New FalconReconRule - CrowdStrike/psfalcon Wiki

New-FalconReconRule

SYNOPSIS

Create Falcon X Recon monitoring rules

DESCRIPTION

Requires 'Monitoring Rules (Falcon X Recon): Write'.

PARAMETERS

Name Type Min Max Allowed Pipeline PipelineByName Description
Array Object[] X An array of monitoring rules to create in a single request
Name String Monitoring rule name
Topic String SA_ALIAS
SA_AUTHOR
SA_BIN
SA_BRAND_PRODUCT
SA_CUSTOM
SA_CVE
SA_DOMAIN
SA_EMAIL
SA_IP
SA_THIRD_PARTY
SA_VIP
Monitoring rule topic
Filter String Falcon Query Language expression to limit results
Priority String high
medium
low
Monitoring rule priority
Permission String private
public
Permission level [public: 'All Intel users', private: 'Recon Admins']

SYNTAX

New-FalconReconRule [-Name] <String> [-Topic] <String> [-Filter] <String> [-Priority] <String> [-Permission] <String> [-WhatIf] [-Confirm] [<CommonParameters>]
New-FalconReconRule -Array <Object[]> [-WhatIf] [-Confirm] [<CommonParameters>]

USAGE

2022-10-06: PSFalcon v2.2.3

⚠️ **GitHub.com Fallback** ⚠️