Retrieving Vulnerability Closed Date via PSFalcon API

[kpoznanski5]

Hello.

When retrieving vulnerability data via PS Falcon Get-FalconVulnerability command, the object has a property called “created_timestamp” which I assume is the equivalent to the "Created Date" on the CrowdStrike console. Please confirm.

Now, I am looking for a property which is the equivalent to the "Closed Date" on the CrowdStrike console.
I can't find it. Please help me to determine the "Closed Date" of the vulnerability when importing data using PSFalcon.
Thank you.

Kris

[bk-cs]

Once a vulnerability has status: closed, there is a closed_timestamp property present on the vulnerability record. You can filter by status or closed_timestamp to find them.

Get-FalconVulnerability -Filter "status:'closed'"

Get-FalconVulnerability -Filter "closed_timestamp:>'now-30d'"

[kpoznanski5]

Perfect. It works. Thank you.

[kpoznanski5]

Is it possible to retrieve these attributes too:

Closed Dwell Time
CVSS Version
Closed Product Versions
AdditionalRemediationAdvisoryUrl
AdditionalRemediationSteps

[bk-cs]

You can try including all of the available Facet values and see what is present. PSFalcon doesn't have any control over what the available APIs produce, and it's possible that the UI has access to data that the API doesn't.

[kpoznanski5]

Thank you BK.