Azure / Azure/Azure-Sentinel

CrowdStrike API Data Connector CCF - Internal Server Error

Closed
#15,068 0 comments 0 reactions 3 assignees Claimed by @hassanchawiche View on GitHub
Codeless Connector Framework (CCF) Connector Connector
Dominant language
Python
Stars
6.1k
Forks
3.8k
Avg merge
4d 7h
Merged PRs (30d)
125

Description

**Describe the bug**
V2 Crowdstrike API Data Connector returned 'InternalServerError' when attempting to connect Alert, Detection and Case tables while Hosts and Vulnerabilities work no problem.

**To Reproduce**
Steps to reproduce the behavior:
1. deploy Crowdstrike API Data Connector in sentinel data sources
2. authenticate with all 5 event types selected
3. deployment will show partial success with 3 internalservererror listed for the 3 failed event sources.

**Expected behavior**
All 5 tables expected to connect

**Screenshots**
Image

**Desktop (please complete the following information):**
windows 11, edge browser

**Additional context**
Immediately produces internal server error but then after some time (minutes to hours) the following error is reflected on the azure deployment
{
"status": "Failed",
"error": {
"code": "Unauthorized",
"message": "The ARM signed user token failed validation."
}
}
API permissions are correct, a entirely new api client has been created in an attempt to isolate the issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.