User Guide:

Troubleshooting

Known Issues & Workarounds

PowerShell Core Suggestion Messages

Issue: When running Hawk commands, particularly during tenant investigations, users may see repeated "Suggestion [4,General]: The most similar commands are..." messages. This behavior appears to be related to PowerShell's command suggestion feature, which became a mainstream (non-experimental) feature in PowerShell 7.5. For technical details and current status, see GitHub Issue #261.

PowerShell Core suggestion message example

Impact:

  • Only occurs in PowerShell Core
  • Only affects Tenant Investigation functions that use Exchange Online cmdlets
  • Does not affect Hawk data collection or results
  • Purely cosmetic issue with command suggestions

Current Workaround:

Users who find these messages particularly disruptive may prefer to use PowerShell Desktop, where this issue does not occur.

Long-term Fix:

We continue to investigate the root cause of this behavior in PowerShell Core and will update the documentation when a more permanent solution is identified.




IPStack API Key Management

Issue: Hawk currently lacks a built-in method to update existing IPStack API keys or add new ones after initial setup. If an API key is missing, invalid, or expired, Hawk will display error messages during IP geolocation attempts, such as:

[2025-05-08 10:15:22Z] - [ERROR] - Failed to retrieve location for IP 192.168.1.1

The current workflow has several limitations: the API key prompt appears mid-investigation rather than during initialization; skipping the initial key entry saves an empty string that can't be easily corrected; and once a key is stored (even if invalid), Hawk doesn't re-prompt for a replacement on subsequent runs.

For technical details and current status, see GitHub Issue #210.

Impact:

  • Users may experience unexpected IP geolocation failures
  • API key changes require manual configuration file editing
  • Error messages appear during IP resolution attempts when key is missing or invalid

Current Workaround:

To update or insert your IPStack API key, manually edit the configuration file:

  1. Navigate to: C:\Users\[YOUR USERNAME]\AppData\Local\Hawk\Hawk.json
  2. Open the file in a text editor
  3. Replace your old key with the new one, or add a key if there's an empty string

Example 1: Replacing an existing key

// Current configuration:
{
"access_key": "YOUR-OLD-KEY"
}

// Update to:
{
"access_key": "YOUR-NEW-KEY"
}

Example 2: Adding a key when there's an empty string

// Current configuration:
{
"access_key": ""
}

// Update to:
{
"access_key": "YOUR-NEW-KEY"
}

Long-term Fix:

We're working on a comprehensive solution that will:

  • Add a command-line parameter for the API key
  • Move the API key prompt to initialization
  • Validate API keys to prevent empty/invalid values
  • Add a dedicated function to update the API key
  • Improve error handling for missing/invalid keys




Spread Your Wings


Go Back

Review the previous section: User Investigation.

Circle Back