Get FalconFileVantageChange - CrowdStrike/psfalcon GitHub Wiki

Get-FalconFileVantageChange

SYNOPSIS

Search for Falcon FileVantage changes

DESCRIPTION

Requires 'Falcon FileVantage: Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String[] FileVantage change identifier X X
Filter String Falcon Query Language expression to limit results

action_timestamp
ingestion_timestamp
host.name
severity
Sort String Property and direction to sort results action_timestamp|asc
action_timestamp|desc
ingestion_timestamp|asc
ingestion_timestamp|desc
Limit Int32 Maximum number of results per request 1 5000
After String Pagination token to retrieve the next set of results
Detailed Switch Retrieve detailed information
All Switch Repeat requests until all available results are retrieved
Total Switch Display total result count instead of results

SYNTAX

Get-FalconFileVantageChange [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-After <String>] [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconFileVantageChange -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /filevantage/entities/changes/v2
GET /filevantage/queries/changes/v3

falconpy

highVolumeQueryChanges
getChanges

USAGE

2024-01-24: PSFalcon v2.2.6

⚠️ **GitHub.com Fallback** ⚠️