Error 403

[jtabby]

When trying to run any command in PSfalcon I get a 403 error

[BeejCyr]

Mine works until I try to make any of the RTR related calls.

Import-Module -Name PSFalcon

New-Variable -Name "ClientID" -Value "MyClientID" -Scope Private -Force 
New-Variable -Name "ClientSecret" -Value "MyClientSecret" -Scope Private -Force

Request-FalconToken -ClientId $ClientID -ClientSecret $ClientSecret -Cloud us-1

$Computers = Get-Content "C:\Temp\ComputerList.txt"

$IDs = [System.Collections.Generic.List[string]]::new()

ForEach($Computer in $Computers) {
    Write-Host "Looking up ID for $Computer"
    Try {
        $ID = Get-FalconHost -Filter "hostname:'$Computer'"
        If ($ID) { $IDs.Add($ID) }
    } Catch {
        Write-Warning "No match for $Computer. [$($_.Exception.Message)]"
    }
}

# Now I should have a list of IDs.
$result = Invoke-FalconRtr -HostIds $IDs.ToArray() -Command ls -Arguments "C:\Temp" -Timeout 60

When the Invoke command runs, it returns this for each computer:

Write-Result : 403: access denied, authorization failed At C:\Users\cyrbr9\Documents\WindowsPowerShell\Modules\PSFalcon\2.1.3\Private\Private.ps1:582 char:35
 
 +                         $Result = Write-Result $Request
 +                                   ~~~~~~~~~~~~~~~~~~~~~
     + CategoryInfo          : NotSpecified: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
     + FullyQualifiedErrorId : f6279e3d-003c-42d2-bd6b-339854d2145e,Write-Result

When I look at $result, I see this:
aid : a0819fe9b7514a52a70f479e904af06e ( different aid for each computer, of course)
batch_id :
session_id :
cloud_request_id :
complete : False
offline_queued : False
errors :
stderr :
stdout :

[bk-cs]

Do you have real-time-response:read permissions for the API client that you're using? 403: authorization failed errors are produced when you're missing the appropriate API permissions.

I recommend having the following permissions if you're going to use Invoke-FalconRtr:

• real-time-response:read
• real-time-response:write
• real-time-response-admin:write

NOTE: You'll want to be careful with that script. If $Computer is an empty value, it will return all host results. I recommend using the exact search and filtering for null values, seen in this example under the "Retrieve the device_id for hostnames in groups of 20" comment.

[bk-cs]

• Did you verify your API Client Id and Secret?
• Are you requesting an authentication token in the proper cloud?
• Does your API Client have the proper permissions for the command you're trying to run?

403 errors generally appear when you don't have access to the API you're trying to use. Usually they're displayed along with the line $Result = Write-Result $Request because that's the function that's making the call to the API--but it's not the source of the problem, it's the place in the module where the error is occurring (i.e. the response being received from the API for your request attempt).