Edit FalconNgsParser - CrowdStrike/psfalcon GitHub Wiki
Modify Falcon NGSIEM parsers
Requires 'NGSIEM Parsers: Write'.
| Name | Type | Description | Min | Max | Allowed | Pipeline | PipelineByName |
|---|---|---|---|---|---|---|---|
| Id | String | Parser identifier | X | ||||
| Repository | String | Repository name | parsers-repository |
X | |||
| Script | String | Parser script to transform input into events | X | ||||
| TestCase | Object[] | An example event and output | X | ||||
| FieldToRemoveParsing | String[] | X | |||||
| FieldToTag | String[] | Event fields to tag during parsing | X |
Edit-FalconNgsParser [-Id] <String> [-Repository] <String> [-Script] <String> [-TestCase] <Object[]> [[-FieldToRemoveParsing] <String[]>] [[-FieldToTag] <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]PATCH /ngsiem-content/entities/parsers/v1
2025-08-05: PSFalcon v2.2.9
