Can I use Get-FalconHost to pull selected fields for all managed clients

[mclea11]

Hello, I'm trying to use PSFalcon Get-FalconHost to pull selected fields for all managed clients and output the results to a csv file. The problem I'm having is that it will run for hours and not finish (script below). If I remove most of the selected fields and leave just device_id, cid and agent_load for example, it will finish in about 10 minutes. Any ideas?

import-module psfalcon

$outputFile = 'C:\temp\Crowdstrike\data\HostDetails-v5.csv'
remove-item $outputFile -Force
Request-FalconToken -ClientId XXXXXXXXXXXXXXXXXXXXX -ClientSecret XXXXXXXXXXXXXXXXXXXXXXX -Cloud eu-1

Get-FalconHost -Detailed -All | select device_id,cid,agent_load_flags,agent_local_time,agent_version,bios_manufacturer,bios_version,build_number,config_id_base,config_id_build,config_id_platform,
cpu_signature,external_ip,mac_address,hostname,first_seen,last_seen,local_ip,machine_domain,major_version,minor_version,os_version,os_build,ou,platform_id,platform_name,policies,reduced_functionality_mode,
device_policies,groups,group_hash,product_type,product_type_desc,provision_status,serial_number,service_pack_major,service_pack_minor,pointer_size,site_name,status,system_manufacturer,system_product_name,tags,
modified_timestamp,slow_changing_modified_timestamp,meta,SiteName | Export-FalconReport | Export-Csv $outputFile -NoTypeInformation -Force

[bk-cs]

Export-FalconReport exports to CSV, so you don't have to pipe it to Export-Csv.

How many hosts are in your environment? Could you re-run the command with $VerbosePreference = 'Continue' and Start-Transcript? That will produce a log that could point to potential problems.

If you're not using the latest version of PSFalcon, I also recommend that you upgrade.

[mclea11]

If I run this "Get-FalconHost -Detailed | Export-FalconReport $outputFile" it will pull back the details for the first 100 hosts in about a minute. I'm running it now with the -All option (Get-FalconHost -Detailed -All | Export-FalconReport $outputFile). I think I tried this before and it ran for hours, but I've tried so many things that I'm not sure now. I'll let this run for a while and let you know.

[mclea11]

It's been running for 2.5 hours, I just stopped it.

[bk-cs]

• Are you using a virtual machine for the script? Can you use a physical machine to rule out resource constraints?
• Do you have home folder redirection turned on (i.e. your module is loading/operating across the network)? Can you load the module locally?
• Do you have limited bandwidth? Do you have another connection you could try?

I can export ~1,500 hosts to CSV in less than a minute:

PS> get-falconhost -total
1551
PS> measure-command { get-falconhost -detailed -all | export-falconreport .\hosts.csv }


Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 54
Milliseconds      : 338
Ticks             : 543383605
TotalDays         : 0.000628916209490741
TotalHours        : 0.0150939890277778
TotalMinutes      : 0.905639341666667
TotalSeconds      : 54.3383605
TotalMilliseconds : 54338.3605

I would expect 70,000 hosts to take less than 15 minutes to export to CSV. What about exporting to Json?

Get-FalconHost -Detailed -All | ConvertTo-Json -Depth 8 >> .\hosts.json

Json takes significantly less time for me too (~3 seconds for ~1,500 hosts) -- I'm guessing that pipelining to Export-Csv (or Export-FalconReport) consumes a lot of cycles.

PS> measure-command { get-falconhost -detailed -all | convertto-json -depth 8 >> .\hosts.json }


Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 3
Milliseconds      : 320
Ticks             : 33201182
TotalDays         : 3.84272939814815E-05
TotalHours        : 0.000922255055555556
TotalMinutes      : 0.0553353033333333
TotalSeconds      : 3.3201182
TotalMilliseconds : 3320.1182

[bk-cs]

Looking into it further, it seems like Export-FalconReport is adding the overhead, not Export-Csv. Export-FalconReport processes the entire list at once in order to figure out all the appropriate columns to add to the final export because of some weird PowerShell behavior with CSVs.

I can remove this and drastically increase the speed of Export-FalconReport, but then exports will regularly break as some hosts will have fields that aren't present in all others.

Using Json will avoid this problem.

[mclea11]

There's definitely a resource issue on my laptop. When running either script it will consume all free ram and start paging out to disk. So, we modified our custom script to basically write the host details to the csv every 100 hosts. This drastically reduced the utilization and the run time. The run time is down to 10 minutes now.

I'd still like to get the PSFalcon version of the script to run. So, I'll look into switching to Json format.

Thanks for all your help!