Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] GraphQL operation does not support variables when using abstracted keywords (IdentityProtection) #902

Closed
jshcodes opened this issue Feb 1, 2023 · 0 comments · Fixed by #903
Assignees
Labels
API usage General API usage issues and questions bug 🐛 Something isn't working identity protection Identity Protection issues and questions SDK usage General SDK usage issues and questions

Comments

@jshcodes
Copy link
Member

jshcodes commented Feb 1, 2023

Describe the bug
When working with the GraphQL operation, you are unable to provide variables to the processor without leveraging the body keyword. variables needs to be added to this method as an allowed keyword.

To Reproduce
See additional context below.

Expected behavior
Variables can be provided to GraphQL without having to leverage the body keyword.

Environment (please complete the following information):

  • OS: All supported
  • Python: All supported
  • FalconPy: <= 1.2.10

Additional context

Thanks go out to @cl6227 for identifying and reporting this issue!

Discussed in #901

Originally posted by cl6227 January 31, 2023
Is there a way to use GraphQL queries that paginate? I'd like a report that returns more than 1000 results (the limit without paginating).

I'm using IdentityProtection / falcon.graphql: https://github.com/CrowdStrike/falconpy/wiki/Identity-Protection

The response object contains 'hasNextPage' and 'endCursor' values to obtain the next page of results. How can I use this information to gather the next page of data?

response["body"]["data"]["entities"]["pageInfo"]["hasNextPage"] = True
response["body"]["data"]["entities"]["pageInfo"]["endCursor"] = eyJfaWQiOiIwMDAwdWJiOS01YzQxLTRmNzctODhmNy02MWFjOGQ1ZDViNztifQ==

An example graphql query that has pagination enabled is below. You'll note that I only have 'first' set to 2 so the output response is small and can be easily read for troubleshooting. However with pagination enabled, it should repeat batches of 2 results until all results have been obtained. Normally 'first' would be set to 1000.

    idp_query = """
      query ($after: Cursor, $enabled: Boolean)
  {
  entities(types: [USER]
    archived: false
    enabled: $enabled
    after: $after
    first: 2
    dataSources: [ACTIVE_DIRECTORY]) {
    nodes {
            primaryDisplayName
            secondaryDisplayName
            riskScoreSeverity
            riskFactors {
              type
              severity
            }
            isHuman: hasRole(type: HumanUserAccountRole)
             isProgrammatic: hasRole(type: ProgrammaticUserAccountRole)
             roles {
              fullPath
              probability
            }
            accounts {
              description
              ... on ActiveDirectoryAccountDescriptor{
                passwordAttributes{
                  lastChange
                }
                creationTime
                objectSid
                samAccountName
                domain
                enabled
                ou
                lastUpdateTime
                department
                servicePrincipalNames
                upn
                dn
                title
                userAccountControl
                objectGuid
              }
            }
        }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
  }
  """

falconpy 1.2.8
Python 3.9.2
OS Win 2012 R2

@jshcodes jshcodes added the bug 🐛 Something isn't working label Feb 1, 2023
@jshcodes jshcodes self-assigned this Feb 1, 2023
@jshcodes jshcodes added API usage General API usage issues and questions SDK usage General SDK usage issues and questions labels Feb 1, 2023
@jshcodes jshcodes added the identity protection Identity Protection issues and questions label Feb 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
API usage General API usage issues and questions bug 🐛 Something isn't working identity protection Identity Protection issues and questions SDK usage General SDK usage issues and questions
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant