Fix execute.py response parsing for real API shapes - #7
Open
mraible wants to merge 4 commits into
Open
Conversation
…ion (#4) * Add Fusion SOAR JSON structure reference from Charlotte team Authoritative BPMN-based JSON schema doc covering the internal workflow model: triggers, activities, flows, gateways, submodels (loops), CEL extensions (cs.* functions), data references, custom variables, and three complete examples. Updates SKILL.md to reference the new doc when authoring workflows. * Add local structural validation to validate.py Adds a structural_check() step between pre-flight and API validation that catches schema errors without needing API credentials. Validates: action IDs are 32-char hex, actions have required id/name fields, class-based actions include version_constraint, trigger type is valid, next references resolve to defined labels, loop for.input matches a trigger parameter, and data references have balanced brackets. Also adds PyYAML to requirements.txt (needed for yaml.safe_load) and 11 new tests covering each validation rule (93 total, all passing). * Bump dependencies to latest versions crowdstrike-falconpy 1.6.1 → 1.6.2 pytest 9.0.2 → 9.0.3 PyYAML 6.0.2 → 6.0.3
* Fix README install instructions - Replace generic SKILL-NAME placeholder with actual plugin name (fusion-workflows) - Add CrowdStrike fork as primary install option with latest improvements - Keep upstream (eth0izzle) as stable alternative - Clarify that both repos provide the same plugin with two skills - Update manual install to show both repo options * Keep upstream repo URL, fix only the SKILL-NAME placeholder Revert CrowdStrike fork references. The actual bug was the generic SKILL-NAME placeholder, which is now replaced with the real plugin name (fusion-workflows) and a note about the two skills it provides. * Remove .git suffix from marketplace add command The /plugin marketplace add command takes the bare repo URL without the .git suffix. The git clone command in Manual Setup keeps it.
Real Fusion SOAR playbooks exported from the CrowdStrike Content Library with real action IDs. The import logic detects non-global actions and prompts users to configure integrations or substitute available actions. Categories: - threat-intel: VirusTotal domain/URL enrichment + Zscaler blocklist - identity-response: brute force auto-resolution, phishing with ITP - notifications: Slack messaging, endpoint containment with approval - ngsiem: duplicate detection auto-close - response-actions: 6 Palo Alto NGFW EDL/DAG playbooks - tutorials: 6 Introduction to... concept playbooks CrowdStrike-native action IDs are universal across all clouds. Plugin actions (Slack, Zscaler, PAN NGFW) require the integration installed from the CrowdStrike Store.
Two bugs in execute.py, both confirmed against live workflow executions:
- execute_workflow() assumed the execute endpoint returns resources as
a list of dicts (resources[0].get('id')), but it returns bare
execution-ID strings, crashing with 'str' object has no attribute 'get'.
Now handles both shapes.
- poll_results() checked status in ('completed','failed','error'), but
the execution-results API returns capitalized statuses
(Succeeded/Failed/Canceled/NonRecoverable/ActionRequired per
references/best-practices.md). A finished run never matched the terminal
set, so polling always ran until timeout. Now matches the documented
statuses case-insensitively.
Updated tests to use real API status casing and added coverage for the
bare-string execution ID.
Contributor
Author
|
@eth0izzle This PR has all the previous PRs I created in it because I branched from our fork's |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes two bugs in
execute.pythat prevented--waitfrom working, both confirmed against live workflow executions.1.
execute_workflow()crashed on the real response shape. The execute endpoint returnsresourcesas a list of bare execution-ID strings, but the code calledresources[0].get("id"), raising'str' object has no attribute 'get'. Now handles both the string and object shapes.2.
poll_results()never detected terminal status. It checkedstatus in ("completed", "failed", "error"), but the execution-results API returns capitalized values (Succeeded,Failed,Canceled,NonRecoverable,ActionRequired— perreferences/best-practices.md). A finished run never matched, so polling always ran until timeout. Now matches the documented statuses case-insensitively.The existing tests asserted fictional lowercase statuses (
completed,running) that the platform never returns, so they passed while the code was broken. Updated them to real API casing and added coverage for the bare-string execution ID.Verified against live executions in a test CID: execution IDs parse correctly and polling transitions
In progress→Failed/Succeededand stops. All 84 tests pass.