[ BUG ] `Get-FalconWorkflow -All` does not complete when a draft workflow is present

[GT-PE]

Describe the bug
When a Draft workflow exists in an environment Get-FalconWorkflow -All does not complete. The command simply hangs (it is stuck in a loop) and does not return any results.

To Reproduce

1. Create a Draft workflow in an existing or new Workflow.
2. Run the Get-FalconWorkflow -All command against the CS Instance.

Expected behavior
Details of ALL workflows should be returned

Environment (please complete the following information):

• OS: Windows 11 24H2
• PowerShell: 7.5.4
• PSFalcon: 2.2.9

Additional context
Removal of the Draft workflow allows the command to run.

Transcript content

**********************
PowerShell transcript start
Start time: 20260102132046
Username: AzureAD\REDACTED
RunAs User: AzureAD\REDACTED
Configuration Name: 
Machine: REDACTED (Microsoft Windows NT 10.0.26100.0)
Host Application: C:\Program Files\PowerShell\7\pwsh.dll
Process ID: 28040
PSVersion: 7.5.4
PSEdition: Core
GitCommitId: 7.5.4
OS: Microsoft Windows 10.0.26100
Platform: Win32NT
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1, 6.0, 7.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
WSManStackVersion: 3.0
**********************
Transcript started, output file is C:\Users\REDACTED\Documents\PowerShell_transcript.REDACTED.v7lrMIaO.20260102132046.txt
PS C:\Users\REDACTED> Show-FalconModule

PSVersion      : Core [7.5.4]
ModuleVersion  : v2.2.9 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1}
ModulePath     : C:\Users\REDACTED\Documents\PowerShell\Modules\PSFalcon\2.2.9
UserModulePath : C:\Users\REDACTED\Documents\PowerShell\Modules;C:\Program Files\PowerShell\Modules;c:\program
                 files\powershell\7\Modules;C:\Program
                 Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
UserHome       : C:\Users\REDACTED
UserAgent      : crowdstrike-psfalcon/2.2.9

PS C:\Users\REDACTED> $InstanceWorkflows=Get-FalconWorkflow -All
VERBOSE: 13:20:58 [Get-FalconWorkflow] /workflows/combined/definitions/v1:get
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:58 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:58 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:58 GMT, Transfer-Encoding=chunked, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=9dc4c06d-dec4-4e02-967e-bd7525e10d7c, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:58 [Write-Result] query_time=1E-07, pagination.offset=0, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=9dc4c06d-dec4-4e02-967e-bd7525e10d7c
VERBOSE: 13:20:58 [Get-FalconWorkflow] Retrieved 29 of 30
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500&offset=29
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:58 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:58 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:58 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=d1c11705-153b-4e6d-828d-c8839e41adde, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:58 [Write-Result] query_time=6.2E-08, pagination.offset=29, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=d1c11705-153b-4e6d-828d-c8839e41adde
VERBOSE: 13:20:58 [Get-FalconWorkflow] Retrieved 29 of 30
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500&offset=29
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:58 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:58 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:58 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=d76fd845-c6a6-4c90-92ff-73d06224f583, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:58 [Write-Result] query_time=5.2E-08, pagination.offset=29, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=d76fd845-c6a6-4c90-92ff-73d06224f583
VERBOSE: 13:20:58 [Get-FalconWorkflow] Retrieved 29 of 30
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500&offset=29
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:58 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:58 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:59 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=bc831685-3169-4a9b-a328-0ecb81297ed2, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:58 [Write-Result] query_time=9.3E-08, pagination.offset=29, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=bc831685-3169-4a9b-a328-0ecb81297ed2
VERBOSE: 13:20:58 [Get-FalconWorkflow] Retrieved 29 of 30
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500&offset=29
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:58 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:58 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:59 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=4dd5c99a-e6b0-4ee2-a159-a1ae109fb997, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:58 [Write-Result] query_time=6.9E-08, pagination.offset=29, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=4dd5c99a-e6b0-4ee2-a159-a1ae109fb997
VERBOSE: 13:20:58 [Get-FalconWorkflow] Retrieved 29 of 30
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500&offset=29
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:58 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:58 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:59 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=4c8030df-8849-4c94-b753-ddc981cbe973, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:58 [Write-Result] query_time=7.1E-08, pagination.offset=29, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=4c8030df-8849-4c94-b753-ddc981cbe973
VERBOSE: 13:20:58 [Get-FalconWorkflow] Retrieved 29 of 30
VERBOSE: 13:20:58 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/workflows/combined/definitions/v1?limit=500&offset=29
VERBOSE: 13:20:58 [ApiClient.Invoke] Accept=application/json
VERBOSE: 13:20:59 [ApiClient.Invoke] 200: OK
VERBOSE: 13:20:59 [ApiClient.Invoke] Server=nginx, Date=Fri, 02 Jan 2026 13:20:59 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=8096d79c-d2de-4b39-bdc9-777eab1ed65b, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 13:20:59 [Write-Result] query_time=5.7E-08, pagination.offset=29, pagination.limit=500, pagination.total=30, powered_by=workflow-api, trace_id=8096d79c-d2de-4b39-bdc9-777eab1ed65b
VERBOSE: 13:20:59 [Get-FalconWorkflow] Retrieved 29 of 30
PS C:\Users\REDACTED> TerminatingError(): "The pipeline has been stopped."
>> TerminatingError(): "The pipeline has been stopped."
>> TerminatingError(): "The pipeline has been stopped."
>> TerminatingError(): "The pipeline has been stopped."
>> TerminatingError(): "The pipeline has been stopped."
PS C:\Users\REDACTED> Stop-Transcript
**********************
PowerShell transcript end
End time: 20260102132313
**********************

[bk-cs]

@GT-PE

Can you provide an example of the draft workflow that is causing the issue? It doesn't seem to be all draft workflows, but draft workflows with specific properties. In my test CID, I created a draft on-demand workflow and did not encounter this problem. When using a different CID with draft workflows, the problem does occur, but I can't tell which workflow is causing it.

Get-FalconWorkflow -All behaves properly until the draft workflow is encountered. You can see this if you add a Limit value and don't save directly to a variable:

Get-FalconWorkflow -Limit 10 -All

My initial suspicion is that this issue is related to what the API is returning when the problematic draft workflow is present, rather than something PSFalcon is doing.