Get FalconIntel - CrowdStrike/psfalcon GitHub Wiki

Get-FalconIntel

SYNOPSIS

Search for Falcon Intelligence reports

DESCRIPTION

Requires 'Reports (Falcon Intelligence): Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String[] Report identifier X X
Filter String Falcon Query Language expression to limit results

actors
actors.name
created_date
description
id
last_modified_date
motivations
motivations.value
name
short_description
sub_type
sub_type.value
tags
tags.value
target_countries
target_countries.value
target_industries
target_industries.value
type
type.value
Query String Perform a generic substring search across available fields
Sort String Property and direction to sort results name|asc
name|desc
target_countries|asc
target_countries|desc
target_industries|asc
target_industries|desc
type|asc
type|desc
created_date|asc
created_date|desc
last_modified_date|asc
last_modified_date|desc
Limit Int32 Maximum number of results per request 1 5000
Field String[] Specific fields, or a predefined collection name surrounded by two underscores [default: basic]
Offset Int32 Position to begin retrieving results
Detailed Switch Retrieve detailed information
All Switch Repeat requests until all available results are retrieved
Total Switch Display total result count instead of results

SYNTAX

Get-FalconIntel [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-Offset <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconIntel -Id <String[]> [[-Field] <String[]>] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconIntel [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Field] <String[]>] [-Offset <Int32>] -Detailed [-All] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /intel/combined/reports/v1
GET /intel/entities/reports/v1
GET /intel/queries/reports/v1

falconpy

QueryIntelReportIds
GetIntelReportEntities
QueryIntelReportEntities

USAGE

Search for report IDs by criteria

Get-FalconIntel -Filter "target_countries:'united states'+target_industries:'government'"

Search for reports using a specific ID

Get-FalconIntel -Id <id>, <id>

Search for detailed report information

Get-FalconIntel -Filter "target_countries:'afghanistan'" -Limit 1 -Detailed

2025-09-19: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️