Get-FalconScript -Detailed fails

[M1kep]

Hello,

For some reason Get-FalconScript -Detailed $true is failing without much of a reason, while it does work without the Detailed flag. I've provided some details below:

PS /Users/***> Get-FalconScript -Detailed $true -Debug -Verbose
VERBOSE: [Get-Query] filter=True
VERBOSE: [Invoke-Endpoint] GET https://api.crowdstrike.com/real-time-response/queries/scripts/v1
DEBUG: [Format-Header] Accept: 'application/json'
DEBUG: [Read-Meta] 500: binservclient.MsaPutFileResponse
VERBOSE: [Read-Meta] trace_id: ef11a888-c139-4314-8ef3-37c29effd603
DEBUG: [Format-Result]
{
  "meta": {
    "query_time": 1.22E-07,
    "powered_by": "crowdstrike-api-gateway",
    "trace_id": "ef11a888-c139-4314-8ef3-37c29effd603"
  },
  "errors": [
    {
      "code": 500,
      "message": "Internal Server Error: Please provide trace-id='ef11a888-c139-4314-8ef3-37c29effd603' to support"
    }
  ]
}

[M1kep]

Device Details incase needed:

Name                           Value
----                           -----
PSVersion                      7.1.1
PSEdition                      Core
GitCommitId                    7.1.1
OS                             Darwin 20.3.0 Darwin Kernel Version 20.3.0: Thu Jan 21 00:06:51 PST 2021; root:xnu-7195.81.3~1/RELEASE_ARM64_T8101
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[bk-cs]

Thanks for the report and the detailed information!

I don't think this is a case of the -Detailed failing -- I think the problem is due to how you're using it. In your example, you're treating it like a [boolean] (when it should be a [switch]) and the command thinks you're supplying the value of $true for -Filter because of the position of the argument.

This part is the giveaway, because it's saying that Get-Query is appending filter=True to the URL path:

PS /Users/***> Get-FalconScript -Detailed $true -Debug -Verbose
VERBOSE: [Get-Query] filter=True

In other words, PowerShell is interpreting what you wrote as:

PS /Users/***> Get-FalconScript -Filter True -Detailed -Debug -Verbose

Which is failing because filter=True is an improper value.

Here's the proper way to write the command:

PS /Users/***> Get-FalconScript -Detailed