Edit FalconCorrelationRule - CrowdStrike/psfalcon GitHub Wiki

Edit-FalconCorrelationRule

SYNOPSIS

Modify Falcon NGSIEM correlation rules

DESCRIPTION

Requires 'Correlation Rules: Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String Correlation 'rule_id' (specific version) X
Name String Correlation rule name X
Description String Correlation rule description X
MitreAttack Object[] An object containing MITRE ATT&CK 'tactic_id' and 'technique_id' X
Severity Int32 Correlation rule severity 10
30
50
70
90 		X
Search Object An object containing 'search' properties ('filter', 'lookback', 'outcome', 'trigger_mode', 'use_ingest_time') X
Operation Object An object containing 'operation' properties ('schedule', 'start_on', 'stop_on') X
Status String Correlation rule status active
inactive 		X
State String Correlation rule state published
unpublished 		X
Notification Object[] An object containing 'notifications' properties ('config', 'options', 'type') X
Comment String Audit log comment X

SYNTAX

Edit-FalconCorrelationRule [-Id] <String> [[-Name] <String>] [[-Description] <String>] [[-MitreAttack] <Object[]>] [[-Severity] <Int32>] [[-Search] <Object>] [[-Operation] <Object>] [[-Status] <String>] [[-State] <String>] [[-Notification] <Object[]>] [[-Comment] <String>] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /correlation-rules/entities/rules/v1

falconpy

entities_rules_patch_v1

USAGE

2025-08-05: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️