ConvertTo FalconMlExclusion
Output required fields to create a Machine Learning exclusion from a Falcon detection
Uses the 'behaviors' and 'device' properties of a detection to generate the necessary fields to create a new Machine Learning exclusion. Specfically, it maps the following properties these fields:
behaviors.filepath > value device.groups > groups
The 'value' field is stripped of any leading NT file path ('Device/HarddiskVolume').
If the detection involves a device that is not in any groups,it uses 'all' to target all host groups.
The resulting output can be passed to 'New-FalconMlExclusion' to create an exclusion.
| Name | Type | Min | Max | Allowed | Pipeline | PipelineByName | Description |
|---|---|---|---|---|---|---|---|
| Detection | Object | X | Falcon detection content, including 'behaviors' and 'device' |
ConvertTo-FalconMlExclusion [-Detection] <Object> [<CommonParameters>]2022-10-31: PSFalcon v2.2.3
