Get-FalconHostGroup Filder doesn't seem to work anymore

[cliffporterx]

I noticed recently when the Get-FalconHostGroup command was being run with a filter, at least from how I had it configured with a filter for a name filter, it appears to be no longer working in either recent updates to the module (2.2.6 is the version being used) or back end Crowdstrike updates.

For example, my original script looked for groups with certain names, which the original line was:

Get-FalconHostGroup -Filter "name:*'*Workstations-VDs-*',name:*'*Workstations-ThinClients-*'"

Where I was looking for all groups that started with 'Workstations-VDs-' or 'Workstations-ThinClients-', which worked in previous module versions. However those now come back with null results. I also tried to simplify it for other basic group names to test and it still failed. When running Get-FalconHostGroup with the -Detailed flag without the filter, it will respond back with all groups with the details, and the details does show the names, but any search tried with a filter results with a null result.

I was able to get my intended script lookup to work by changing it with built in Powershell scripting instead, with a command like:

Get-FalconHostGroup -Detailed -All | Where-Object {$_.name -like "Workstations-VDs-*" -or $_.name -like "Workstations-ThinClients-*"}

Would anybody familiar with this lookup have knowledge if something changed or broke that caused the original lookup filter to no longer work? It did work before and the host group names are still the same, and as shown it works with the alternate lookup. So I am wondering if there is a bug with a newer release, something changed in Crowdstrike back end (we did recently get updated to Raptor also), or if I'm just missing something.

[bk-cs]

PSFalcon has no control over how the Filter values work. If something changed that made the search not work anymore, it was on the back end. The name:*'*value*' syntax still works in my testing. I got results using the same sort of search you did in your example.