Edit FalconNgsCase - CrowdStrike/psfalcon GitHub Wiki

Edit-FalconNgsCase

SYNOPSIS

Modify a Falcon NGSIEM case

DESCRIPTION

Requires 'Cases: Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Name String Case name X
Severity String Case severity X
Description String Case description X
Status String Case status new
in_progress
reopened
closed 		X
CustomField Object[] Objects containing 'custom_fields' properties ('id', 'values') X
SlaActive Boolean SLA status X
AssignedUuid String User identifier for case assignment X
RemoveUuid Boolean Remove assigned user from case X
Template Object Object containing case template properties ('id') X
Id String Case identifier X X

SYNTAX

Edit-FalconNgsCase [[-Name] <String>] [[-Severity] <String>] [[-Description] <String>] [[-CustomField] <Object[]>] [[-SlaActive] <Boolean>] [[-AssignedUuid] <String>] [[-RemoveUuid] <Boolean>] [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]
Edit-FalconNgsCase [[-Status] <String>] [[-Template] <Object>] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /cases/entities/cases/v2
PUT /cases/entities/cases/v2

falconpy

entities_cases_patch_v2
entities_cases_put_v2

USAGE

Modify a case

Edit-FalconNgsCase -Name 'P2: Credential Misuse' -AssignedUuid <uuid> -Id <id>

2025-09-22: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️