Make queries in multi tenant environment - Flight Control

[brucelourenco]

Hello all.
The environment that I work today has multi-tenant CIDs and I need to interact with other CIDs besides the parent CID. However seeing the MSSP (Flight Control) documentation I couldn't find out how can interact with the others consoles using the classes available like I have in parent CID.
The "children" CIDs doesn't inherit my parent console permissions?
Thanks for the help.

[crowdstrikedcs]

Hello @brucelourenco thanks for the question!

Take a look at some of the examples we have for Flight Control on our Documentation Site

In short, with Flight Control, you are able to use credentials from the Parent CID to perform actions on Children CIDs by specifying the member_cid query parameter when generating an OAuth 2 Token.

As a side note, some APIs are natively Flight Control aware such as the Detects class. This will allow you to make a call without specifying the member_cid to aggregate data from Child CIDs.

Let us know if that works for you or if you have any more questions!

[jshcodes]

To add on to @crowdstrikedcs answer, we also have some Flight Control usage examples in our samples library: https://github.com/CrowdStrike/falconpy/tree/main/samples.

[brucelourenco]

Thanks for this so quick answer!
One more question, I just made the validation of Detects class and was really great to see the detections of children CIDs (I never paid attention on this before). So, is there some field in the JSON returned where I can see information of which CID I'm gathering these detecions? I couldn't see this information so far.
Thanks guys!

[jshcodes]

You should be able to pull the CID straight from the detection. The CID returned should match the tenant the hosts resides in. (It's actually in two places depending on the detection, the main branch, and then the "device" sub-branch.)

[brucelourenco]

Hi Mr @jshcodes !
I'll take a look on this to prepare some reports for the customer.
Thanks a lot

[brucelourenco]

Hello guys!
Today arises another doubt. Once when I do not set the member_cid for child tenants it will retrieve all detections from parent and child tenants correct? Now I need to exclude the child cids to just get all detection only from the parent cid.
I've tried passing the parent cid as member_cid variable but I get a 401 error as follows:

Am I doing something wrong?
Thank you for all support

[jshcodes]

Hi @brucelourenco!

Have you tried adding your parent CID to the filter you're passing to QueryDetects?

Something along the lines of:

from falconpy import Detects

falcon = Detects(client_id="CLIENT_ID_HERE",
                 client_secret="CLIENT_SECRET_HERE"
                 )

response = falcon.query_detects(limit=9999,
                                filter="status:'new'+max_severity_displayname:'High'+cid:'PARENT_CID_HERE'",
                                sort="last_behavior|desc"
                                )

[brucelourenco]

Hi @jshcodes !
I really don't paid attention on this.
I did the adjustment and works perfectly!
Thanks a lot