Get FalconScheduledReport - CrowdStrike/psfalcon GitHub Wiki

Get-FalconScheduledReport

SYNOPSIS

Search for scheduled report or searches and their execution information

DESCRIPTION

Requires 'Scheduled Reports: Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String[] Scheduled report or scheduled search identifier X X
Filter String Falcon Query Language expression to limit results

created_on
description
expiration_on
last_execution.last_updated_on
last_execution.status
last_updated_on
name
next_execution_on
shared_with
start_on
status
stop_on
type
user_id

Execution:
created_on
expiration_on
last_updated_on
result_metadata
scheduled_report_id
shared_with
status
type
user_id
Query String Perform a generic substring search across available fields
Sort String Property and direction to sort results created_on.asc
created_on.desc
last_updated_on.asc
last_updated_on.desc
last_execution_on.asc
last_execution_on.desc
next_execution_on.asc
next_execution_on.desc
Limit Int32 Maximum number of results per request 1 5000
Offset Int32 Position to begin retrieving results
Execution Switch Retrieve information about scheduled report execution(s)
Detailed Switch Retrieve detailed information
All Switch Repeat requests until all available results are retrieved
Total Switch Display total result count instead of results

SYNTAX

Get-FalconScheduledReport [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-Offset <Int32>] [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconScheduledReport -Id <String[]> -Execution [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconScheduledReport -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]
Get-FalconScheduledReport [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-Offset <Int32>] -Execution [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /reports/entities/report-executions/v1
GET /reports/entities/scheduled-reports/v1
GET /reports/queries/report-executions/v1
GET /reports/queries/scheduled-reports/v1

falconpy

scheduled_reports_query
report_executions_get
scheduled_reports_get
report_executions_query

USAGE

List the first five scheduled report IDs that match a filtered search

Get-FalconScheduledReport -Filter "created_on:<'2021-09-15'+status:'ACTIVE'+type:['hosts','spotlight_remediations']" -Limit 5 [-Detailed]

Retrieve details about a scheduled report

Get-FalconScheduledReport -Id <id>, <id>

List the first five scheduled report execution IDs that match a filtered search

Get-FalconScheduledReport -Filter "created_on:<'2021-10-01'+type:['hosts','dashboard']" -Limit 5 -Sort created_on.desc -Execution [-Detailed]

Retrieve details about a scheduled report execution

Get-FalconScheduledReport -Id <id>, <id> -Execution

2024-09-03: PSFalcon v2.2.7

⚠️ **GitHub.com Fallback** ⚠️