Permission required to use query_vulnerability

[aosti]

Hello FalconPy Community,

I am encountering an issue with the Falcon Intel API when using FalconPy and was hoping for some guidance or suggestions on how to resolve it.

I have a falcon client that works for getting the actors, but when I attempt to use the query_vulnerability method, it returns an error 403. Which permission do I need to execute this operation?

[jshcodes]

Hi @aosti -

Thank you for the question!

Does your key have the Vulnerabilities (Falcon Intelligence) scope assigned?

[poncion]

Hello, I’m collaborating with Aosti in this case, and we are using the Vulnerabilities (Falcon Intelligence) scope.
'code': 403, 'message': 'access denied, authorization failed'

However, we do not experience this error when using other API methods, such as query_actor_entities.

Our code reference:
https://www.falconpy.io/Service-Collections/Intel.html#queryvulnerabilities

[jshcodes]

I get a 200 with results from the QueryVulnerabilities operation using a key with only the one scope assigned in my test environment.

Can we confirm we have this scope assigned:

and not this one?

Are you using the Service Class example or the Uber Class example?

[poncion]

I can't see the "Vulnerabilities (Falcon Intelligence)" scope in my /api-clients-and-keys. I can see "vulnerabilities" and other Falcon Intelligence scopes. Here’s my list of my scopes in use:

Read Only:

• Vulnerabilities
• Actors (Falcon Intelligence)
• Indicators (Falcon Intelligence)
• Malware Families (Falcon Intelligence)
• Reports (Falcon Intelligence)
• Sandbox (Falcon Intelligence)
• Quick Scan (Falcon Intelligence)

I'm trying to use query_vulnerabilities because I'd like to list all vulnerabilities with specific adversaries.

I'm using Service Classe:

from falconpy.intel import Intel
falcon = Intel(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

response = falcon.query_vulnerabilities()
print(response)

[jshcodes]

The scope should have (Falcon Intelligence) in the name like the others. If Vulnerabilities (Falcon Intelligence) is not one of the available scope options, you may need to reach out to the Support Team to check which products are available in your tenant.