prompt reply!

I will check if that works.

EDIT: Download worked, but the file is password protected. This wasn't mentioned in the API. I tried infected, but it doesn't work.

There was no option to provide a password to:

• BatchGetCmd (POST, /real-time-response/combined/batch-get-command/v1) [Real Time Response]
• or /real-time-response/entities/extracted-file-contents/v1

Where do I get the password from?

Could you please help me understand what the difference between getting files from remote hosts via RTR vs Sample Uploads is? Is it that Sample Uploads API is meant for uploading files to be submitted to CrowdStrike for analysis [part of the Falcon Intelligence Sandbox] vs RTR for retrieving any, arbitrary files?

And one more question, does the session_id expire?

[jshcodes]

Hi @jkozlowicz -

Are you using 7zip? Here's an example that demonstrates downloading / extracting a file from a Real Time Response session using 7zip. This password should be infected like you tried previously.

Files retrieved with BatchGetCmd are only available for the specific RTR session in question. These files are removed after 7 days and are not uploaded for retrieval until requested using a get request on the endpoint.

The session_id expires based upon the timeout specified when you call RTR_InitSession. If not specified, the default timeout is 30 seconds. To "reset" this time and extend the timeout, leverage the RTR_PulseSession operation.

Let us know if you have more questions. 😄

[jkozlowicz]

Hi @jshcodes,
the Python 7zip library with the provided example worked like a charm.

Thanks again and feel free to close this issue.