[ BUG ] Get-FalconAsset code 400 error offset 10000 and limit 100

[dako76]

Describe the bug Write-Result : {"code":400,"message":"offset 10000 and limit 100 are invalid; offset + limit must be less than or equal to 10000"} At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\private\Private.ps1:660 char:19

• $Output = Write-Result $Object

• 
  + CategoryInfo          : InvalidResult: (@{resources=System.Object[]}:PSObject) [Write-Result], Exception
  + FullyQualifiedErrorId : Write-Result

To Reproduce Get-FalconAsset over 300000 Assets

Expected behavior We like to have a list of all assets.

Environment (please complete the following information):

• OS: Windows Server 2022
• PowerShell: 5.1
• PSFalcon: 2.2.6

Additional context Add any other context about the problem here.

Transcript content

---

Windows PowerShell transcript start Start time: 20240118152336 Username: xxx RunAs User: xxx Configuration Name: Machine: xxx (Microsoft Windows NT 10.0.20348.0) Host Application: C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe Process ID: 12328 PSVersion: 5.1.20348.2110 PSEdition: Desktop PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.20348.2110 BuildVersion: 10.0.20348.2110 CLRVersion: 4.0.30319.42000 WSManStackVersion: 3.0 PSRemotingProtocolVersion: 2.3 SerializationVersion: 1.1.0.1

---

Transcript started, output file is C:\Users\xxx

PSVersion : Desktop [5.1.20348.2110] ModuleVersion : v2.2.6 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1} ModulePath : C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6 UserModulePath : C:\Users\xxx\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files\Microsoft Monitoring Agent\Agent\PowerShell\ UserHome : C:\Users\xxx UserAgent : crowdstrike-psfalcon/2.2.6

Write-Result : {"code":400,"message":"offset 10000 and limit 100 are invalid; offset + limit must be less than or equal to 10000"} At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\private\Private.ps1:663 char:9

• Write-Result $Object

• 
  + CategoryInfo          : InvalidResult: (@{resources=System.Object[]}:PSObject) [Write-Result], Exception
  + FullyQualifiedErrorId : Write-Result
  Write-Result : {"code":400,"message":"offset 10000 and limit 100 are invalid; offset + limit must be less than or equal to 10000"}
  At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\private\Private.ps1:663 char:9

• Write-Result $Object

• 
  + CategoryInfo          : InvalidResult: (@{resources=System.Object[]}:PSObject) [Write-Result], Exception
  + FullyQualifiedErrorId : Write-Result

92df66f9xxxxxxxxxxx here are all the ids reduced and xxx 92df66f9xxxxxxxxxxx 92df66f9xxxxxxxxxxx

---

Windows PowerShell transcript end End time: 20240118152358

---

[bk-cs]

This is a normal an expected error. Most of the CrowdStrike APIs return a maximum of 10,000 results.

You need to use Filter to break your total results into groups of less than 10,000, then use -All with those filtered groups.

You can test your filters using -Total to ensure that the results are lower than 10,000.