Skip to content

Commit 985ee4c

Browse files
hassanchawichehassanchawiche
authored
Merge pull request #13126 from srikarshastry/feature/srsistla/crowdstrikeApi
[CrowdstrikeApiConnector] - fix rate limit exceptions
2 parents fdd8c0f + f0814a0 commit 985ee4c

File tree

6 files changed

+105
-121
lines changed

6 files changed

+105
-121
lines changed

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_Definition.json‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,8 @@
101101
"requiredPermissions": {
102102
"write": true,
103103
"read": true,
104-
"delete": true
104+
"delete": true,
105+
"action": false
105106
}
106107
}
107108
]
@@ -111,12 +112,6 @@
111112
"title": "Configuration steps for the CrowdStrike API",
112113
"description": "Follow the instructions below to obtain your CrowdStrike API credentials.",
113114
"instructions": [
114-
{
115-
"type": "Markdown",
116-
"parameters": {
117-
"content": "#### Configuration steps for the CrowdStrike API\nFollow the instructions below to obtain your CrowdStrike API credentials."
118-
}
119-
},
120115
{
121116
"type": "Markdown",
122117
"parameters": {

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_PollingConfig.json‎

Lines changed: 29 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,11 @@
2020
"request": {
2121
"apiEndpoint": "[[concat(parameters('apiUrl'),'/spotlight/combined/vulnerabilities/v1')]",
2222
"httpMethod": "GET",
23-
"rateLimitQPS": 10,
24-
"queryWindowInMin": 5,
23+
"rateLimitQPS": 1,
24+
"queryWindowInMin": 15,
2525
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
26-
"retryCount": 3,
27-
"timeoutInSeconds": 68,
26+
"retryCount": 5,
27+
"timeoutInSeconds": 90,
2828
"headers": {
2929
"Content-Type": "application/json",
3030
"Accept": "application/json",
@@ -45,7 +45,7 @@
4545
"pagingType": "NextPageToken",
4646
"nextPageTokenJsonPath": "$.meta.pagination.after",
4747
"NextPageParaName": "after",
48-
"pageSize": 100,
48+
"pageSize": 50,
4949
"pageSizeParameterName": "limit"
5050
},
5151
"connectorDefinitionName": "CrowdStrikeAPICCPDefinition",
@@ -78,11 +78,11 @@
7878
"request": {
7979
"apiEndpoint": "[[concat(parameters('apiUrl'),'/alerts/combined/alerts/v1')]",
8080
"httpMethod": "POST",
81-
"rateLimitQPS": 10,
82-
"queryWindowInMin": 5,
81+
"rateLimitQPS": 1,
82+
"queryWindowInMin": 15,
8383
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
84-
"retryCount": 3,
85-
"timeoutInSeconds": 91,
84+
"retryCount": 5,
85+
"timeoutInSeconds": 120,
8686
"isPostPayloadJson": true,
8787
"headers": {
8888
"Content-Type": "application/json",
@@ -101,7 +101,7 @@
101101
"pagingType": "PersistentToken",
102102
"nextPageTokenJsonPath": "$.meta.pagination.after",
103103
"nextPageParaName": "after",
104-
"pageSize": 100
104+
"pageSize": 50
105105
},
106106
"connectorDefinitionName": "CrowdStrikeAPICCPDefinition",
107107
"dataType": "CrowdStrikeAlerts",
@@ -133,20 +133,19 @@
133133
"request": {
134134
"apiEndpoint": "[[concat(parameters('apiUrl'),'/incidents/queries/incidents/v1')]",
135135
"httpMethod": "GET",
136-
"rateLimitQPS": 10,
137-
"queryWindowInMin": 7,
136+
"rateLimitQPS": 1,
137+
"queryWindowInMin": 15,
138138
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
139-
"retryCount": 3,
140-
"timeoutInSeconds": 60,
139+
"retryCount": 5,
