Sensor Download - filtering for different operating systems

[mobious999]

Describe the bug
Attempting to query with multiple os filters

To Reproduce
based on the payload
'platform': 'linux',
'os': 'RHEL/CentOS/Oracle',
'os_version': '8',
just for a sample
sensor_download.get_combined_sensor_installers_by_query(filter=f"platform_name:!'Linux'")

{'status_code': 400, 'headers': {'Server': 'nginx', 'Date': 'Wed, 30 Oct 2024 18:12:09 GMT', 'Content-Type': 'application/json', 'Content-Length': '227', 'Connection': 'keep-alive', 'Content-Encoding': 'gzip', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains', 'X-Cs-Region': 'us-2', 'X-Cs-Traceid': 'e4af534f-a6d3-44cd-87eb-519a7d486e02', 'X-Ratelimit-Limit': '6000', 'X-Ratelimit-Remaining': '5997'}, 'body': {'meta': {'query_time': 0.01448715, 'powered_by': 'binserv', 'trace_id': 'e4af534f-a6d3-44cd-87eb-519a7d486e02'}, 'errors': [{'code': 400, 'message': "Failed to parse filter expression. ['os' is an unknown property]"}], 'resources': None}}
ERROR:main:Query failed with status code 400:

Expected behavior
Return a filtered os type

Environment (please complete the following information):

• OS: [e.g. Red Hat Enterprise Linux 8.3]
• Python: [e.g. 3.9]
• FalconPy: [e.g. 0.7.1]

os: Windows
Python: 3.11

• Falconpy - latest

I'm attempting to download a filtered list by operating system using the sha256 value.

[jshcodes]

Hi @mobious999 -

Here are a couple of filter examples for you to try:

Filter for all platforms except linux

sensor.get_combined_sensor_installers_by_query(filter="platform:!'linux'")

Filter for windows and mac platforms only

sensor.get_combined_sensor_installers_by_query(filter="platform:['windows', 'mac']")

Filter for macOS only

sensor.get_combined_sensor_installers_by_query(filter="os:'macOS'")

Filter for macOS and SLES only

sensor.get_combined_sensor_installers_by_query(filter="os:['macOS', 'SLES']")

Filter for any os match with Oracle

sensor.get_combined_sensor_installers_by_query(filter="os:'*Oracle*'")

Thank you for the question!

[mobious999]

hi @jshcodes

is there any way that a json payload can be used as a filter? I have been trying various payloads so for example from the payload that I got back from the api

            'platform': 'linux',
            'os': 'RHEL/CentOS/Oracle',
            'os_version': '8',

I'm just looking to be more granular with the filters.

@jshcodes thanks for the sample queries I'll try them out.

[jshcodes]

The filter keyword (which ultimately becomes the filter query string parameter when the request to the API is made) only supports FQL formatted strings.

You can use compound filters which might get you to what you're trying to return.

Example:

sensor.get_combined_sensor_installers_by_query(filter="platform:'linux'+os:'SLES'+os_version:'*zLinux*'")