Get FalconIndicator

Get-FalconIndicator

SYNOPSIS

Search for intelligence indicators

DESCRIPTION

Requires 'Indicators (Falcon Intelligence): Read'.

PARAMETERS

Name	Type	Min	Max	Allowed	Pipeline	PipelineByName	Description
Id	String[]				X	X	Indicator identifier
Filter	String						Falcon Query Language expression to limit results
Query	String						Perform a generic substring search across available fields
Sort	String			id|asc id|desc indicator|asc indicator|desc type|asc type|desc published_date|asc published_date|desc last_updated|asc last_updated|desc _marker|asc _marker|desc			Property and direction to sort results
Limit	Int32	1	5000				Maximum number of results per request
IncludeDeleted	Boolean						Include previously deleted indicators
Offset	Int32						Position to begin retrieving results
Detailed	Switch						Retrieve detailed information
All	Switch						Repeat requests until all available results are retrieved
Total	Switch						Display total result count instead of results

SYNTAX

Get-FalconIndicator [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-IncludeDeleted] <Boolean>] [-Offset <Int32>] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconIndicator -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconIndicator [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-IncludeDeleted] <Boolean>] [-Offset <Int32>] -Detailed [-All] [-WhatIf] [-Confirm] [<CommonParameters>]

SDK Reference

falconpy

QueryIntelIndicatorIds,GetIntelIndicatorEntities,QueryIntelIndicatorEntities

USAGE

Search for indicator IDs

Get-FalconIndicator -Filter "type:'domain'" [-All]

Get indicators by ID

Get-FalconIndicator -Id <id>, <id>

Search for detailed indicator information

Get-FalconIndicator -Filter "last_updated:>=1427846400" -Sort "last_updated|asc" -Detailed [-All]

2022-10-21: PSFalcon v2.2.3