API now getting rate limited with PSFalcon

[RetardedParrot]

Everything has been working fine for months now I get an error using Get-FalconHost, I tried upgrading to latest version from Powershell gallery but same result
Write-Result : 429: API rate limit exceeded

[bk-cs]

Can you provide a transcript with more details?

The most common reason for rate limiting is authorization token requests. That has a very low limit (15/min) versus regular requests, depending on the cloud. If your script is using Request-FalconToken a lot, it will hit rate limiting quickly.

[RetardedParrot]

breaking it down into the simplest query
Request-FalconToken
$Fields = @('hostname', 'first_seen', 'last_seen', 'os_version', 'product_type_desc', 'external_ip')
$crowdstrike = Get-FalconHost -Detailed -All | Select-Object $Fields
Write-Host $crowdstrike

Results in:

Write-Result : 429: API rate limit exceeded.
At C:\XXXXX\WindowsPowerShell\Modules\PSFalcon\2.1.4\Private\Private.ps1:660 char:27

•             $Result = Write-Result $Request
  

•                       ~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
  • FullyQualifiedErrorId : ff1a6889-634f-492a-8c2e-eb939f6d6f67,Write-Result

Invoke-Loop : [Invoke-Loop] Results limited by API '/devices/queries/devices-scroll/v1' (40000 of XXXXX).
At c:\XXXXXXXXXXXXXXXXXXX\WindowsPowerShell\Modules\PSFalcon\2.1.4\Private\Private.ps1:603 char:33

•                             Invoke-Loop @Param
  

•                             ~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
  • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-Loop

[bk-cs]

Based on the error, it looks like you're able to retrieve 40,000 of your total device count. Have you verified the output to see whether you're getting your total number of devices (e.g. there is an error, but it continues to retrieve the results)?

In one of the more recent versions of PSFalcon I added an error message when the total number of devices received is less than the total number being advertised by the API. I did this because the Falcon APIs wouldn't provide an error message when the total number of results were being limited, confusing users as to exactly what was happening--PSFalcon was attempting to get all the results, but the API wasn't allowing it.

However, this shouldn't be happening with Get-FalconHost because it uses a specific API that does not have a limit of the total number of results that can be returned. If you're being rate limited, it should slow the loop down to compensate.

Can you step through each command after enabling verbose output?

$VerbosePreference = 'Continue'
$Fields = @('hostname', 'first_seen', 'last_seen', 'os_version', 'product_type_desc', 'external_ip')
Request-FalconToken -ClientId <string> -ClientSecret <string> [-Hostname <string>]
$crowdstrike = Get-FalconHost -Detailed -All | Select-Object $Fields

I expect you'll still receive an error on the Get-FalconHost -Detailed -All command, but with verbose output we can see rate limit information, how many total hosts it's attempting to retrieve, your cloud API destination, etc.

[RetardedParrot]

Just quickly checking the output and it gave the error but it did retrieve all devices, I will run the verbose output this afternoon and post results
Thanks