Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] Edit-FalconDeviceControlPolicy does not retain exception descriptions when adding additional exceptions #306

Open
harrim4n opened this issue May 5, 2023 · 2 comments
Assignees
Labels
bug Something isn't working

Comments

@harrim4n
Copy link

harrim4n commented May 5, 2023

Describe the bug
When adding a new exception to a device policy which includes a description, the description of already existing exceptions is cleared.

To Reproduce
I used a script which basically does the same as the sample file: https://github.com/CrowdStrike/psfalcon/blob/7976423c1e67eadfc5b829862f64eed3194a854a/samples/policies/add-a-list-of-combined_id-exceptions-to-a-device-control-policy.ps1
In line 26, add the "description" parameter and set it to some string (multiline in my case, not sure if relevant).

Expected behavior
The existing exceptions should not be modified

Environment (please complete the following information):

  • OS: Debian 11
  • PowerShell: 7.3.3
  • PSFalcon: 2.2.4

Additional context

Transcript content

@harrim4n harrim4n added the bug Something isn't working label May 5, 2023
@bk-cs
Copy link
Collaborator

bk-cs commented May 5, 2023

Thank you for the report! I was able to re-create this behavior. I suspect this is API related and not restricted to Edit-FalconDeviceControlPolicy. Here's why I think that:

  • The script example you provided does not modify existing exceptions, it only adds new ones
  • Modifying the script to add a description with the new exception still erases any existing descriptions

I'll investigate further and see if I can get an internal issue opened to get it fixed.

@bk-cs bk-cs changed the title [ BUG ] Edit-FalconDeviceControlPolicy deletes descriptions of existing exceptions [ BUG ] Edit-FalconDeviceControlPolicy does not retain exception descriptions when adding additional exceptions May 5, 2023
@bk-cs
Copy link
Collaborator

bk-cs commented May 10, 2023

I have confirmed that this is an API issue and not restricted to PSFalcon. I've opened an internal ticket requesting a fix and I'll leave this issue open until I receive confirmation that it is resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants