Skip to content

Edit FalconIoaRule

bk-cs edited this page Oct 21, 2022 · 21 revisions

Edit-FalconIoaRule

SYNOPSIS

Modify custom Indicator of Attack rules within a rule group

DESCRIPTION

All fields are required (plus 'rulegroup_version') when making a rule group change. PSFalcon adds missing values automatically using data from your existing rule group.

If an existing rule is submitted within 'rule_updates', it will be filtered to the required properties ('comment', 'description', 'disposition_id', 'enabled', 'field_values', 'instance_id', 'name', and 'pattern_severity') including those under 'field_values' ('name', 'label', 'type' and 'values').

Requires 'Custom IOA Rules: Write'.

PARAMETERS

Name Type Min Max Allowed Pipeline PipelineByName Description
Comment String Audit log comment
RuleUpdate Object[] X An array of rule properties
RulegroupId String X Rule group identifier

SYNTAX

Edit-FalconIoaRule [[-Comment] <String>] [[-RuleUpdate] <Object[]>] [-RulegroupId] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

SDK Reference

falconpy

update-rules

USAGE

Modify custom IOA rules

$Group = Get-FalconIoaGroup -Filter "name:'updatedRuleGroup'" -Detailed
$RuleUpdates = @(
    @{
        name = 'BugRule'
        pattern_severity = 'critical'
        enabled = $true
        description = 'Stops the bug'
        disposition_id = 30
        instance_id = '1'
        field_values = @(
            @{
                label = 'Grandparent Image Filename'
                name = 'GrandparentImageFilename'
                type = 'excludable'
                values = @(
                    @{
                        label = 'include'
                        value = '.+updatebug.exe'
                    }
                )
            },
            @{
                label = 'Grandparent Command Line'
                name = 'GrandparentCommandLine'
                type = 'excludable'
                values = @(
                    @{
                        label = 'include'
                        value = '.*'
                    }
                )
            },
            @{
                label = 'Parent Image Filename'
                name = 'ParentImageFilename'
                type = 'excludable'
                values = @(
                    @{
                        label = 'include'
                        value = '.*'
                    }
                )
            },
            @{
                label = 'Parent Command Line'
                name = 'ParentCommandLine'
                type = 'excludable'
                values = @(
                    @{
                        label = 'include'
                        value = '.*'
                    }
                )
            },
            @{
                label = 'Image Filename'
                name = 'ImageFilename'
                type = 'excludable'
                values = @(
                    @{
                        label = 'include'
                        value = '.*'
                    }
                )
            },
            @{
                label = 'Command Line'
                name = 'CommandLine'
                type = 'excludable'
                values = @(
                    @{
                        label = 'include'
                        value = '.*'
                    }
                )
            }
        )
    }
)
Edit-FalconIoaRule -RulegroupId $Group.id -RulegroupVersion $Group.version -RuleUpdate $RuleUpdates -Comment 'Updated using PSFalcon'

2022-10-21: PSFalcon v2.2.3

Clone this wiki locally