PSFalcon Not Finidng CloudFile

[zgold15]

I am trying to run a custom script with the command:

Invoke-FalconRTR -Command runscript -Arguments "-CloudFile='file'"

However, PSFalcon is saying that it can not find the script

[bk-cs]

It's most likely not PSFalcon having an issue finding the script--it's Real-time Response in general due to permissions or how the script is named.

You can validate this by trying to runscript -CloudFile='file' directly in the Real-time Response UI.

Real-time Response scripts can have three different permissions:

• private: visible only to the user account that created it
• group: visible to all Real-time Response admins
• public: visible to all Real-time Response admins and active responders

1. Can you verify that your script permission is set to group or public? private will not be visible to your API client, because it was created by your user account (which is not the same as your API client).
2. If the permissions are correct, can you verify the name of the script matches? Try using lowercase names, and if the script name has spaces, try removing and re-adding it without them. Sometimes the API has problems matching based on case sensitivity and whitespace characters.

[bk-cs]

Did any of those tips help? Since I'm unable to reproduce any errors, I'm going to close this ticket unless you report that you're still having problems.

[zgold15]

Sadly, that did not work and I am still have a problem.

[bk-cs]

Try deleting the file and recreating it as your API client:

• Save the script to a local .ps1 file
• Delete the existing cloud file
• Use Send-FalconScript to upload it with public permission

Send-FalconScript -Path .\path\to\script.ps1 -Platform windows -PermissionType public -Name my_script_name