[ Q&A ] Get-FalconHost -include content_state - unable to read content_state detail

[bbivmb]

Describe the bug
$AllHosts = Get-FalconHost -All -Include content_state does not return content_state values

To Reproduce
Get-FalconHost -All -Include content_state
or
Get-FalconHost -Filter "platform_name:'Windows'" -Detailed -All -Include content_state

We get the following for content_state property for all hosts queried:
content_state: @{system_critical=; rapid_response_content=; vulnerability_management=; sensor_operations=}

Expected behavior
I would like to retrieve the content update states for hosts in our environment

Environment (please complete the following information):

• OS: Windows 11
• PowerShell: Desktop [5.1.26100.7705]
• PSFalcon: 2.2.9

Additional context
Add any other context about the problem here.

Transcript content
If possible, please include a PowerShell transcript.

1. Set $VerbosePreference = 'Continue'
2. Run Import-Module, Request-FalconToken, Start-Transcript, Show-FalconModule, the affected PSFalcon commands or script, and Stop-Transcript
3. Copy/paste transcript content

[bk-cs]

I'm not able to reproduce this in my test environment. Can you provide more information?

• Is this consistent for all hosts in your environment?
• Are you able to retrieve content state information when using Get-FalconHost -Id <id> -State?

If possible, please include a verbose transcript.

1. Run Import-Module, Request-FalconToken
2. Set $VerbosePreference = 'Continue'
3. Run Start-Transcript, the affected PSFalcon commands or script, and Stop-Transcript
4. Copy/paste transcript content

[bbivmb]

bug524_ps_transcript.txt

Please find the transcript attached.
I ran both
Get-FalconHost -Filter "device_id: ''" -All -Detailed -Include content_state
AND
Get-FalconHost -Id -State
but none provided the content update details
content_state : @{system_critical=; rapid_response_content=; vulnerability_management=; sensor_operations=}

[bk-cs]

Sorry, I gave you the wrong command when I asked you to use Get-FalconHost -Id <id> -State to check for content state information. That's online state information. You can ignore that.

However, I can see the content details in your examples:

content_state : @{system_critical=; rapid_response_content=; vulnerability_management=; sensor_operations=}

What you're seeing is default PowerShell display behavior for complex objects. If you want to see the values under system_critical below content_state, you need to reference that specific property in the object. Here are some ways to do that:

$Obj = Get-FalconHost -Filter "device_id:'id'" -Include content_state -Detailed
$Obj | Select-Object -ExpandProperty content_state
$Obj.content_state.system_critical
$Obj.content_state | ConvertTo-Json

[bbivmb]

Managed to retrieve the content state details I wanted, thanks to your advice. Much appreciated!