Get FalconNgsSavedQuery - CrowdStrike/psfalcon GitHub Wiki
Search for Falcon NGSIEM saved queries
Requires 'NGSIEM Saved Queries: Read'.
| Name | Type | Description | Min | Max | Allowed | Pipeline | PipelineByName |
|---|---|---|---|---|---|---|---|
| Id | String | Saved query identifier | X | ||||
| Domain | String | Repository or view |
alldashboardsfalconthird-party
|
X | |||
| Filter | String | Falcon Query Language expression to limit results | |||||
| Limit | String | Maximum number of results per request [default: 50] | |||||
| Offset | String | Position to begin retrieving results | |||||
| Detailed | Switch | Retrieve detailed information | |||||
| All | Switch | Repeat requests until all available results are retrieved | |||||
| Total | Switch | Display total result count instead of results |
Get-FalconNgsSavedQuery [-Domain] <String> [[-Filter] <String>] [[-Limit] <String>] [-Offset <String>] [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]Get-FalconNgsSavedQuery [-Id] <String> [-Domain] <String> [-WhatIf] [-Confirm] [<CommonParameters>]GET /ngsiem-content/entities/savedqueries-template/v1
GET /ngsiem-content/queries/savedqueries/v1
ListSavedQueries
GetSavedQueryTemplate
2025-09-02: PSFalcon v2.2.9
