Error when execute "run-a-command-against-a-group-of-devices.ps1"

[yak1ra]

Invoke-FalconRtr by itself works correctly.
Invoke-FalconRtr -command runscript -Argument '-cloudfile=xxxx' -GroupId xxxxxxxxxxx

But when I run the sample script, I get this error

---

Invoke-FalconRtr : The expression after '&' in a pipeline element produced an object that was not valid. It must result in a command name, a script block,or a CommandInfo object.
At C:\temp\run-a-command-against-a-group-of-devices.ps1:39 char:1

• Invoke-FalconRtr @param | Export-Csv -Path $OutputFile

•   + CategoryInfo          : InvalidOperation: (:) [Invoke-FalconRtr]、RuntimeException
    + FullyQualifiedErrorId : BadExpression,Invoke-FalconRtr
  

---

I have the following in the command parameter, is this correct?
runscript -Argument '-cloudfile=xxxx'

To isolate, change the execution part of the script as follows,
#Invoke-FalconRtr @param | Export-Csv -Path $OutputFile
Invoke-FalconRtr runscript $Command -GroupID $GroupId

I entered the following parameters and it worked
-cloudfile=xxxx

So I think the problem is in the [-command:] parameter entry.

Thank you,

[bk-cs]

Give this version a try:

#Requires -Version 5.1
using module @{ModuleName='PSFalcon';ModuleVersion ='2.2'}
<#
.SYNOPSIS
Search for a Host Group by name, execute a command on the members of the group using Real-time Response and output
results to CSV
.PARAMETER GroupName
Host group name
.PARAMETER Command
Real-time Response command
.PARAMETER Argument
Arguments to include with the command
.PARAMETER QueueOffline
Add non-responsive hosts to the offline queue
#>
param(
    [Parameter(Mandatory,Position=1)]
    [string]$GroupName,
    [Parameter(Mandatory,Position=2)]
    [string]$Command,
    [Parameter(Position=3)]
    [string]$Argument,
    [boolean]$QueueOffline
)
# Find group identifier using 'name' filter
$GroupId = Get-FalconHostGroup -Filter "name:'$($GroupName.ToLower())'"
if (!$GroupId) { throw "No host group found matching '$($GroupName.ToLower())'." }

# Set CSV output file name and baseline Invoke-FalconRtr parameters
$OutputFile = Join-Path (Get-Location).Path "$('rtr',($Command -replace ' ','_'),$GroupId -join '_').csv"
$Param = @{ GroupId = $GroupId }

# Add Command/Argument/QueueOffline status
switch ($PSBoundParameters.Keys) {{ $_ -ne 'GroupName' } { $Param[$_] = $PSBoundParameters.$_ }}

# Use 'Invoke-FalconRtr' and output result to CSV
Invoke-FalconRtr @Param | Export-Csv -Path $OutputFile
if (Test-Path $OutputFile) { Get-ChildItem $OutputFile | Select-Object FullName,Length,LastWriteTime }

[yak1ra]

Thanks for the reply.
I tried new version, but it still didn't work..

$Param = @{ GroupId = $GroupId }
I thought this part was wrong, so I fixed it as follows,

$Param = @{ Command= $Command ; GroupId = $GroupId }
But ,this also resulted in an error.

I modified the previous $Param and modified the Invoke-FalconRtr executable.
This worked

Invoke-FalconRtr -command runscript -argument '-cloudfile=xxx' @param

I think it is a problem with the script, do you know what it is?

[bk-cs]

Can you give an example of how you're running the script? It's designed so that it does not need to be modified -- everything it needs comes from the command line parameters when you execute the script.

[yak1ra]

Here’s the log I ran
(I ran the script as it was given to me)

---

PS C:\temp> .\run-a-command-against-a-group-of-devices20231011.ps1

cmdlet run-a-command-against-a-group-of-devices20231011.ps1 at command pipeline position 1
Supply values for the following parameters:
GroupName: xxxx_test
Command: runscript -argument '-cloudfile=Demo'
Invoke-FalconRtr: C:\temp\run-a-command-against-a-group-of-devices20231011.ps1:37
Line |
37 | Invoke-FalconRtr @param | Export-Csv -Path $OutputFile
| ~~~~~~~~~~~~~~~~~~~~~~~
| The expression after '&' in a pipeline element produced an object that was not valid. It must result in a
| command name, a script block, or a CommandInfo object.

FullName Length LastWriteTime
C:\temp\rtr_runscript_-argument_'-cloudfile=Demo'_4dc7c8a111e3447fbc213aae398492b9.csv 0 2023/10/11 11:14:45

---

Is the way the parameters are given correct?
Are the comma places correct?

[bk-cs]

No, it should look like this:

PS> .\run-a-command-against-a-group-of-devices.ps1 -GroupName <group_name> -Command runscript -Argument "-CloudFile='demo'"

[yak1ra]

It worked fine with the information you gave me.
Thaks!