Get FalconFileVantageChange

Get-FalconFileVantageChange

SYNOPSIS

Search for Falcon FileVantage changes

DESCRIPTION

Requires 'Falcon FileVantage: Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Id	String[]	FileVantage change identifier				X	X
Filter	String	Falcon Query Language expression to limit results action_timestamp ingestion_timestamp host.name severity
Sort	String	Property and direction to sort results			action_timestamp|asc action_timestamp|desc ingestion_timestamp|asc ingestion_timestamp|desc
Limit	Int32	Maximum number of results per request	1	5000
After	String	Pagination token to retrieve the next set of results
Detailed	Switch	Retrieve detailed information
All	Switch	Repeat requests until all available results are retrieved
Total	Switch	Display total result count instead of results

SYNTAX

Get-FalconFileVantageChange [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-After <String>] [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconFileVantageChange -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /filevantage/entities/changes/v2
GET /filevantage/queries/changes/v3

falconpy

highVolumeQueryChanges
getChanges

USAGE

2024-01-24: PSFalcon v2.2.6