Filtering detections by Status

[matwmatw]

When I open the Crowdstrike Falcon console and go to 'Endpoint detections', it shows that we have marked 253 detections with a Status of "Closed", and 5 are still marked as "New". I am trying to access that information through PSFalcon.

When I run: Get-FalconDetection -Filter "status:'new'" -Total
I get a result of: 206

When I run: Get-FalconDetection -Filter "status:'closed'" -Total
I get a result of: 0

Any idea what could be causing the disparity what I see from Get-FalconDetection vs the console?

[bk-cs]

With the switchover to Raptor, "detections" became "alerts" (despite still being called "detections" in the Falcon UI). While Get-FalconDetection still works and still shows endpoint detections, eventually it will be deprecated and Get-FalconAlert will be your only option.

Have you tried using Get-FalconAlert? I just tested closing a detection in my environment through the Falcon UI and noticed that the corresponding detection displayed by Get-FalconDetection did not update, while the corresponding "alert" did.

[matwmatw]

That works - thanks!