-
Bug
-
Resolution: Unresolved
-
Medium
-
None
-
3
-
Minor
-
0
-
Issue Summary
When setting the API limit on Data Manager adapters higher than the amount of items that the endpoint has the job fails and the following message is shown in the logs:
Error in importing data from CrowdStrike: Index was out of range. Must be non-negative and less than the size of the collection. (Parameter ‘index’)
Steps to Reproduce
- Create a new Falcon adapter
- Set the API limit to an amount higher that the number of items in the endpoint, for example, if the endpoint has 3000 items, set it to 3001 or higher
Expected Results
The job should be completed successfully as the API limit only sets the "Bulk" operation amount.
Actual Results
The following error is shown for the job
Error in importing data from CrowdStrike: Index was out of range. Must be non-negative and less than the size of the collection. (Parameter ‘index’)
Workaround
Currently, you will need to set the API limit to or below the amount of items that it scans.
Hi Team,
I raised this issue with Mikhael, who in turn helped me hone in on the actual issue described above.
I would just like to add that doing an API call to the same endpoint with my own python script, allowed me to set a limit of 5000, despite having 4679 items. In other words, CrowdStrike's endpoint allows setting an integer higher than the amount of items you have as the limit, up to a max of 5000 and the API call will return results successfully. Seems it is not as happy when doing this through the ADM integration however.
Hope that helps.
Kind regards,
Diogo Reis