Server Error in Application for Indicator page

[ineedasolution]

I’m trying to build an internal Falcon Orchestrator server but I have received this error. I can see calls the to the local disk for Visual Studio files, however, I don’t see this account anywhere on the local disk.

Can you advise how to solve the problem?

The remote server returned an error: (401) Unauthorized.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Net.WebException: The remote server returned an error: (401) Unauthorized.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[WebException: The remote server returned an error: (401) Unauthorized.]
System.Net.HttpWebRequest.GetResponse() +1390
FalconOrchestrator.IOC.ApiUtil.Response(HttpWebRequest request) in C:\Users\Falcon\Documents\Visual Studio 2015\Projects\FalconOrchestrator\FalconOrchestrator.IOC\Utility.cs:65
FalconOrchestrator.IOC.IndicatorsAPI.List() in C:\Users\Falcon\Documents\Visual Studio 2015\Projects\FalconOrchestrator\FalconOrchestrator.IOC\Indicators.cs:59
FalconOrchestratorWeb.Controllers.IndicatorController.Index() in C:\Users\Falcon\Documents\Visual Studio 2015\Projects\FalconOrchestrator\FalconOrchestrator.Web\Controllers\IndicatorController.cs:38
lambda_method(Closure , ControllerBase , Object[] ) +62
System.Web.Mvc.ActionMethodDispatcher.Execute(ControllerBase controller, Object[] parameters) +14
System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary2 parameters) +182 System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary2 parameters) +27
System.Web.Mvc.Async.<>c__DisplayClass42.b__41() +28
System.Web.Mvc.Async.<>c__DisplayClass81.<BeginSynchronous>b__7(IAsyncResult _) +10 System.Web.Mvc.Async.WrappedAsyncResult1.End() +50
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +32
System.Web.Mvc.Async.<>c__DisplayClass39.b__33() +58
System.Web.Mvc.Async.<>c__DisplayClass4f.b__49() +225
System.Web.Mvc.Async.<>c__DisplayClass37.b__36(IAsyncResult asyncResult) +10
System.Web.Mvc.Async.WrappedAsyncResult1.End() +50 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +34 System.Web.Mvc.Async.<>c__DisplayClass2a.<BeginInvokeAction>b__20() +24 System.Web.Mvc.Async.<>c__DisplayClass25.<BeginInvokeAction>b__22(IAsyncResult asyncResult) +99 System.Web.Mvc.Async.WrappedAsyncResult1.End() +50
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +27
System.Web.Mvc.<>c__DisplayClass1d.b__18(IAsyncResult asyncResult) +14
System.Web.Mvc.Async.<>c__DisplayClass4.b__3(IAsyncResult ar) +16
System.Web.Mvc.Async.WrappedAsyncResult1.End() +50 System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +36 System.Web.Mvc.Async.<>c__DisplayClass4.<MakeVoidDelegate>b__3(IAsyncResult ar) +16 System.Web.Mvc.Async.WrappedAsyncResult1.End() +50
System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +26
System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.EndExecute(IAsyncResult asyncResult) +10
System.Web.Mvc.<>c__DisplayClass8.b__3(IAsyncResult asyncResult) +25
System.Web.Mvc.Async.<>c__DisplayClass4.b__3(IAsyncResult ar) +16
System.Web.Mvc.Async.WrappedAsyncResult`1.End() +50
System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +28
System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult result) +9
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9744261
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +155

[mr-burnse]

This is due to the fact you have not saved your Falcon Query API credentials in the system. Navigate to Admin > Configuration > Falcon Query API and input your username & password (support can provide these to you). Once valid credentials are saved you should no longer see this error. Let me know if you run into any other issues!

[ineedasolution]

Hi Evan,

When I try to start the Falcon service I get the following error: 2016-07-07 17:36:39,708 FATAL FalconOrchestrator.Client.FalconOrchestratorService - Connection to database failed.

Any ideas?

[mr-burnse]

Check the file C:\Program Files (x86)\Falcon Orchestrator\FalconOrchestrator.Client.exe.config and make sure the sql connection string has the proper User ID and password set. This needs to be an account with sufficient access to the FalconOrchestrator database. Also if you installed SQL as an instance, ensure you use hostname\SQLEXPRESS as the datasource.

