New FalconReconRule - CrowdStrike/psfalcon GitHub Wiki

New-FalconReconRule

SYNOPSIS

Create Falcon Intelligence Recon monitoring rules

DESCRIPTION

Requires 'Monitoring rules (Falcon Intelligence Recon): Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Array Object[] An array of monitoring rules to create in a single request X
Name String Monitoring rule name
Topic String Monitoring rule topic SA_ALIAS
SA_AUTHOR
SA_BIN
SA_BRAND_PRODUCT
SA_CUSTOM
SA_CVE
SA_DOMAIN
SA_EMAIL
SA_IP
SA_THIRD_PARTY
SA_VIP
Filter String Falcon Query Language expression to limit results
Priority String Monitoring rule priority high
medium
low
Permission String Permission level [public: 'All Intel users', private: 'Recon Admins'] private
public
BreachMonitoring Boolean Monitor for breach data
SubstringMatching Boolean Monitor for substring matches

SYNTAX

New-FalconReconRule [-Name] <String> [-Topic] <String> [-Filter] <String> [-Priority] <String> [-Permission] <String> [[-BreachMonitoring] <Boolean>] [[-SubstringMatching] <Boolean>] [-WhatIf] [-Confirm] [<CommonParameters>]
New-FalconReconRule -Array <Object[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /recon/entities/rules/v1

falconpy

CreateRulesV1

USAGE

Creating a monitoring rule

New-FalconReconRule -Name psfalcon_example -Topic SA_AUTHOR -Filter "author:'example_author'" -Priority low -Permission private

Creating multiple monitoring rules in a single request

$Array = @(
    @{
        name = "psfalcon_example_1"
        topic = "SA_BRAND_PRODUCT"
        filter = "phrase:'psfalcon_example_phrase'"
        priority = "low"
        permissions = "private"
    },
    @{
        name = "psfalcon_example_2"
        topic = "SA_BIN"
        filter = "ccbin:'1234'"
        priority = "medium"
        permissions = "public"
    }
)
New-FalconReconRule -Array $Array

2023-04-25: PSFalcon v2.2.5

⚠️ **GitHub.com Fallback** ⚠️