Varying Property Count when using get-falconhost

[gmellendorf-dxc]

Using psfalcon 2.0.8.

Some hosts in my environment don't have values for some of their properties. It appears that the returned object is defined based on the first host returned. Here are successive run of get-falconhost:

PS C:> (get-falconhost -Detailed -All -Limit 5000 | gm | where-object{$_.MemberType -eq "NoteProperty"}).count
45

PS C:> (get-falconhost -Detailed -All -Limit 5000 | gm | where-object{$_.MemberType -eq "NoteProperty"}).count
39

PS C:> (get-falconhost -Detailed -All -Limit 5000 | gm | where-object{$_.MemberType -eq "NoteProperty"}).count
39

PS C:> (get-falconhost -Detailed -All -Limit 5000 | gm | where-object{$_.MemberType -eq "NoteProperty"}).count
45

Property Comparison - Properties Missing Limited Results

PS C:> $g1 = get-falconhost -Detailed -All -Limit 5000 | gm | where-object{$.MemberType -eq "NoteProperty"}
PS C:> $g1.count 39
PS C:> $g2 = get-falconhost -Detailed -All -Limit 5000 | gm | where-object{$.MemberType -eq "NoteProperty"}
PS C:> $g2.count 45

PS C:> Compare-Object -ReferenceObject $g1.name -DifferenceObject $g2.name

InputObject SideIndicator

---

local_ip =>
machine_domain =>
mac_address =>
ou =>
provision_status =>
site_name =>

Need help to get consistent results...

[bk-cs]

This is not something PSFalcon is doing, it's a combination of how the API works and how you're looking for the properties.

The APIs will not return various properties for an object if they're not present. For example, in my testing environment, none of my devices are joined to a domain and the machine_domain, ou and site_name properties do not show up in a Get-FalconHost result.

The way you're counting makes it look like properties are missing, too. You need to check the members of each item in the array, not the array itself:

PS> $Array = @([PSCustomObject] @{ a = 1; b = 2 }, [PSCustomObject] @{ a = 1; b = 2; c = 3 })
PS> ($Array | gm | where { $_.membertype -eq 'noteproperty' }).count
2
PS> $array.foreach{ ($_ | gm | where { $_.membertype -eq 'noteproperty' }).count }
2
3