Update FalconNgsSavedQuery - CrowdStrike/psfalcon GitHub Wiki

Update-FalconNgsSavedQuery

SYNOPSIS

Update a Falcon NGSIEM saved query using a YAML template

DESCRIPTION

Requires 'NGSIEM Saved Queries: Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Id String Saved query identifier X
Domain String Repository or view all
falcon
third-party 		X
Path String Path to YAML template X

SYNTAX

Update-FalconNgsSavedQuery [-Id] <String> [-Domain] <String> [-Path] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /ngsiem-content/entities/savedqueries-template/v1

falconpy

UpdateSavedQueryFromTemplate

USAGE

2025-09-02: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️