Wildcards not Working in Filters

[w-lewis]

When attempting to search for hosts using a filter with a wildcard (*), Get-FalconHost returns an error "400: Invalid filter expression supplied"

PS C:\> Get-FalconHost -Filter "hostname:'vp-*''"
Format-Result : 400: Invalid filter expression supplied
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.0.6\Private\Private.ps1:995 char:17
+                 Format-Result -Response $Response -Endpoint $Endpoint
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (StatusCode: 400...ication/json
}:HttpResponseMessage) [Format-Result], Exception
    + FullyQualifiedErrorId : 86b843d7-204d-4d6a-ad8b-c3680cffa513,Format-Result

Using the same filter in the uri with Invoke-RestMethod returns agent ids as expected.

PS C:\> Invoke-RestMethod -Uri "https://api.crowdstrike.com/devices/queries/devices-scroll/v1?limit=5000&filter=hostname:'vp-*'" -Headers $header

meta                                                                                                         resources                                                                                                               
----                                                                                                         ---------                                                                                                               
@{query_time=0.014501614; pagination=; powered_by=device-api; trace_id=f2d84b60-df39-495c-810e-8bab94c212a1} {cc41595e...

[bk-cs]

Filters, and the Falcon Query Language, work differently for each API. This issue is not specific to PSFalcon. PSFalcon passes the filter value you provide to the API, so the error 400: Invalid filter expression supplied is coming from the API itself--that's not how wildcards work with this API.

The API that is used by the command Get-FalconHost uses wildcards by default with the hostname property. To search for a hostname that starts with vp-, you can use this filter:

Get-FalconHost -Filter "hostname:'vp-'"

To search for an exact hostname, you have to explicitly define the exact search format (which is also case sensitive):

Get-FalconHost -Filter "hostname:['vp-example']"

If the filter does not wildcard by default, generally you can use the following expression (or sometimes you can include the wildcard like you did in your original example):

Get-FalconHost -Filter "example:*'filter*'"