Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] Add Windows certificate-based machine learning exclusions to documentation and FalconConfig commands #436

Open
59e5aaf4 opened this issue Nov 21, 2024 · 2 comments
Assignees
Labels
enhancement New feature or request

Comments

@59e5aaf4
Copy link

( similar to CrowdStrike/falconpy#1252 :D )
Describe the bug

  • "Release Notes | Windows Certificate-Based Machine Learning Exclusions" was just published

These API endpoint ( below ) are not available through psfalcon, please implement :D ( notably in your fancy zip-based config migration code ) ( I don't need that, just pointing at parts that will likely explode :D )

What you can do Endpoint
Create a machine learning (certificate) exclusion POST /exclusions/entities/cert-based-exclusions/v1
Search for machine learning (certificate) exclusions GET /exclusions/queries/cert-based-exclusions/v1
Get detailed info about one or more machine learning (certificate) exclusions GET /exclusions/entities/cert-based-exclusions/v1
Update settings for an existing machine learning (certificate) exclusion PATCH /exclusions/entities/cert-based-exclusions/v1
Delete one or more machine learning (certificate) exclusions DELETE /exclusions/entities/cert-based-exclusions/v1
  • the ​/exclusions​/entities​/certificates​/v1 API endpoint which "Retrieves certificate signing information for a file" in the swagger doc which isn't in the release message. It accepts a sample sha256

To Reproduce

Read the documentation of psfalcon, there's no mention of the cert-based-exclusions API

Expected behavior

1/ it's documented
2/ it's implemented

:D

thanks !

@59e5aaf4 59e5aaf4 added the bug Something isn't working label Nov 21, 2024
@bk-cs bk-cs added enhancement New feature or request and removed bug Something isn't working labels Nov 22, 2024
@bk-cs
Copy link
Collaborator

bk-cs commented Nov 22, 2024

These endpoints were added in v2.2.7. See release notes.

  • Edit-FalconCertificateExclusion
  • Get-FalconCertificate
  • Get-FalconCertificateExclusion
  • New-FalconCertificateExclusion
  • Remove-FalconCertificateExclusion

They are not currently part of Import-FalconConfig or Export-FalconConfig and are not yet listed on the PSFalcon Wiki, but you can view their individual help pages using Get-Help <command> -Online.

@bk-cs
Copy link
Collaborator

bk-cs commented Nov 22, 2024

Added certificate-related commands to Detection and Prevention Policies wiki table.

@bk-cs bk-cs changed the title [ BUG ] Windows Certificate-Based Machine Learning Exclusions - not implemented [ BUG ] Add Windows certificate-based machine learning exclusions to documentation and FalconConfig commands Nov 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants