Receive FalconNgsCaseFile - CrowdStrike/psfalcon GitHub Wiki

Receive-FalconNgsCaseFile

SYNOPSIS

Download files from Falcon NGSIEM cases

DESCRIPTION

Requires 'Cases: Read'.

Providing multiple identifiers will be bunded into a ZIP archive.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String Case file identifier X X

SYNTAX

Receive-FalconNgsCaseFile [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /case-files/entities/files/download/v1

falconpy

entities_files_download_get_v1

USAGE

2025-08-11: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️