Fix: Handle missing indicator scope permission gracefully in CrowdStrike Report Connector #5479
+43
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ike report importer - Add defensive check for API response structure before accessing 'resources' field - Log warning and continue report import when indicator scope is not permitted (403) - Allows reports to import successfully even without indicator scope access - Fixes KeyError crash when users lack indicator scope in API credentials Co-Authored-By: Warp <agent@warp.dev>
…API client - Change 403 (permission denied) errors from ERROR to WARNING level - Prevents misleading error logs when scope is not permitted - 403 errors are now handled gracefully in the connector logic - Other 4xx/5xx errors remain at ERROR level for visibility Co-Authored-By: Warp <agent@warp.dev>
Co-Authored-By: Warp <agent@warp.dev>
5 tasks
Author
|
Closing this PR in favor of #5577, which follows the proper naming conventions ([connector_name] format) and has GPG-signed commits as required by the project guidelines. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
CrowdStrike connector crashes with
KeyError: 'resources'when users lack the "indicator" API scope, preventing import of reports and actors.Root Cause
API returns a 403 error response without a
"resources"field, but code tried to access it directly without validation.Solution
Testing
Impact
Proposed changes
Related issues
Checklist
Further comments