[ BUG ] Crowdstrike API returning 406 when uploading a Fusion Workflow

[RoemIko]

Describe the bug
I followed the docs here: https://www.falconpy.io/Service-Collections/Workflows.html?highlight=import_definition#workflowdefinitionsimport
But i received a 406 after uploading a .yaml file, tried changing it to a .yml same results. When i upload it through the CrowdStrike Swagger UI i get a 200 back.

To Reproduce
This is my code

from os import listdir

def import_workflows():
    path_to_workflows_folder = "/home/REDACTED/workflows/

    falcon_w = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

    for filename in listdir(path_to_workflows_folder):
        if filename.endswith(".yaml") or filename.endswith(".yml"):
            print(f'Importing {filename}')
            with open(f'{path_to_workflows_folder + filename}', 'r') as yaml_file:
                workflow_response = falcon_w.import_definition(data_file=yaml_file)
                print(f'Workflow Response: {workflow_response}')
                if workflow_response['status_code'] == 200:
                    print(f'Workflow {filename} imported successfully')
                else:
                   print(f'Workflow {filename} failed to import')

Expected behavior
I expect a status code of 200

Environment (please complete the following information):

• OS: 5.15.146.1-microsoft-standard-WSL2
• Python: 3.10.12
• FalconPy: 1.4.2

Additional context
Add any other context about the problem here.

[jshcodes]

Hi @RoemIko -

Thank you for reporting this issue!

We have confirmed this issue as a bug, and have a fix ready for the 1.4.3 version. In the interim, here is a work around leveraging the Uber Class that should also accomplish what you are trying to do.

from os import listdir
from falconpy import APIHarnessV2


def import_workflows():
    path_to_workflows_folder = "/home/REDACTED/workflows/

    falcon_w = APIHarnessV2(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )

    for filename in listdir(path_to_workflows_folder):
        if filename.endswith(".yaml") or filename.endswith(".yml"):
            print(f'Importing {filename}')
            with open(f'{path_to_workflows_folder + filename}', 'r') as yaml_file:
                file_data = {"data_file": yaml_file.read(), "type": "application/x-yaml"}
                workflow_response = falcon_w.command("WorkflowDefinitionsImport", files=file_data)
                print(f'Workflow Response: {workflow_response}')
                if workflow_response['status_code'] == 200:
                    print(f'Workflow {filename} imported successfully')
                else:
                   print(f'Workflow {filename} failed to import')

[RoemIko]

Hi @jshcodes,

Thank you for looking into it 🙏 , and many thanks for the workaround

[RoemIko]

I have updated falconpy to 1.4.3 but now i receive an error 500 with "Keyword arguments are required to use this method." This happens when i use the initial code from the beginning of this thread

[jshcodes]

Can we see your call to import_definition? It still just includes the data_file argument?

[RoemIko]

Yes it still includes the data_file argument

from os import listdir

def import_workflows():
    path_to_workflows_folder = "/home/REDACTED/workflows/

    falcon_w = Workflows(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

    for filename in listdir(path_to_workflows_folder):
        if filename.endswith(".yaml") or filename.endswith(".yml"):
            print(f'Importing {filename}')
            with open(f'{path_to_workflows_folder + filename}', 'r') as yaml_file:
                workflow_response = falcon_w.import_definition(data_file=yaml_file)
                print(f'Workflow Response: {workflow_response}')
                if workflow_response['status_code'] == 200:
                    print(f'Workflow {filename} imported successfully')
                else:
                   print(f'Workflow {filename} failed to import')

[RoemIko]

Did you happen to look into this @jshcodes ?
The uber class works

[jshcodes]

Yes we did! 😄

The consumption of the YAML file has been implemented within the service class, which should reduce the amount of code you need.

from os import listdir

def import_workflows():
    path_to_workflows_folder = "/home/REDACTED/workflows/

    falcon_w = Workflows(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

    for filename in listdir(path_to_workflows_folder):
        if filename.endswith(".yaml") or filename.endswith(".yml"):
            print(f'Importing {filename}')
            workflow_response = falcon_w.import_definition(data_file=f'{path_to_workflows_folder + filename}')
            print(f'Workflow Response: {workflow_response}')
            if workflow_response['status_code'] == 200:
                print(f'Workflow {filename} imported successfully')
            else:
               print(f'Workflow {filename} failed to import')