404 Error when search at multi tenant

[brucelourenco]

Hello all
Today I'm trying to get a set of host that matches an IP pool parameter like filter="local_ip.raw:'192.168.123.'"

I can get a list of host ids using "query_devices_by_filter", however, when a try to get the host details with "falcon.get_device_details" I get 404 error. After some debbuging, I realize if I pass "member_cid" parameter in the Hosts instantiation could get the host details.

The question is, this search is spreaded throughout the tenants because several tenants have IPs from this range, and in this case to concatenate all of them I'll need to get set by set using all tenant's cids during the Hosts instantiation... So...

I'm almost sure that I did this kind of search before but...

Do you have some workaround for this?

Follow evidences:

WITHOUT member_cid

WITH member_cid

Thank you!

[jshcodes]

Hi @brucelourenco -

We've recreated this scenario and are investigating potential solutions. I'll post an update here as we find out more detail.

[brucelourenco]

Thank you @jshcodes for trying to help me with this issue.

[rafaelosoto]

@jshcodes hello, I am running into a similar issue with FalconPy so decided to post here. I'm not sure if we are using multi-tenant but we essentially call:

query_devices_by_filter_scroll
with a last_seen filter.
filter = f"first_seen:>='<>'

then we iterate through the resulting host_ids and run the following on each ID

get_device_details

For one specific account we have we receive. "No matching device with ID:X"

My question is, would query_devices_by_filter_scroll ever return "bad" host_ids? Not sure why this specific device is returning 404s if the ID seems valid. Is it possible this is a multi-tenant issue?

Is there an additional filter we can add to the query to not return "malforned" host_ids or host_ids that will fail a get_device_details call?

This recently started happening and we have been successfully running this script for about two years until now.

[jshcodes]

Can we see an example of your code? (Please sanitize it of any client ID / secrets or AID / CID values.)