fix(crowdstrike): stop pagination after API errors

[Tatamis]

Summary

Stops the CrowdStrike paginator when the API response contains errors instead of continuing to process the response as a valid paginated result.

FalconPy error responses may contain reduced metadata without a pagination key. Continuing pagination in that case causes the original API error to be replaced by a KeyError: 'pagination'.

This change preserves the existing API error logging and stops processing the invalid response before accessing pagination metadata.

Addresses #7430

Changes

• stop pagination immediately when an API error response is returned
• add a regression test for a 401-style response without meta.pagination
• verify that the original API error remains available instead of raising KeyError

Testing

Ran the full CrowdStrike connector test suite:

228 passed, 2 warnings

The two warnings are existing deprecated configuration warnings and are unrelated to this change.

Also verified:

git diff --check

with no errors.

I did not perform an end-to-end test against a live CrowdStrike/OpenCTI deployment because that would require valid CrowdStrike API credentials.

[filigran-cla-bot]

Contributor License Agreement

✅ CLA signed 💚

Thank you Tatamis for signing the Contributor License Agreement! Your pull request can now be reviewed and merged.

We appreciate your contribution to Filigran's open source projects! ❤️

_{This is an automated message from the Filigran CLA Bot.}

[Copilot]

Pull request overview

Stops CrowdStrike pagination after API errors, avoiding missing pagination metadata and adding regression coverage.

Changes:

• Stops pagination after logged API errors.
• Adds a 401-style missing-pagination regression test.
• Preserves the original API error instead of raising KeyError.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Summary and findings
external-import/crowdstrike/src/crowdstrike_feeds_services/utils/__init__.py	Stops processing errored responses. Critical (3 votes): failure is swallowed and work may be recorded as successful. Moderate (1 vote): empty-body errors can still raise KeyError before the guard.
external-import/crowdstrike/tests/test_paginate_error_logging.py	Adds missing-pagination coverage. Nit (3 votes): add two blank lines between module-level functions.

Suppressed comments (1)

external-import/crowdstrike/src/crowdstrike_feeds_services/utils/init.py:210

• This guard is only reached after errors = response["errors"]. BaseCrowdstrikeClient.handle_api_error normalizes non-2xx responses with an empty body to {}, and the API clients pass that body into paginate, so responses such as an empty-body 403 still raise KeyError: 'errors' before reaching this return. Detect the error/malformed envelope before indexing or normalize every error body to include an error marker.

                # An API error response is not a valid paginated result.
                # FalconPy may return reduced metadata without a ``pagination``
                # key, so stop here instead of trying to process the error
                # response as a successful page.
                return

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.