Function to Retrieve past executions of scheduled reports

[datorr2]

Currently, the functions available in PSFalcon allow:

• Querying Scheduled Report metadata (Get-FalconScheduledReport)
• Execute a Scheduled Report on-demand/ad-hoc (Invoke-FalconScheduledReport)
• Redo a past execution (Redo-FalconScheduledReport)
• Download an execution (Receive-FalconScheduledReport)

However, the metadata that gets returned from Get-FalconScheduledReport only has the last_execution and not previous executions.

The GET /reports/queries/report-executions/v1 endpoint allows retrieving of execution IDs.
The GET /reports/entities/report-executions/v1 endpoint allows retrieving the details of those executions.

It would be useful to be able to have a function that would allow handling of report executions in addition to the existing functionality around their parent scheduled reports. Example use-case: Report is scheduled to run daily, but employees only work M-F, so would want to check for any executions over the weekend, or on days off.

[bk-cs]

Have you tried Get-FalconScheduledReport with the -Execution switch?

[datorr2]

No. Apparently, I missed that.

However, after trying that, it only pulls metadata around an execution with a known ID.

How would I get a list of execution IDs using PSFalcon?

Example

Request

https://api.[cloudname].crowdstrike.com/reports/queries/report-executions/v1?q=<scheduled_report_id>

Response

{
  "meta": {
    "query_time": 0.024051705,
    "pagination": {
      "offset": 0,
      "limit": 100,
      "total": 30
    },
    "powered_by": "reports",
    "trace_id": "<REDACTED>"
  },
  "resources": [
    "executionidhash1",
    "executionidhash2",
    "executionidhash3",
    ...
  ],
  "errors": []
}

[bk-cs]

As far as I know, that API endpoint does not exist. The best you can do at the moment is to retrieve the recent executions from a report and use those identifiers.

EDIT: This is incorrect--didn't see it when I CTRL-F'd Swagger.

[datorr2]

As far as I know, that API endpoint does not exist.

It's listed on Swagger:

https://assets.[cloudname].crowdstrike.com/support/api/swagger-eagle.html#/report-executions
https://assets.[cloudname].crowdstrike.com/support/api/swagger-eagle.html#/report-executions/report-executions.get
https://assets.[cloudname].crowdstrike.com/support/api/swagger-eagle.html#/report-executions/report-executions.query

And the output in #319 (reply in thread) is from a real execution in Swagger, just redacted for customer privacy.

[bk-cs]

As far as I know, that API endpoint does not exist.

It's listed on Swagger:

https://assets.[cloudname].crowdstrike.com/support/api/swagger-eagle.html#/report-executions https://assets.[cloudname].crowdstrike.com/support/api/swagger-eagle.html#/report-executions/report-executions.get https://assets.[cloudname].crowdstrike.com/support/api/swagger-eagle.html#/report-executions/report-executions.query

And the output in #319 (reply in thread) is from a real execution in Swagger, just redacted for customer privacy.

Sorry, I missed it when searching.

This will return execution ids:

Get-FalconScheduledReport -Execution

Including -Detailed in the example above will include details, or you can use -Id:

Get-FalconScheduledReport -Execution -Id <id>,<id>,<id>

Examples are also available on the wiki: https://github.com/CrowdStrike/psfalcon/wiki/Get-FalconScheduledReport