Periodic errors checking for status of get file

[grayfold3d]

I have a script which collects data off the host, uses a get request to upload the output to CS and then downloads that data from CS to one of our servers. Occasionally I have failures while my script is running a loop checking whether the get file has uploaded to CS.

Here is a snippet of the code that is running:

                try
                { 
                    $getUploadResponse = Confirm-FalconGetFile -SessionID $rtrSessionID -ErrorAction Stop
                    Start-Sleep -seconds 10
                }
                catch
                {
                    Write-Host "Error checking for Get file status: $($error[0])" -ForegroundColor Red
                    return
                }


                # Checking to see if upload has completed

                while($getuploadResponse.count-eq 0){
                    $sessionUpdate = Update-FalconSession -hostid $($aid)
                    Write-Host "Upload still running. Will check again in 30 seconds..." -ForegroundColor Yellow
                    Start-Sleep -Seconds 30
                    $getUploadResponse = Confirm-FalconGetFile -SessionID $rtrSessionID -ErrorAction Stop
                }

                $getUploadStatus = Confirm-FalconResponderCommand -CloudRequestId $getuploadResponse.cloud_request_id 

                if($getUploadStatus.complete -eq "True") {
                    Write-Host "Collection successfully uploaded to CrowdStrike Cloud" -ForegroundColor Green
                }

What's odd is that the error that I see when this fails is as follows:

Request-FalconToken : The term 'Request-FalconToken' is not recognized as the name of a cmdlet, function, script file,
or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and
try again.
At C:\Users\foo\Documents\WindowsPowerShell\Modules\PSFalcon\2.0.6\Private\Private.ps1:907 char:13
+             Request-FalconToken
+             ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Request-FalconToken:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Any idea why it can't find the Request-FalconToken function? The script works the majority of times without issue and even when it fails that function has been called multiple times before failing.

[bk-cs]

The PSFalcon module will not automatically import to PowerShell (I think because the module adds 'Falcon' as a prefix rather than having it in the command names). I'm not sure if that's the cause of the problem, but the error you're getting is acting like PowerShell can't find PSFalcon.

I don't see any code showing that you're importing the module as part of the script. Have you tried a requires statement? Forcing the module to be present should stop that error from showing up...

[grayfold3d]

Yep I'm importing it in the beginning of the script. I have a ton of other stuff that occurs in the script prior to the part where it's failing that uses PSFalcon so I would think if it was an issue with the module not being available it would have failed prior to that.

[bk-cs]

If you're using Import-Module, try using a requires statement instead and see if that fixes it. The error makes me suspect that somehow PowerShell is creating a separate process at some point which doesn't have the module loaded. There's not really any reason in the code of PSFalcon that this should be happening, so I can't really offer any advice beyond trying a few different methods to make sure the module is imported and see if you can narrow it down...

[grayfold3d]

alright cool I'll give that a shot.