Receive FalconNgsSavedQuery - CrowdStrike/psfalcon GitHub Wiki

Receive-FalconNgsSavedQuery

SYNOPSIS

Download a Falcon NGSIEM saved query YAML template

DESCRIPTION

Requires 'NGSIEM Saved Queries: Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Path String Destination path
Id String Saved query identifier X
Domain String Repository or view all
dashboards
falcon
third-party 		X
Force Switch Overwrite an existing file when present

SYNTAX

Receive-FalconNgsSavedQuery [[-Path] <String>] [-Id] <String> [-Domain] <String> [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /ngsiem-content/entities/savedqueries-template/v1

USAGE

2025-08-05: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️