Ticketing Stack Trace Issue

[crowdstrike]

Ticketing Stack Trace Issue

[mr-burnse]

I have not been able to reproduce. Do you currently have any tickets created or is this the first time attempting to navigate to the tickets view? Also did you install via the provided MSI package or your own build...I see a reference to C:\Users\eerickson\Downloads\falcon-orchestrator-1.0.0\falcon-orchestrator-1.0.0\FalconOrchestrator.Web\Repository\TicketingRepository.cs:7 which leads me to believe you compiled yourself?

[esquared617]

Evan,
It is basically the first time navigating to the tickets.  Don't know if it is relevant, but clicking on Indicators returns an (400) Bad Request. 
I did recompile the msi because it failed repeatedly to create the database so I modified that portion to "Continue on Error =yes" in the database.wxs and manually created the database and tables using the scripts. I did verify the requirements (roles, etc) and matched the OS (2012 R2) and SQL version (2014) to what you specified in the Install documentation. 
Outside of that, the only differences in the recompile would be the versions of MVC and .Net components (Razor, Web.Infrastructure, etc) Shown below.
To be completely honest, I am NOT a developer so it is completely possible and probably likely I have messed this up severly in the recompile; however, it seems only the two functions listed are not working so its almost functional. 
From a holistic perspective, not sure why I couldn't get the database installation to work. Tried using my account which has DA rights and a local account with admin rights on the server.  Doing a SQL trace during install never showed anything touching the SQL server.  Which led to modifying the MSI as described above. 
By the way, I think Brent has setup a call on Thursday with you around this.  I don't want to waste a bunch of your time but we have a small Infosec team and the Orchestrator functionality will be very helpful to them on a daily basis otherwise I would have given up a long time ago.  ;-)
Regards,Eric

[mr-burnse]

Hey Eric, glad the project can be useful to your team! I'm happy to help you get it deployed. I recently came across this and still need to update the documentation...when installing you need to use a local sql account and not a windows account otherwise the install won't complete properly. This is likely the cause of your installation issues with the MSI. For installation purposes you can use the sql SA account and change it afterwards or just create a new account within SSMS with adequate permissions.

On our call Thursday, I suggest we walk through re-installing with this in mind. I suspect this will resolve the issue you're seeing within the ticketing module. I'm going to close this ticket and we can troubleshoot further Thursday. Cheers!

[esquared617]

Evan,
I was able to successfully install Orchestrator on a new production box using the information you provided.  Thank you very much.  The only issue I have (outside of the known 400 error in Indications) is getting the dashboard and Detections to populate.  I have double verified I save both API keys but won't seem to pull data. 
If I can get this resolved, I would say there is no need for the call scheduled tomorrow.  ;-)
Eric

[mr-burnse]

Eric, have you started the Falcon Orchestrator Windows service (https://github.com/CrowdStrike/falcon-orchestrator/wiki/Installation-&-Deployment#starting-the-service)? If so, are you seeing any errors in the RunLog? There's a section right underneath in the Wiki which provides some basic troubleshooting. Please start the service and send any errors you're seeing. Also to see new detections coming into Orchestrator, make sure you use the refresh button on the top right in the navigation bar.

[esquared617]

Per our conversation, generating a new API key seems to be the resolution. Thanks again for your time and efforts.