zero_trust_assessment

[antmar904]

Hi

I am using PSFalcon 2.1.7 and trying to pull the zero_trust_assessment value but it does not return anything.
Here are the returned results.

zero_trust_assessment : @{modified_time=2/7/2022 4:28:54 PM; sensor_file_status=confirmed; assessment=; assessment_items=}

As you can see the "assessment=" is blank.

[bk-cs]

Have you checked the sub-object to verify whether or not it's truly empty? PowerShell suppresses the content of sub-objects by default when viewing from the console:

PS>$Hosts = Get-FalconHost -Include zero_trust_assessment
PS>$Hosts | fl

device_id             : c4ebee48e3ae42ebbf4248cfbe389157
zero_trust_assessment : @{modified_time=2/4/2022 4:47:51 PM; 
                        sensor_file_status=not deployed; assessment=; 
                        assessment_items=}

device_id             : 0b411c4e6fbc4e528bdf5ae0817546e0
zero_trust_assessment : @{modified_time=2/3/2022 6:20:10 PM; 
                        sensor_file_status=not deployed; assessment=; 
                        assessment_items=}

device_id             : 79e512a318104e0e8cff439555e4cb95
zero_trust_assessment : @{modified_time=2/3/2022 6:19:09 PM; 
                        sensor_file_status=not deployed; assessment=; 
                        assessment_items=}

PS>$Hosts.zero_trust_assessment | fl

modified_time      : 2/4/2022 4:47:51 PM
sensor_file_status : not deployed
assessment         : @{sensor_config=48; os=0; overall=48; version=3.2.0}
assessment_items   : @{os_signals=System.Object[]; 
                     sensor_signals=System.Object[]}

modified_time      : 2/3/2022 6:20:10 PM
sensor_file_status : not deployed
assessment         : @{sensor_config=29; os=56; overall=37; version=3.2.0}
assessment_items   : @{os_signals=System.Object[]; 
                     sensor_signals=System.Object[]}

modified_time      : 2/3/2022 6:19:09 PM
sensor_file_status : not deployed
assessment         : @{sensor_config=28; os=57; overall=39; version=3.2.0}
assessment_items   : @{os_signals=System.Object[]; 
                     sensor_signals=System.Object[]}

If it is truly empty, it's most likely due to the device itself having no assessment results. You can verify this using Get-FalconZta:

Get-FalconZta -Ids <id>

[antmar904]

It's returning a value using Get-FalconZta

assessment : @{sensor_config=94; os=95; overall=94; version=3.2.0}

[bk-cs]

So it sounds like it's working as expected--it's just that PowerShell is misleading you.

Try this, and you should see all the results:

Get-FalconHost -Include zero_trust_assessment | ConvertTo-Json -Depth 8

[antmar904]

ty