140+
"timeoutInSeconds": 90,
141141
"headers": {
142142
"Content-Type": "application/json",
143143
"Accept": "application/json",
144144
"User-Agent": "Scuba"
145145
},
146146
"queryParameters": {
147147
"filter": "modified_timestamp:>'{_QueryWindowStartTime}'+modified_timestamp:<='{_QueryWindowEndTime}'",
148-
"sort": "modified_timestamp.asc",
149-
"limit": "500"
148+
"sort": "modified_timestamp.asc"
150149
}
151150
},
152151
"response": {
@@ -158,7 +157,7 @@
158157
"paging": {
159158
"pagingType": "Offset",
160159
"offsetParaName": "offset",
161-
"pageSize": 500,
160+
"pageSize": 50,
162161
"pageSizeParameterName": "limit"
163162
},
164163
"stepInfo": {
@@ -176,10 +175,10 @@
176175
"request": {
177176
"apiEndpoint": "[[concat(parameters('apiUrl'),'/incidents/entities/incidents/GET/v1')]",
178177
"httpMethod": "POST",
179-
"rateLimitQPS": 10,
178+
"rateLimitQPS": 1,
180179
"queryWindowInMin": 5,
181-
"retryCount": 3,
182-
"timeoutInSeconds": 65,
180+
"retryCount": 5,
181+
"timeoutInSeconds": 90,
183182
"logResponseContent": true,
184183
"isPostPayloadJson": true,
185184
"headers": {
@@ -227,11 +226,11 @@
227226
"request": {
228227
"apiEndpoint": "[[concat(parameters('apiUrl'),'/alerts/combined/alerts/v1')]",
229228
"httpMethod": "POST",
230-
"rateLimitQPS": 10,
231-
"queryWindowInMin": 6,
229+
"rateLimitQPS": 1,
230+
"queryWindowInMin": 15,
232231
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
233-
"retryCount": 3,
234-
"timeoutInSeconds": 70,
232+
"retryCount": 5,
233+
"timeoutInSeconds": 120,
235234
"isPostPayloadJson": true,
236235
"headers": {
237236
"Content-Type": "application/json",
@@ -250,7 +249,7 @@
250249
"pagingType": "PersistentToken",
251250
"nextPageTokenJsonPath": "$.meta.pagination.after",
252251
"nextPageParaName": "after",
253-
"pageSize": 100
252+
"pageSize": 50
254253
},
255254
"connectorDefinitionName": "CrowdStrikeAPICCPDefinition",
256255
"dataType": "CrowdStrikeDetections",
@@ -282,11 +281,11 @@
282281
"request": {
283282
"apiEndpoint": "[[concat(parameters('apiUrl'),'/devices/combined/devices/v1')]",
284283
"httpMethod": "GET",
285-
"rateLimitQPS": 10,
286-
"queryWindowInMin": 5,
284+
"rateLimitQPS": 1,
285+
"queryWindowInMin": 15,
287286
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
288-
"retryCount": 3,
289-
"timeoutInSeconds": 63,
287+
"retryCount": 5,
288+
"timeoutInSeconds": 90,
290289
"headers": {
291290
"Content-Type": "application/json",
292291
"Accept": "application/json",
@@ -307,7 +306,7 @@
307306
"pagingType": "NextPageToken",
308307
"nextPageTokenJsonPath": "$.meta.pagination.next",
309308
"NextPageParaName": "offset",
310-
"pageSize": 100,
309+
"pageSize": 50,
311310
"pageSizeParameterName": "limit"
312311
},
313312
"connectorDefinitionName": "CrowdStrikeAPICCPDefinition",

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
"azuresentinel.azure-sentinel-solution-commoneventformat"
3131
],
3232
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CrowdStrike Falcon Endpoint Protection",
33-
"Version": "3.1.6",
33+
"Version": "3.1.7",
3434
"Metadata": "SolutionMetadata.json",
3535
"TemplateSpec": true,
3636
"Is1Pconnector": false

‎Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.1.7.zip‎

72.9 KB
Binary file not shown.

0 commit comments

Comments
 (0)