Skip to content

Event Streams

Jump to bottom
bk-cs edited this page Jan 21, 2021 · 13 revisions

Start an event stream

Get-FalconStream -AppId psfalcon

Refresh an active event stream

Update-FalconStream -AppId psfalcon -Partition 0

Capture a sample of events from a stream

Open-FalconStream

NOTE: This is a custom command included with PSFalcon. Over a few minutes, Open-FalconStream will output an event stream to a Json file in the local directory. It currently only works on Windows and will open a secondary session when executed. You can close the session to write the Json to disk.

See CrowdStrike API Documentation.

Clone this wiki locally