[ QUESTION ] `Get-FalconCompleteCase` detection IDs aren't usable with `Get-FalconDetection`

[mpetitb]

Describe the bug
The Id format expected by Get-FalconDetection is not the same as the id returned by the detection included inside a FalconCompleteCase.

To Reproduce

1. Query FalconCompleteCases :

PS > $messages = Get-FalconCompleteCase -All -Detailed
PS > $subset_messages = $messages | ? { $_.type -eq "13300"}

2. Display an arbitrary message object and focus on its "detections" key :

PS > $subset_messages[0].detections | format-list
id  : abcdef1234567890abcdefabcdef1231:ngsiem:abcdefabcdefabcdefabcdef12345678:fedfedfedabcabcabc123123abcdefab
url : https://falcon.eu-1.crowdstrike.com/unified-detections/abcdef1234567890abcdefabcdef1231:ngsiem:abcdefabcdefabcdefabcdef12345678:fedfedfedabcabcabc123123abcdefab?_cid=abdhfkfifdgsfklj14332jksdflfioo

3. Query Get-FalconDetection using the id returned by the command above (The following id have been hidden) (or by any of these "id-like")

PS > $d = Get-FalconDetection -Id "abcdef1234567890abcdefabcdef1231:ngsiem:abcdefabcdefabcdefabcdef12345678:fedfedfedabcabcabc123123abcdefab"
Get-FalconDetection: Cannot validate argument on parameter 'Id'. The argument "abcdef1234567890abcdefabcdef1231:ngsiem:abcdefabcdefabcdefabcdef12345678:fedfedfedabcabcabc123123abcdefab" does not match the "^ldt:[a-fA-F0-9]{32}:\d+$" pattern. Supply an argument that matches "^ldt:[a-fA-F0-9]{32}:\d+$" and try the command again.

Expected behavior
(Get-FalconCompleteCase -All -Detailed)[0].detections.id
and the id expected by Get-FalconDetection should match

Environment (please complete the following information):

• PSFalcon: 2.2.7 (but also happens in 2.2.9)

[bk-cs]

https://supportportal.crowdstrike.com/s/article/Tech-Alert-90-Day-Notice-Planned-Decommission-Announcement-of-the-DetectionSummaryEvent-and-detects-API

The /detects/ APIs have been deprecated and the relevant APIs will no longer be accessible on September 30, 2025. With the release of PSFalcon v2.2.9, the Get-FalconDetection and related commands were removed.

With the release of Falcon NGSIEM, "detections" are displayed in the /alerts/ API. You can use Get-FalconAlert to provide information on any "detection" ID values.