Custom Storage API

[jkozlowicz]

Hi,
I've been looking into the custom storage API and I'd like to get a better understanding about a few things.

1. How to create collections and objects?

I am looking at this documentation:
https://www.falconpy.io/Service-Collections/Custom-Storage.html#putobject

, which says that I can send a PUT request to /customobjects/v1/collections/{collection_name}/objects/{object_key} in order to put a new object or overwrite an existing one.

But how can I create a collection so that I know its name to be use for the {collection_name} param? I wasn't able to find any endpoint for doing that.

Can {object_key} be anything or does it have to be a uuid or something else?

2. Retention policy. Are objects persisted forever or do they expire at some point?
3. Can I access those collections and objects through the CrowdStrike UI? Something similar to AWS S3 directory/object browser?
4. Can this API be also accessed from endpoints? (if there's a built-in crowdstrike command for that or would I have to write custom code that would use either your REST API or one of your clients, e.g. falconpy)?

Thanks!

[jkozlowicz]

@jshcodes any chance I could get an answer to this question, please?

[jshcodes]

Hi @jkozlowicz -

This service collection is recently released, new functionality will continue to be added.

Collections

• Currently you are only able to create collections leveraging the App Builder UI or the Foundry CLI application.
• Collection names must be between 5 and 200 characters and begin and end with a number or letter. These names cannot contain spaces or any special characters outside of underscore (_).

Object Keys

• Do not have to be UUID.
• Should be between 1 and 1000 characters and only contain alphanumeric characters, periods (.), hyphens (-), or underscores (_).

Retention

• Currently these objects exist until they are removed using the DeleteObject operation.
• TTL and retention policies are planned for some point in the future.

Viewing objects

• The ListObjects operation can provide this information via the API, but there is not currently a place in the UI to view objects residing within a Custom Storage collection.

For part 4 of your question, are we asking if the collection contents are available to endpoints without making an API call?

Thank you for the question! 😄

[jkozlowicz]

Thank you for the thorough reply.

As for part 4:

I believe that an API call has to be made for any operation, but my question here was really if there's a way to upload something to a Custom Storage collection directly from an endpoint, same as what we do with the BatchGetCmd (we batch upload files directly from endpoints to CrowdStrike). [So it'd be something like BatchCustomStorageUploadCmd 😄 ]

Just exploring options here... for a flow that produces a file on an endpoint and the file needs to be retrieved we could do the following:

• job X runs an executable on N endpoints that produces N files
• we created a custom collection with id X
• we batch upload those N files directly from all the endpoints to the collection X
• then everything meant for the job X is in the custom collection X

If files cannot be uploaded to a custom collection from an endpoint directly, then one would have to grab the N files with BatchGetCmd first, and then upload them to the collection X from their server, which is not that useful anymore as they have already been downloaded and can be stored on our side, like in S3.

[jshcodes]

Not natively... but you should be able to call the API from the endpoint. The endpoint would need access to keys scoped to Custom Storage. (There are a few ways to do this.) From the APIs perspective, this should be the same as calling the operations from your administrative machine.

[harshwardhanp-metron]

Hi @jkozlowicz / @jshcodes,

I am also trying to PUT some data in a collection and am hitting the same API you are using (/customobjects/v1/collections/{collection_name}/objects/{object_key}), but I am always getting a 403 error. Can you provide the sample code that you are using for this? I created an API client and key with all the read and write operations that are present in the scope but am still facing this issue. Can you help?

Thanks,
Harshwardhan R Patil