Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG ] Update-FalconStream gives error about specifying multiple endpoints #223

Closed
g1t-out opened this issue Jul 21, 2022 · 2 comments
Closed
Assignees
Labels
bug Something isn't working

Comments

@g1t-out
Copy link

g1t-out commented Jul 21, 2022

Describe the bug
Update-FalconStream gives the following error:

Invoke-Falcon : Cannot bind parameter because parameter 'Endpoint' is specified more than once. To provide multiple
values to parameters that can accept multiple values, use the array syntax. For example, "-parameter
value1,value2,value3".
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.1\Public\streaming.ps1:66 char:30
+ Invoke-Falcon @param -Endpoint $Endpoint -Inputs $PSBoundPara ...
+ ~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Invoke-Falcon], ParameterBindingException
+ FullyQualifiedErrorId : ParameterAlreadyBound,Invoke-Falcon

To Reproduce
Get-FalconStream -AppId psfalcon
Update-FalconStream -AppId psfalcon -Partition 0

Expected behavior
A clear and concise description of what you expected to happen.

Environment (please complete the following information):

  • OS: Windows 11
  • PowerShell: 5.1
  • PSFalcon: 2.2.1

Transcript content
If possible, please include a PowerShell transcript.


Windows PowerShell transcript start
Start time: 20220721104559
Username: <MYDOMAIN>\<MYUSER>
RunAs User: <MYDOMAIN>\<MYUSER>
Configuration Name:
Machine: <MYCOMPUTER> (Microsoft Windows NT 10.0.22000.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Process ID: 26256
PSVersion: 5.1.22000.653
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.22000.653
BuildVersion: 10.0.22000.653
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1


Transcript started, output file is C:\Users\<MYUSER>\Documents\PowerShell_transcript..qkeMeZGB.20220721104559.txt
PS C:\Users\<MYUSER>> Show-FalconModule

PSVersion : Desktop [5.1.22000.653]
ModuleVersion : v2.2.1 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1}
ModulePath : C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.1
UserModulePath : C:\Users<MYUSER>\Documents\WindowsPowerShell\Modules;C:\Program
Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
UserHome : C:\Users\<MYUSER>
UserAgent : crowdstrike-psfalcon/2.2.1

PS C:\Users\<MYUSER>> Get-FalconStream -AppId psfalcon
VERBOSE: [ApiClient.Invoke] GET https://api.us-2.crowdstrike.com/sensors/entities/datafeed/v2?appId=psfalcon
VERBOSE: [ApiClient.Invoke] Accept=application/json
VERBOSE: [ApiClient.Invoke] 200: OK
VERBOSE: [ApiClient.Invoke] Connection=keep-alive, X-Cs-Region=us-2, X-Cs-Traceid=403ab61b-3f48-4943-8fe9-4ed4ec495df8, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5999, Strict-Transport-Security=max-age=31536000; includeSubDomains, Date=Thu, 21 Jul 2022 16:46:35 GMT, Server=nginx
VERBOSE: [Write-Result] meta.query_time=0.01751635, meta.trace_id=403ab61b-3f48-4943-8fe9-4ed4ec495df8, meta.powered_by=FalconHose

dataFeedURL sessionToken


https://firehose.us-2.crowdstrike.com/sensors/entities/datafeed/v1/0?appId=psfalcon @{token=<TOKENBITS>...

PS C:\Users\<MYUSER>> Update-FalconStream -AppId psfalcon -Partition 0
>> TerminatingError(Invoke-Falcon): "Cannot bind parameter because parameter 'Endpoint' is specified more than once. To provide multiple values to parameters that can accept multiple values, use the array syntax. For example, "-parameter value1,value2,value3"."
Invoke-Falcon : Cannot bind parameter because parameter 'Endpoint' is specified more than once. To provide multiple
values to parameters that can accept multiple values, use the array syntax. For example, "-parameter
value1,value2,value3".
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.1\Public\streaming.ps1:66 char:30

+ Invoke-Falcon @param -Endpoint $Endpoint -Inputs $PSBoundPara ...
+ ~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Invoke-Falcon], ParameterBindingException
+ FullyQualifiedErrorId : ParameterAlreadyBound,Invoke-Falcon
Invoke-Falcon : Cannot bind parameter because parameter 'Endpoint' is specified more than once. To provide multiple
values to parameters that can accept multiple values, use the array syntax. For example, "-parameter
value1,value2,value3".
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.1\Public\streaming.ps1:66 char:30
+ Invoke-Falcon @param -Endpoint $Endpoint -Inputs $PSBoundPara ...
+ ~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Invoke-Falcon], ParameterBindingException
+ FullyQualifiedErrorId : ParameterAlreadyBound,Invoke-Falcon

PS C:\Users\<MYUSER>> stop-transcript


Windows PowerShell transcript end
End time: 20220721104702


@g1t-out g1t-out added the bug Something isn't working label Jul 21, 2022
@bk-cs
Copy link
Collaborator

bk-cs commented Jul 21, 2022

Thank you for the report. I've verified this bug and will be fixing it in the next release.

If you'd like to fix it yourself, you can edit Public\streaming.ps1 and change this section within the Update-FalconStream function from:

begin {
    $Param = @{
        Command = $MyInvocation.MyCommand.Name
        Endpoint = $Endpoint
        Format = @{ Query = @('action_name','appId') }
    }
}

to:

begin {
    $Param = @{
        Command = $MyInvocation.MyCommand.Name
        Format = @{ Query = @('action_name','appId') }
    }
}

bk-cs added a commit that referenced this issue Aug 8, 2022
Issue #223

Removed extraneous $Endpoint to correct error.
@bk-cs bk-cs changed the title [ BUG ] Update-FalconStream gives error about specifying multiple endpoints [ BUG ] Update-FalconStream gives error about specifying multiple endpoints Aug 24, 2022
@bk-cs
Copy link
Collaborator

bk-cs commented Sep 12, 2022

Closing issue--resolved in 2.2.2 release.

@bk-cs bk-cs closed this as completed Sep 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants