Get-FalconHost with all, detailed, group name, limit and sort does not complete

[eddietorial]

Running Get-FalconHost -All -Detailed -Include group_names -Limit 1 -Sort last_seen.desc, does not complete. No errors.

Is this a limitation with the Get-FalconHost commandlet?

The intent is to retrieve all falcon end-points including group names and sort descending by last seen and show only first unique value per end-point.

[bk-cs]

This is functioning properly when I test using PowerShell 7 on MacOS.

Is there a reason you're using -Limit 1 with -All? That is counter-intuitive and will only slow down the collection of the results, as it will return 1 at a time instead of 5,000.

Can you provide a transcript?

[eddietorial]

This is using PowerShell 5.1 on Windows 10.

The reason for using -Limit 1 with -All is to get all endpoints, and limit to the most recently seen (in case of duplicates) by a -Sort last_seen.desc

This is the transcript. The "access denied, invalid bearer token" errors are after it timed-out.

**********************
Windows PowerShell transcript start
Start time: 20220921223333
Username: REDACTED
RunAs User: REDACTED
Configuration Name: 
Machine: REDACTED (Microsoft Windows NT 10.0.19042.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe REDACTED.ps1
Process ID: 9884
PSVersion: 5.1.19041.1682
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1682
BuildVersion: 10.0.19041.1682
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Transcript started, output file is REDACTED\PowerShell_transcript.REDACTED.p9venAVJ.20220921223333.txt
Write-Result : [{"code":401,"message":"access denied, invalid bearer token"}]
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.2\Private\Private.ps1:604 char:17
+                 Write-Result $Object
+                 ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
    + FullyQualifiedErrorId : 918f58c6-6284-4a27-9e34-54582954a03d,Write-Result
Write-Result : [{"code":401,"message":"access denied, invalid bearer token"}]
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.2\Private\Private.ps1:604 char:17
+                 Write-Result $Object
+                 ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
    + FullyQualifiedErrorId : 918f58c6-6284-4a27-9e34-54582954a03d,Write-Result

PS>TerminatingError(): "Authorization token request failed."
>> TerminatingError(): "Authorization token request failed."
Invoke-Falcon : Authorization token request failed.
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.2\Public\devices.ps1:217 char:24
+ ...            $Request = Invoke-Falcon @Param -Inputs $PSBoundParameters
+                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-Falcon
Invoke-Falcon : Authorization token request failed.
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.2\Public\devices.ps1:217 char:24
+ ...            $Request = Invoke-Falcon @Param -Inputs $PSBoundParameters
+                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-Falcon

[bk-cs]

Limit only sets the number of results returned per request; it does not impact how the results are sorted. You seem to be receiving the 401 errors (which shouldn't be happening...) because you're attempting to retrieve all results one host at a time. Try this command instead:

Get-FalconHost -All -Detailed -Include group_names -Sort last_seen.desc

[bk-cs]

I also confirmed that this command works as expected on PowerShell 5.1 within Windows 10:

Get-FalconHost -All -Detailed -Limit 1 -Include group_names -Sort last_seen.desc

[eddietorial]

Not sure why but Get-FalconHost -All -Detailed -Limit 1 -Include group_names -Sort last_seen.desc still times-out when I run it.

Get-FalconHost -All -Detailed -Include group_names -Sort last_seen.desc works, but not with the output I would like to see.
The output I get has multiple "last_seen" entries for some hosts.

The expected output is to only get the latest "last_seen" for every unique Falcon end-point. I'll work something out in PowerShell to get the required output.

You may close this out if it is not something currently possible directly with Get-FalconHost.

[bk-cs]

I think you're misunderstanding how the APIs work. There is no way to use the APIs to only return the most recently seen device, unless:

• You perform a search for every hostname in your environment individually (i.e. -Filter "hostname:'PC'") and return with -Limit 1 -Sort last_seen.desc
• You return all results and filter using PowerShell to exclude the devices that aren't the most recently seen

Do you have an issue with duplicate hosts? There is a command that will help you clean those up: https://github.com/CrowdStrike/psfalcon/wiki/Host-and-Host-Group-Management#finding-potential-duplicate-hosts

You can find and hide duplicate hosts in a single step:

Find-FalconDuplicate | Invoke-FalconHostAction hide_host

[eddietorial]

I have been able to work out a solution to -

return all results and filter using PowerShell to exclude the devices that aren't the most recently seen.