From c2ab1cefc6a112b5f41269423d52bf28089bc785 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Mon, 29 Jun 2026 09:49:29 +0930 Subject: [PATCH] crowdstrike: fix streaming system test mock to handle reconnection with offset The streaming input appends ?offset=N to the feed URL when reconnecting after a stream ends. The mock server only had a rule for /events with no query parameters (offset: null), so reconnection requests got 404, causing the agent to go DEGRADED and failing the system test. Add a catch-all /events rule (without query_params constraints) after the existing rule. It matches reconnection requests and returns an empty 200, preventing the DEGRADED transition. Fixes #19766 Fixes #19773 --- .../falcon/_dev/deploy/docker/files/config.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml b/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml index 84cf411c285..d0a915dc457 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml +++ b/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml @@ -62,6 +62,16 @@ rules: {"metadata":{"customerIDString":"abcabcabc22222","offset":2,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} 400 {"metadata":{"customerIDString":"abcabcabc22223","offset":3,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} + - path: /events + methods: ["GET"] + request_headers: + authorization: ["Token secretsessiontoken"] + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: '' - path: /refresh methods: ["POST"] responses: