Get FalconDetection - CrowdStrike/psfalcon GitHub Wiki

Get-FalconDetection

SYNOPSIS

Search for detections

DESCRIPTION

Requires 'Detections: Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String[] Detection identifier X X
Filter String Falcon Query Language expression to limit results

behaviors.parent_details.parent_md5
behaviors.parent_details.parent_process_graph_id
behaviors.parent_details.parent_cmdline
behaviors.parent_details.parent_sha256
behaviors.parent_details.parent_process_id
behaviors.confidence
behaviors.severity
behaviors.triggering_process_id
behaviors.filename
behaviors.sha256
behaviors.user_name
behaviors.user_id
behaviors.behavior_id
behaviors.timestamp
behaviors.alle
behaviors.objective
behaviors.tactic
behaviors.technique
behaviors.pattern_disposition
behaviors.cmdline
behaviors.triggering_process_graph_id
behaviors.ioc_type
behaviors.ioc_source
behaviors.ioc_value
behaviors.device_id
device.first_seen
device.last_seen
device.modified_timestamp
device.site_name
device.config_id_platform
device.system_manufacturer
device.bios_manufacturer
device.platform_name
device.hostname
device.config_id_build
device.os_version
device.bios_version
device.agent_load_flags
device.release_group
device.status
device.product_type_desc
device.machine_domain
device.agent_local_time
device.device_id
device.system_product_name
device.product_type
device.cid
device.external_ip
device.major_version
device.minor_version
device.platform_id
device.config_id_base
device.ou
device.agent_version
device.local_ip
device.mac_address
device.cpu_signature
device.reduced_functionality_mode
device.serial_number
hostinfo.domain
hostinfo.active_directory_dn_display
quarantined_files.paths
quarantined_files.state
quarantined_files.sha256
quarantined_files.id
q
date_updated
assigned_to_name
max_confidence
detection_id
max_severity
max_severity_displayname
seconds_to_triaged
seconds_to_resolved
status
adversary_ids
cid
first_behavior
last_behavior
Query String Perform a generic substring search across available fields
Sort String Property and direction to sort results adversary_id.asc
adversary_id.desc
devices.hostname.asc
devices.hostname.desc
first_behavior.asc
first_behavior.desc
last_behavior.asc
last_behavior.desc
max_confidence.asc
max_confidence.desc
max_severity.asc
max_severity.desc
Limit Int32 Maximum number of results per request 1 5000
Offset Int32 Position to begin retrieving results
Detailed Switch Retrieve detailed information
All Switch Repeat requests until all available results are retrieved
Total Switch Display total result count instead of results

SYNTAX

Get-FalconDetection [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-Offset <Int32>] [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconDetection -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /detects/queries/detects/v1
POST /detects/entities/summaries/GET/v1

falconpy

QueryDetects
GetDetectSummaries

USAGE

Find detections

Get-FalconDetection -Filter "status:'new'+first_behavior:>'2020-01-01'" -Sort first_behavior.desc [-Detailed] [-All]

Find unassigned detections

Get-FalconDetection -Filter "assigned_to_uid:null" [-All]

2023-04-25: PSFalcon v2.2.5

⚠️ **GitHub.com Fallback** ⚠️