update list command RTR

[t0uxe]

Hi,

I want to make a little script which shows the list of updates of all the Windows hosts. This is available if the customer has enabled Spotlight modile., but I'm trying to get that list performing a RTR command.

What I'm doing is to get the list of all the Windows hosts. For each one, I open a session, using the 'RTR-InitSession' (im using the Uber class). Then I prepare a BODY dict:
BODY = {
'base_command': 'update list',
'session_id': session_id
}
But when I do:
response = falcon.command('RTR-ExecuteActiveResponderCommand', body=BODY)

I get an error: 'Command not found', and status code 400.

I've seen in the wiki that I can use that command.

Please, could anyone tell me what I'm doing wrong?

Thank you.

[jshcodes]

Hi @t0uxe!

I was able to recreate your issue, and believe the problem is related to your body payload.
(I changed base_command and added command_string)

Here's my test example:

import json
from falconpy.api_complete import APIHarness as Uber

with open("config.json", "r") as cred_file:
    config = json.loads(cred_file.read())
creds = {
    "client_id": config["falcon_client_id"],
    "client_secret": config["falcon_client_secret"]
}

falcon = Uber(creds=creds)

device_id = "DEVICE_ID_GOES_HERE"

session = falcon.command("RTR_InitSession", body={"device_id": device_id})
if session["body"]["errors"]:
    print(session["body"]["errors"][0]["message"])
else:
    session_id = session["body"]["resources"][0]["session_id"]
    print("Session started")


BODY = {
    'base_command': 'update',
    'command_string': 'update list',
    'session_id': session_id
}

response = falcon.command('RTR-ExecuteActiveResponderCommand', body=BODY)
print(response)

Please note: This should result in a 201 status code, and return the cloud_request_id so that you may use it to retrieve the results of your command.

[t0uxe]

Ok, it's working now. Thank you very much for your help!