Inconsistency between Detects Advisor API and New "Endpoint detections" Web Page about falconpy HOT 1 CLOSED

@Skyw3lker - This was covered in some degree back in a release note published on Sept 19, 2023.
The "Endpoint detections (Updated)" should probably have been tagged with (New) vs (Updated) since it's powered by a new detection architecture that was designed for the Raptor platform. The new Endpoint Detections dashboard is powered by the Alerts API endpoints. Keep in mind that this API has several different detection types, so if you want endpoint detections you need to use a filter of product:'epp'. The presentation, architecture and the data between the two is considerably different so you'll want to review it. A very simple and basic explanation of the UI can be found in this document.
One of the biggest changes is that the automatic consolidation was removed so the behaviors that would have been grouped by the process tree by default are now stand alone detections. This allows for custom correlation/grouping as well as a more granular detection methodology. eg If you had a behavior in the old detection that was a FP you couldn't just mark it that way, you had to mark the whole thing as a FP. In the new architecture you can.
If you're interested in associating the endpoint events in the alerts API you should be able to do it by grouping them based on the aggregate_id field value.

from falconpy.