[ BUG ] `New-FalconReconRule` generating `Invalid Request` error with single rule about psfalcon

[jashley92]

Forgot to mention, API Key works when using API directly via Postman.

[bk-cs]

Forgot to mention, API Key works when using API directly via Postman.

Thanks for the added detail! Are you submitting the same fields when creating the rule using Postman?

[bk-cs]

It appears that PSFalcon is incorrectly sending your single rule as an individual object, instead of forcing it into an array (expected by the API). You can work around the problem by creating your rule using the example below until I fix it:

[PSCustomObject]@{ filter = "phrase:'psfalcon_example_phrase'"; priority = 'low'; name = 'psfalcon_example_1'; permissions = 'public'; topic = 'SA_VIP' } | New-FalconReconRule

[jashley92]

Excellent! The workaround works perfect. Thank you so much!