[ineedasolution]

Hi Evan,

Even after entering the Query API credentials I am still experiencing the page error identified last week, however, it is responding with the error code (400) bad request shown below:

[WebException: The remote server returned an error: (400) Bad Request.]
System.Net.HttpWebRequest.GetResponse() +1390
FalconOrchestrator.IOC.ApiUtil.Response(HttpWebRequest request) in C:\Users\Falcon\Documents\Visual Studio 2015\Projects\FalconOrchestrator\FalconOrchestrator.IOC\Utility.cs:65
FalconOrchestrator.IOC.IndicatorsAPI.List() in C:\Users\Falcon\Documents\Visual Studio 2015\Projects\FalconOrchestrator\FalconOrchestrator.IOC\Indicators.cs:62
FalconOrchestratorWeb.Controllers.IndicatorController.Index() in C:\Users\Falcon\Documents\Visual Studio 2015\Projects\FalconOrchestrator\FalconOrchestrator.Web\Controllers\IndicatorController.cs:38
lambda_method(Closure , ControllerBase , Object[] ) +62
System.Web.Mvc.ActionMethodDispatcher.Execute(ControllerBase controller, Object[] parameters) +14
System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary2 parameters) +182 System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary2 parameters) +27
System.Web.Mvc.Async.<>c__DisplayClass42.b__41() +28
System.Web.Mvc.Async.<>c__DisplayClass81.<BeginSynchronous>b__7(IAsyncResult _) +10 System.Web.Mvc.Async.WrappedAsyncResult1.End() +50
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +32
System.Web.Mvc.Async.<>c__DisplayClass39.b__33() +58
System.Web.Mvc.Async.<>c__DisplayClass4f.b__49() +225
System.Web.Mvc.Async.<>c__DisplayClass37.b__36(IAsyncResult asyncResult) +10
System.Web.Mvc.Async.WrappedAsyncResult1.End() +50 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +34 System.Web.Mvc.Async.<>c__DisplayClass2a.<BeginInvokeAction>b__20() +24 System.Web.Mvc.Async.<>c__DisplayClass25.<BeginInvokeAction>b__22(IAsyncResult asyncResult) +99 System.Web.Mvc.Async.WrappedAsyncResult1.End() +50
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +27
System.Web.Mvc.<>c__DisplayClass1d.b__18(IAsyncResult asyncResult) +14
System.Web.Mvc.Async.<>c__DisplayClass4.b__3(IAsyncResult ar) +16
System.Web.Mvc.Async.WrappedAsyncResult1.End() +50 System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +36 System.Web.Mvc.Async.<>c__DisplayClass4.<MakeVoidDelegate>b__3(IAsyncResult ar) +16 System.Web.Mvc.Async.WrappedAsyncResult1.End() +50
System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +26
System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.EndExecute(IAsyncResult asyncResult) +10
System.Web.Mvc.<>c__DisplayClass8.b__3(IAsyncResult asyncResult) +25
System.Web.Mvc.Async.<>c__DisplayClass4.b__3(IAsyncResult ar) +16
System.Web.Mvc.Async.WrappedAsyncResult`1.End() +50
System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +28
System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult result) +9
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9744261
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +155

I am also seeing the following log entry:

2016-07-12 13:57:05,048 FATAL FalconOrchestrator.Client.FalconOrchestratorService - An unhandled error occured
System.IO.IOException: Unable to read data from the transport connection: The connection was closed.
at System.Net.ConnectStream.Read(Byte[] buffer, Int32 offset, Int32 size)
at System.IO.StreamReader.ReadBuffer()
at System.IO.StreamReader.ReadLine()
at FalconOrchestrator.Client.FalconOrchestratorService.ProcessStream(Stream firehose)
at FalconOrchestrator.Client.FalconOrchestratorService.Invoke()

Can you advise?

Are you available for a webex?

Thanks

[mr-burnse]

Do you have any type of proxy server in front of the Falcon Orchestrator server? Yes, please email me directly at evan.burns@crowdstrike.com and we can co-ordinate a call.

[ghost]

What was the solution for this? I'm having the same issue.

I also did save my Falcon Query API credentials.

Thanks

[mr-burnse]

It appears this is due to a new bug that was introduced. For the time being the Indicators component will not be functional, I'll be releasing an updated build shortly which will address this and number of other features.

[mr-burnse]

Closing off, duplicate of issue #5 which will be addressed in next release.