PSFalcon - Vulnerability evaluation_logic

[kpoznanski5]

Hello,

I am using PSFalcon to retrieve vulnerability data (Get-FalconVulnerability).
The Facet section looks like this: Facet = 'cve','evaluation_logic','host_info','remediation'
However, I can't find in the [PSCustomObject] any property where I can get the vulnerability evaluation logic.
The [PSCustomObject] has only these properties:
aid NoteProperty string aid=df9c8e1b066447cda8ce2721aa6b5199
apps NoteProperty Object[] apps=System.Object[]
cid NoteProperty string cid=367186119abf42c3b50812be7a12efb7
created_timestamp NoteProperty string created_timestamp=2022-10-14T14:28:39Z
cve NoteProperty System.Management.Automation.PSCustomObject cve=@{id=CVE-...
host_info NoteProperty System.Management.Automation.PSCustomObject host_info=@{h...
id NoteProperty string id=df9c8e1b066447cda8ce2721aa6b5199_d5e76f7fe7fe3b...
remediation NoteProperty System.Management.Automation.PSCustomObject remediation=@...
status NoteProperty string status=open
suppression_info NoteProperty System.Management.Automation.PSCustomObject suppression_i...
updated_timestamp NoteProperty string updated_timestamp=2023-04-06T13:18:58Z

Could you please help me in retrieving the vulnerability evaluation logic?

Thank you.

Kris

[bk-cs]

The evaluation_logic property is under apps when using the evaluation_logic facet.

[kpoznanski5]

Thank you for the reply. I see the apps part of the object and the evaluation_logic property.
Do you have an example of a PowerShell code that extracts the key elements of the evaluation_logic property into a single string?
That would be very helpful since the evaluation_logic itself has several other attributes:
Name MemberType Definition

---

comparison_check NoteProperty string comparison_check=
determined_by_comparison NoteProperty bool determined_by_comparison=False
existence_check NoteProperty string existence_check=at_least_one_exists
id NoteProperty long id=1831785938217277258
items NoteProperty Object[] items=System.Object[]
negate NoteProperty bool negate=False
title NoteProperty string title=Adobe Acrobat Reader DC Continuous is...
type NoteProperty string type=inventory

Then the items property has yet another set of attributes:

Name MemberType Definition

---

comparison_result NoteProperty string comparison_result=not evaluated
hive NoteProperty string hive=HKEY_LOCAL_MACHINE
item_type NoteProperty string item_type=registry_item
key NoteProperty string key=Software\Adobe\Acrobat Reader\DC\Installer
name NoteProperty string name=ENU_GUID
type NoteProperty string type=reg_sz
value NoteProperty Object[] value=System.Object[]
windows_view NoteProperty string windows_view=32_bit

Then the value seems to be another System.Object[] .
That has so many nested levels, it looks like.
Thank you for your assistance in advance.

Kris

[bk-cs]

What data do you want from evaluation_logic? Converting it into a single string will lose a lot of information, so you'll want to ensure you know what data you want before you try.

Alternatively, you can use something that supports nested output (like Json) by converting the result to Json:

Get-FalconVulnerability ... | ConvertTo-Json -Depth 32 > .\test.json

[kpoznanski5]

Currently, I am just using your sample PS script and extracting just one item from the apps object:
'Vulnerable Product Versions' = $.apps.product_name_version
On the high level, I would like to see for a specific CVE ($.apps.product_name_version) what items have been evaluated and what values they have.
By "single string" I mean it could be a multi-line text but I would like to have it in just one cell.
I am not sure if that helps.
Thank you.

Kris

[bk-cs]

By "single string" I mean it could be a multi-line text but I would like to have it in just one cell. I am not sure if that helps. Thank you.

These objects are much too complex to try and fit it into a single string. Because of the depth, you'd end up having cells with potentially hundreds of lines inside. I would change how you're ingesting this data and use a format that can handle more complex objects (i.e. not CSV).