Skip to content

fix(fcs): add IOM limit validation, improve risks examples, and enhance error handling - #48

Merged
redhatrises merged 4 commits into
CrowdStrike:mainfrom
eeran-cs:fix/fcs-validation-and-error-hints
Sep 10, 2026
Merged

fix(fcs): add IOM limit validation, improve risks examples, and enhance error handling#48
redhatrises merged 4 commits into
CrowdStrike:mainfrom
eeran-cs:fix/fcs-validation-and-error-hints

Conversation

@eeran-cs

@eeran-cs eeran-cs commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • IOM list: add a `--limit` cap of 100 with a clear error message when exceeded (the API returns an error for larger values)
  • Risks list: correct and expand the `--filter` examples — severity values are title case (`High`, `Critical`), and the `cloud_provider` FQL field is unreliable so examples now show `--grep` and `jq` alternatives; fix sort syntax from `field.desc` to `field|desc`
  • Error handling: add a `filterHints` map so `HandleAPIError` surfaces known filter field names on 400 responses; add human-readable keys to `featureRequirements` for the compliance 404 case
  • Rule table columns: expand `ruleTableDef` to include all fields returned by the rules API (`short_code`, `subdomain`, `scope_type`, `description`, `logic`, `logic_format`, `resource_types`, `auto_remediable`, `cloneable`, `visible`, `created_at`, `updated_at`) so they are selectable via `--columns`
  • `--max-col-width` flag: add per-command control over truncation width; `--no-truncate` now correctly disables the 50-char default limit

Test plan

  • `falcon fcs iom list --limit 101` returns a clear error
  • `falcon fcs risks list --filter "severity:'High'"` works
  • `falcon fcs risks list --sort "severity|desc"` works
  • `HandleAPIError` on a 400 from `ContainerCombined` includes the filter field hint
  • Compliance 404 returns the feature-not-provisioned message via the human-readable keys
  • `falcon fcs policies rules list --columns short_code,logic` shows those columns
  • `falcon fcs policies rules list --max-col-width 120` truncates at 120 chars
  • `falcon fcs policies rules list --no-truncate` shows full column values

- Add limit validation to IOM list command (max 100 items)
- Improve risks list command examples with correct severity format and filtering options
- Enhance error handling with filter hints for 400 responses
- Add legacy operation name keys for backward compatibility
Add all meaningful fields from the rules API response to ruleTableDef
so they can be selected via --columns: short_code, subdomain, scope_type,
description, logic, logic_format, resource_types, auto_remediable,
cloneable, visible, created_at, updated_at.

Also add --max-col-width flag to all table-formatted commands so users
can control truncation width without disabling it entirely. --no-truncate
now correctly bypasses the default 50-char limit.
The API accepts title-case values (High, Critical), not uppercase
(HIGH, CRITICAL). Update the --filter examples accordingly.
@redhatrises
redhatrises merged commit 4cf356d into CrowdStrike:main Sep 10, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants