Custom IOA - Send multiple field_values

[oscardecr]

Hi,

Is there a way to Send multiple field_values to create_rule method?

Let's say I have a rule with multiple field_values, something like:

"field_values": [
    {
        "name": "name_1",
        "value": ".*",
        "label": "label_1",
        "type": "excludable",
        "values": [
            {
                "label": "label_1",
                "value": "value_1"
            }
        ],
        "final_value": "value_1"
    },
    {
        "name": "name_2",
        "value": ".*",
        "label": "label_2",
        "type": "excludable",
        "values": [
            {
                "label": "label_2",
                "value": "value_2*"
            }
        ],
        "final_value": "value_2"
    }

Documentation reference: https://www.falconpy.io/Service-Collections/Custom-IOA.html#create_rule

[jshcodes]

Hi @oscardecr -

In the current version (v1.2.11), this operation's field_values keyword will only accept one dictionary of values. Expanding the payload handler to handle multiple dictionaries here is a solid enhancement ask, I'll get an issue created for it.

In the interim, you can accomplish this by swapping over to leveraging the body keyword instead.

from falconpy import CustomIOA

ioa = CustomIOA(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

body_payload = {
        "comment": "string",
        "description": "string",
        "name": "string",
        "platform": "string",
        "enabled": true,
        "field_values": [
            {
                "final_value": "string",
                "label": "string",
                "name": "value1",
                "type": "string",
                "value": "string",
                "values": [
                    {
                        "label": "string",
                        "value": "string"
                    }
                ]
            },
            {
                "final_value": "string",
                "label": "string",
                "name": "value2",
                "type": "string",
                "value": "string",
                "values": [
                    {
                        "label": "string",
                        "value": "string"
                    }
                ]
            }
        ]
}

result = ioa.create_rule(body=body_payload)

print(result)

Thank you for the question!! 😄

[jshcodes]

Is it a valid Rule Group ID? I did the payload above without issue, that should be the only difference between the two.

[oscardecr]

Yes it is. That leaves me with the single quotes doubt, which I need to resolve.

[jshcodes]

I'm not using json.loads at all. Just providing the payload dictionary directly to the keyword.

[oscardecr]

Due to the nature of the program I can't skip the json.load(). But I guess I can find a workaround. For now, I'll provide the payload directly just to test and see if the json stuff is causing the issue.

[oscardecr]

Hey Joshua - providing the body_payload worked. The issue was on my code. Thanks for all the help :)