[ BUG ] Get-FalconAsset with -Include login_events does not add results for all assets

[Tibap]

Describe the bug
The Get-FalconAsset commandlet with the "-include 'login_event'" parameter does not work as expected

To Reproduce
1/ Run command to get login events for all falcon assets: Get-FalconAsset -detailed -All -include 'login_event' -Filter "entity_type:'managed'" | select hostname, login_event
Result: Most of the login_events returned are empty. In my environment, just one entry is populated. From the list returned, grab a hostname where there is no login_event for step 2.

2/ Run command with a filter on the specific hostname:
Get-FalconAsset -detailed -All -include 'login_event' -Filter "entity_type:'managed'+hostname:'XXX'" | select hostname, login_event
Result: The login_event information is correctly populated.

Expected behavior
The command to get login events for all falcon assets should work.

Environment (please complete the following information):

• OS: [Windows 10]
• PowerShell: [5.1]
• PSFalcon: [2.2.4]

[bk-cs]

Thank you for the report. I'll investigate and update once I've had time to test.

[bk-cs]

I believe I have this fixed for the next release. Can you please test it on your end and verify whether or not it resolves the issue for you?

First, update your local copy of Public\discover.ps1 with the changes from the upcoming 2.2.5 release:

(Invoke-WebRequest https://raw.githubusercontent.com/CrowdStrike/psfalcon/2.2.5/public/discover.ps1).content > $HOME\Documents\WindowsPowerShell\Modules\PSFalcon\2.2.4\Public\discover.ps1

Then import PSFalcon with the modified file (removing the module first, if already loaded), request your token and run the command again:

if (Get-Module PSFalcon) { Remove-Module PSFalcon }
Import-Module PSFalcon
Request-FalconToken <your API client parameters go here>
Get-FalconAsset -Detailed -All -Include 'login_event' -Filter "entity_type:'managed'" | Select-Object hostname,login_event

[Tibap]

Yes, i have login_event for all hosts hosts now. Thanks for the quick fix!

[bk-cs]

Keeping open for people to utilize fix before release.

[bk-cs]

2.2.5 release