Invoke-FalconHostAction

SYNOPSIS

Perform actions on hosts

Requires 'Hosts: Write', plus related permission(s) for 'Include' selection(s).

Name	Type	Description	Allowed	Pipeline	PipelineByName
Name	String	Action to perform	`contain` `detection_suppress` `detection_unsuppress` `hide_host` `lift_containment` `lift_filesystem_containment_all` `unhide_host`
Include	String[]	Include additional properties	`agent_version` `cid` `external_ip` `filesystem_containment_status` `first_seen` `host_hidden_status` `hostname` `last_seen` `local_ip` `mac_address` `os_build` `os_version` `platform_name` `product_type` `product_type_desc` `reduced_functionality_mode` `serial_number` `system_manufacturer` `system_product_name` `tags`
Id	String[]	Host identifier		X	X

Invoke-FalconHostAction [-Name] <String> [[-Include] <String[]>] [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

POST /devices/entities/devices-actions/v2

Invoke-FalconHostAction -Name contain -Id <id>, <id>

Invoke-FalconHostAction -Name lift_containment -Id <id>, <id>

Invoke-FalconHostAction -Name hide_host -Id <id>, <id>

Invoke-FalconHostAction -Name unhide_host -Id <id>, <id>

2025-09-19: PSFalcon v2.2.9