[ Q&A ] Get-FalconAsset additional properties not working

[BatVogt]

Describe the bug

Script Get-FalconAsset crashes when including additional properties browser_extension, host_info or install_usage

To Reproduce

# Any of these doesn't work
Get-FalconAsset -Include host_info
Get-FalconAsset -Detailed -Include host_info

Expected behavior
Retreiving browser_extension, host_info and install_usage

Environment:

• OS: Windows 11
• PowerShell: 5.1
• PSFalcon: 2.2.7 and 2.2.8

Transcript content
Transcript doesn't differ from normal. Except of course :

PS C:\<redacted>> Get-FalconAsset -Detailed -Include host_info
Cannot validate argument on parameter 'Include'. The argument "host_info" does not belong to the set
"login_event,system_insights,third_party,risk_factors" specified by the ValidateSet attribute. Supply an argument that
is in the set and then try the command again.
Au caractère C:\<redacted>\Documents\WindowsPowerShell\Modules\PSFalcon\2.2.8\public\discover.ps1:182 : 41
+           if ($Valid -notcontains $_) { throw $Message } elseif ($_ - ...
+                                         ~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (Cannot validate... command again.:String) [], RuntimeException
    + FullyQualifiedErrorId : Cannot validate argument on parameter 'Include'. The argument "host_info" does not belon
   g to the set "login_event,system_insights,third_party,risk_factors" specified by the ValidateSet attribute. Supply
   an argument that is in the set and then try the command again.

[bk-cs]

The Include values for Get-FalconAsset are different depending on what switches you are using, because each of those switches targets a different API.

• Get-FalconAsset: login_event, system_insights, third_party, risk_factors
• Get-FalconAsset -Application: browser_extension, host_info, install_usage
• Get-FalconAsset -Account: login_event

In your example, you're calling the "assets" API which doesn't allow host_info.

[bk-cs]

When investigating your question, I did find that the command was outputting some identifier values as it performs the Include additions. I've put in a fix so that doesn't happen, but it won't impact the use of the command since the identifiers are being sent to the host stream.

[BatVogt]

The Include values for Get-FalconAsset are different depending on what switches you are using, because each of those switches targets a different API.

• Get-FalconAsset: login_event, system_insights, third_party, risk_factors
• Get-FalconAsset -Application: browser_extension, host_info, install_usage
• Get-FalconAsset -Account: login_event

In your example, you're calling the "assets" API which doesn't allow host_info.

I completely didn't understand that it worked that way. My apologies and thank you very much for the clarification 🙏