download_sensor.py no longer working for "RHEL/CentOS Stream/Oracle"

[TM-JBEE]

Describe the bug
When specifying RHEL/CentOS Stream/Oracle as OS, the following error occurs:

Invalid operating system specified.
Allowed values: rhel, centos, oracle, rhel/centos/oracle, mac, macos, apple, amzn, az, amazon, amazon linux, ubuntu, kali, deb, debian, sles, suse, win, windows, microsoft, container, docker, kubernetes, idp, identity, identity protection

This happens since the changes introduced in 1188.

To Reproduce

1. Download the download_sensor.py script
2. Execute the script python3 download_sensor.py -n 1 -k "${CROWDSTRIKE_CLIENT_ID}" -s "${CROWDSTRIKE_CLIENT_SECRET}" -o "RHEL/CentOS Stream/Oracle" -v "9" -n 1 -d

Expected behavior
Before the changes introduced in 1188, this resulted in a falcon-sensor-7.19.0-17219.el9.x86_64.rpm download.
I would expect this to still work since this file is also available for download through the Falcon dashboard.

Environment (please complete the following information):

• OS: macOS 15/Debian 12
• Python: 3.9.6 / 3.12.8
• FalconPy: 1.4.6

[jshcodes]

Hi @TM-JBEE!

The previous version of this sample would perform a download even if the specified operating system did not match the lookup. While this worked for some scenarios, for others it created confusion by executing the query for the download without an operating system filter.

If you update your script execution command to be: python3 download_sensor.py -n 1 -k "${CROWDSTRIKE_CLIENT_ID}" -s "${CROWDSTRIKE_CLIENT_SECRET}" -o "RHEL/CentOS/Oracle" -v "9" -n 1 -d do you get the correct result?

Thank you for the question! 😄

[TM-JBEE]

Hi @jshcodes,

Thank you for getting back to me!

Using the updated command, I no longer get the error message.
However, it still does not download the rpm file. The script just exits normally.

[jshcodes]

Hi @TM-JBEE -

Think I found it. If we remove the -d and try this command (i.e. "list sensors for this operating system and operating system version"), we get a blank result instead of a list of available sensors.

This is a bug, you should be shown an error message telling you this version is not available. This issue was present before we resolved #1188, it was just hidden by the "default download" behavior that was implemented before. I will create a ticket to get this issue resolved. Thank you for reporting this! 🙇

To avoid this issue, we need to request the appropriate version. We are asking for version "9" when the highest version available is version "8". We can confirm this by executing the command without the version specifier and download argument.

Get a list of available sensors for this operating system

python3 download_sensor.py -n 1 -k "${CROWDSTRIKE_CLIENT_ID}" -s "${CROWDSTRIKE_CLIENT_SECRET}" -o "RHEL/CentOS/Oracle" -n 1

If we update our command arguments to specify version "8", we should download the sensor successfully.

python3 download_sensor.py -n 1 -k "${CROWDSTRIKE_CLIENT_ID}" -s "${CROWDSTRIKE_CLIENT_SECRET}" -o "RHEL/CentOS/Oracle" -v "8" -n 1 -d

Does this updated command work properly for you?

[TM-JBEE]

Hi @jshcodes,

I understand that there is a bug that causes the download to fail silently.
When downloading version 8 using:

python3 download_sensor.py -n 1 -k "${CROWDSTRIKE_CLIENT_ID}" -s "${CROWDSTRIKE_CLIENT_SECRET}" -o "RHEL/CentOS/Oracle" -v "8" -n 1 -d

I get the expected file for version 8 of the OS: falcon-sensor-7.19.0-17219.el8.x86_64.rpm

However, we are using version 9 of the OS which has a specific RPM file: falcon-sensor-7.19.0-17219.el9.x86_64.rpm
This is the file you get when downloading the package through the Falcon web interface when selecting RHEL/CentOS Stream/Oracle - 9 and also when using the previous version of the script.

Could you please look further into this change in behavior?

[jshcodes]

Hi @TM-JBEE -

This is occurring due to changes in the available operating system names available for download. Some of these variations overlap, which conflicted with the values available in the operating system list lookup. (Example: RHEL/CentOS/Oracle vs. RHEL/CentOS Stream/Oracle vs. RHEL/CentOS vs. RHEL)

We've updated the sample to speak to these new variations, this will merge to main sometime this week. (You can download this version from the samples branch before it merges.)

In order to download the sensor version mentioned with the updated sample we will need to use either rhel/centos stream/oracle, centos stream or stream as the OS name (-o) filter.

Example:

python3 download_sensor.py -n 1 -k "${CROWDSTRIKE_CLIENT_ID}" -s "${CROWDSTRIKE_CLIENT_SECRET}" -o "RHEL/CentOS Stream/Oracle" -v "9" -n 1 -d

Thank you for identifying and reporting this issue! 😄

[TM-JBEE]

Hi @jshcodes,

This update indeed fixes the issue. Thank you for resolving it!

[TM-JBEE]

Hi @jshcodes,

Any updates on the merge to main?

[jshcodes]

Hi @TM-JBEE -

This PR has merged. Thank you for your patience! 🙇