Help with "ConnectionResetError"

[zenthpk]

My colleague ran QueryDetects on Windows using Python 3.11.1 and FalconPy 1.2.12 and got the following response:

{'status_code': 500, 'headers': {}, 'body': {'errors': [{'message': "('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))"}], 'resources': []}}

Below is the code I ran:

    from falconpy import Detects

    falcon = Detects(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)
    days_ago = int(input("How many days back would you like to query: "))
    params = {
        'offset': 0,
        'sort': 'last_behavior|asc',
        'filter': f"device.device_id:['[REDACTED]','[REDACTED]']+created_timestamp:>='{datetime.fromtimestamp(datetime.now().timestamp()-days_ago*86400).isoformat()}'",
        'limit': 9999,
    }

    id_response = falcon.QueryDetects(parameters=params)

What's really odd is that when I run the same code on my end (MacOS, Python 3.10.7, FalconPy 1.2.12), I get a response with my desired IDs. What could possibly cause this difference and how can my colleague fix their error? Thank you!

[jshcodes]

Hi @zenthpk -

Does this happen consistently when your coworker runs the code from their machine?

[zenthpk]

Yes, he always gets that error. He's never been able to get a different or successful response. Thanks for responding!

[jshcodes]

Hi @zenthpk -

This sounds like it may be network-related. (Proxy or Firewall interfering with the traffic?)

There are a couple of ways to test for this:

1. Use curl to attempt to request a token from the machine demonstrating this issue. This will eliminate FalconPy as a potential root cause.

   curl -X POST "https://api.crowdstrike.com/oauth2/token" \
       -H "accept: application/json" \
       -H "Content-Type: application/x-www-form-urlencoded" \
       -d "client_id=$FALCON_CLIENT_ID&client_secret=$FALCON_CLIENT_SECRET"

   If you get a token back, then it's not a networking issue.

2. Move to a different network location - Is this a laptop? Can we test from another network to confirm?

[zenthpk]

Hi, it was indeed a proxy problem. My coworker just manually set HTTP_PROXY to something else and that worked. Thanks!