[ BUG ] command `Get-FalconIoaExclusion -All -Detailed` is not retrieving all the IOA exclusions (not using v2 of the API)

[conan-chiles]

Describe the bug

hi,
the command Get-FalconIoaExclusion -All -Detailed is not retrieving all IOA exclusions.

It's using the API endpoint /policy/queries/ioa-exclusions/v1 which only returns the older IOA exclusion type, without parent process details.

believe it needs to be updated to use the API endpoint /exclusions/entities/ss-ioa-exclusions/v2 to also retrieve the newer type, with parent process details.

https://supportportal.crowdstrike.com/s/article/Release-Notes-Parent-and-Grandparent-Process-Context-for-Machine-Learning-and-IOA-Exclusions

To Reproduce
have CID with both the newer and older IOA exclusion types, with and without parent process context.

run Get-FalconIoaExclusion -All -Detailed
which should only return the IOA exclusions of the older type

Expected behavior
use v2 of the API, return both types

Environment (please complete the following information):

• OS: N/A
• PowerShell: 7.6.4
• PSFalcon: 2.2.9

Additional context
CS Support case: 02579478

Transcript content
see above CS Support case

[bk-cs]

I have yet to see any official documentation of these APIs, and in my testing, any IOA created with the v1 API is not able to be modified by the v2 API. Normally I would replace all v1 APIs with their v2 counterpart, but that won't work in this scenario. I'll need to think about how I can redirect v1 and v2 IOAs to their proper endpoints.

[conan-chiles]

hi,
an idea

possible interim solution:

rename Get-FalconIoaExclusion to Get-FalconIoaExclusionV1
create Get-FalconIoaExclusionV2 with the v2 API
set Get-FalconIoaExclusion as an alias to Get-FalconIoaExclusionV1

result:

anything using Get-FalconIoaExclusion should continue to work as is.
can invoke v2 as needed.

future:

figure out some magic to make Get-FalconIoaExclusion route to the appropriate API dynamically