Get FalconIocHost - CrowdStrike/psfalcon GitHub Wiki

Get-FalconIocHost

SYNOPSIS

Search for hosts that have observed a custom indicator

DESCRIPTION

Requires 'IOCs: Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Type String Indicator type domain
ipv4
ipv6
md5
sha256
X
Value String Indicator value X
Limit String Maximum number of results per request 1 100
Offset Int32 Position to begin retrieving results
All Switch Repeat requests until all available results are retrieved
Total Switch Display the total result count instead of results

SYNTAX

Get-FalconIocHost [-Type] <String> [-Value] <String> [[-Limit] <String>] [-Offset <Int32>] [-All] [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconIocHost [-Type] <String> [-Value] <String> -Total [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /indicators/aggregates/devices-count/v1
GET /indicators/queries/devices/v1

falconpy

DevicesRanOn
DevicesCount

USAGE

Getting the host count

Get-FalconIocHost -Type <string> -Value <string> -Total

Getting the list of hosts that have seen an IOC

Get-FalconIocHost -Type <string> -Value <string>

2023-04-25: PSFalcon v2.2.5

⚠️ **GitHub.com Fallback** ⚠️