Skip to content

[ BUG ] ReadContainerCombined with filter running_status:'true' is returning both false and true results #1358

Description

@achitti-lc

Describe the bug
A clear and concise description of what the bug is.
API - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerCombined

The filter running_status is not working as expected. This is an FQL I tried:
cluster_name:'my-cluster-name'+running_status:'true', the API keeps returning results with both true and false running status.
Our cluster is using the Falcon KAC agent.

To Reproduce
Steps to reproduce the behavior.

Try the above API with the following FQL:
cluster_name:'my-cluster-name'+running_status:'true',

the API keeps returning results with both true and false running status.

Expected behavior
A clear and concise description of what you expected to happen.
running_status:'true',

the API should return results with only pods running

Environment (please complete the following information):

  • OS: [e.g. Red Hat Enterprise Linux 8.3]
  • Python: [e.g. 3.9]
  • FalconPy: [e.g. 0.7.1]

Tested on both the API swagger and falconpy - 1.5.2 version

Additional context
Add any other context about the problem here.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

bug 🐛Something isn't workingescalatedThis issue has been escalated to the API teamkubernetesKubernetes Protection issues and questions

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions