Error executing action CrowdStrike - List Hosts. Reason: Incorrect Customer ID specified.

[vanitharaj1208]

i have specified right customer ID 

any idea why it is throwing this error

[vanitharaj1208]

can anyone reply

[f3rz]

Hi @vanitharaj1208 This indicates that CrowdStrike is returning an error message stating, "only your own CID can be provided." This likely means either:

1. You are providing an incorrect CID.
2. Your integration instance is set up for a CrowdStrike account that does not have access to this CID.

I suggest that you verify your integration instance details alongside this CID with your CrowdStrike administrator. 

[vanitharaj1208]

1) i have used own CID 

2) how to check this : Your integration instance is set up for a CrowdStrike account that does not have access to this CID.

[f3rz]

You need to check your Crowdstrike integration instance settings with your Crowdstrike admin and validate if what you have set there is related to your CID or if it is a different account.

https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/crowdstrike-falcon#integrate

 If that wouldn't help, I recommend you to open a Support Ticket.

[vanitharaj1208]

This needs to be checked from SOAR support as this is the correct CrowdStrike CID and integration worked with Chronicle SIEM and Splunk. I checked all the settings from the API created in CrowdStrike and all the permissions has been given.

[f3rz]

Hi @vanitharaj1208 if you have validated that CID belongs to the same credentials you have setup in integration it shouldn't return this error. To double-check everything please contact Support so they can help you with validating it and if there's an issue with integration fix it. 

[vanitharaj1208]

Hi @f3rz  i have validated  it is right and integration is setup is successful.

to add more context , with same CID is was working before but why it is not working

[f3rz]

This is the API Response Crowdstrike send us when we saying you that Customer ID is incorrect:

only your own CID can be provided.

Therefore, I recommend you to open Support Ticket to troubleshoot it further. 

[vanitharaj1208]

@f3rz  i figured out CID - the issue was to remove -XX and keep it in small case (i used action in CS where CID was not required parameters and looked in the json result and got CID ) i was using CID in caps and in json it was in lower case and without -XX

now im getting this issue -

Failed to execute action. Error: An error occurred: pause_duration (2) must be less than or equal to the max_duration (1) 

we option for max duration scan but pause duration field is not there in the action parameters

[f3rz]

Hi @vanitharaj1208 could you please show technical details or send a parameters you are using to run the action?

[vanitharaj1208]

Here you go!!

[f3rz]

Please open a support ticket with it. We are not using "pause_duration" in our API request, and it seems we need to add it according to this message. 

Also, you can try to set Max Scan Duration to higher or equal value to 2 and it should work.