Remove FalconCorrelationRule - CrowdStrike/psfalcon GitHub Wiki
Remove Falcon NGSIEM correlation rules
Requires 'Correlation Rules: Write'.
| Name | Type | Description | Min | Max | Allowed | Pipeline | PipelineByName |
|---|---|---|---|---|---|---|---|
| Id | String[] | Correlation rule identifier (specific version) | X | X | |||
| RuleId | String[] | Correlation 'rule_id' (all versions) |
Remove-FalconCorrelationRule -RuleId <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]Remove-FalconCorrelationRule [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]DELETE /correlation-rules/entities/rule-versions/v1
DELETE /correlation-rules/entities/rules/v1
entities_rules_delete_v1
entities_rule_versions_delete_v1
2025-09-19: PSFalcon v2.2.9
