Get-FalconDetection Filter 'Severity' Returns no Data

[oracle701]

Describe the bug:
The Filter 'severity' returns nothing for Get-FalconDetection. I don't get an error, just no results.
I have confirmed the API I am using contains Detection:Read.

To Reproduce"
Get-FalconDetection -Filter "severity:'low'" - No data returned for this, and all other severities.

Expected behavior:
I would expect all low detections would be listed for the above example. The Filter works for other properties like status and last_seen.

Environment:

• OS: Windows 10\Server 2019
• PowerShell: 7.2\5.1
• PSFalcon: 2.1.7

[bk-cs]

This is not a PSFalcon issue; severity is not a valid filter for the detections API. See the detections API documentation for more details. [ US-1 | US-2 | US-GOV-1 | EU-1 ]

The filter property you're looking for is max_severity_displayname. The API should be returning an error code for using severity, but that's an issue with the API itself and not PSFalcon.

[bk-cs]

I've had functionality within PSFalcon to validate whether or not you're using the proper filter values, but it ended up being more trouble than it was worth because of the lack of documented properties for FQL.

As a general rule, if you don't get results back, you should ask...

• Are there any results that match my query?

In this case, yes, which means one of the following questions must point to something being incorrect.

• Does the property exist in an API response?

No, severity isn't in a detection, but you'll see max_severity_displayname.

• Is my syntax correct?

No, low should be capitalized (Low). You'll see this in a detection, too.

[oracle701]

I looked around as best I could, I did not know of that API page you linked. With no error message, I wasn’t sure where the problem was 😊. I did find ‘max_severity’ on the Swagger page for this under /detects/queries/detects/v1, but it did not have ‘_displayname’ at the end. Thanx again!