why i got 400???

[NSH531]

code:

@app.route("/hosts/last_seen")
def hst():
    #F1=falconpy
    #rr=struct_time()
    #rr.tm_hour=23
    #F= falconpy.APIHarness(client_id=client_id,client_secret=secret)
    #id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']
    #response = F1.Hosts(client_id=client_id,client_secret=secret)
    d=datetime.datetime.fromtimestamp((datetime.datetime.now().utcnow().timestamp()-86400*1.4)).isoformat()
    
#    F.command()
   # lasts=response.query_devices_by_filter(sort="hostname.asc")
  #  return response.query_devices_by_filter(filter=f"hostname:{myid}*")
#.QueryDevicesByFilter(filter=f"host:{myid}*")
                         # )
    j=json2html.Json2Html
#f.close()
 #   hostname_result = hosts.query_devices_by_filter(filter=f""
    response = dict(a=falconpy.APIHarness(client_id=client_id,client_secret=secret).command("GetDeviceDetails", ids=['DEVICE_ID_1','DEVICE_ID_2']),b= falconpy.APIHarness(client_id=client_id,client_secret=secret).command("getHostGroups", ids=['DEVICE_ID_2']))
    t=response["b"]
    t=falconpy.APIHarness(client_id=client_id,client_secret=secret).command("getHostGroups", ids=response["a"]["body"]["resources"][0]["groups"])
    j=falconpy.APIHarness(client_id=client_id,client_secret=secret).command("query_hosts",filter='DEVICE_ID_1')
    return dict(groups_data=t["body"]["resources"],hosts=response["a"],c=x(response))
@app.route("/AA/SS")
def x():
    
    reGsponse = falconpy.APIHarness(client_id=client_id,client_secret=secret).command("QueryDetects",
                           
                        
                          q=response["a"]["body"]["resources"][0]["device_id"]
                          )
    #last_seen_result = falconpy.Hosts.get_device_details(ids=['DEVICE_ID_1'])
    #falconpy.OAuth2(client_id=client_id,client_secret=secret)
    R=list()
    t=list()
    for i in reGsponse["body"]["resources"]:
        R.append(i)
        t.append(falconpy.APIHarness(client_id=client_id,client_secret=secret).command("GetDetectSummaries", body=dict(BODY=i)))
    return dict(LEN=len(R),alerts=dict(a=R,d=t[0]["body"]))
#falconpy.host_group.HostGroup.query_combined_group_members(creds=dict(client_id=client_id,client_secret=secret))

#    return 
    #return dict(last_seen_result)
#response.get_device_details(ids=list(lasts["body"]["resources"]))

   #  response
  #  ret
   
 #response = F.command("GetDeviceDetails", ids=[myid])
  #  return dict(response)
@app.route("/csv")
def dow():
        return pd.read_json('http://localhost:8080/AA/SS').to_html()

[jshcodes]

Hi @NSH531 -

Could you provide us the error response and a little more detail regarding what you're trying to return? (It appears to be a dictionary containing the full result from multiple API operations.)

Just guessing, but I expect one of the payloads is malformed, potentially this one:

j=falconpy.APIHarness(client_id=client_id,client_secret=secret).command("query_hosts",filter='DEVICE_ID')

The correct syntax for this filter would be:

j=falconpy.APIHarness(client_id=client_id,client_secret=secret).command("query_hosts",filter="device_id:'DEVICE_ID'")

It also appears we are repeatedly recreating the Uber Class object, this shouldn't be required and is round tripping to the API unnecessarily.

I've redacted the AIDs from your previous post. Don't forget to obfuscate these when posting (discussion post guidelines).