New FalconIoaRule

New-FalconIoaRule

SYNOPSIS

Create a custom Indicator of Attack rule within a rule group

DESCRIPTION

Requires 'Custom IOA Rules: Write'.

PARAMETERS

Name	Type	Min	Max	Allowed	Pipeline	PipelineByName	Description
Name	String					X	Rule name
PatternSeverity	String			critical high medium low informational		X	Rule severity
RuletypeId	String			1 2 5 6 9 10 11 12		X	Rule type
DispositionId	Int32			10 20 30		X	Disposition identifier [10: Monitor, 20: Detect, 30: Block]
FieldValue	Object[]					X	An array of rule properties
Description	String					X	Rule description
Comment	String					X	Audit log comment
RulegroupId	String					X	Rule group identifier

SYNTAX

New-FalconIoaRule [-Name] <String> [-PatternSeverity] <String> [-RuletypeId] <String> [-DispositionId] <Int32> [-FieldValue] <Object[]> [[-Description] <String>] [[-Comment] 
<String>] [-RulegroupId] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

USAGE

Create custom IOA rules

$Group = Get-FalconIoaGroup -Filter "name:'updatedRuleGroup'" -Detailed $FieldValue = @{     label = 'Grandparent Image Filename'     name = 'GrandparentImageFilename'     type = 'excludable'     values = @(         @{             label = 'include'             value = '.+bug.exe'         }     ) } New-FalconIoaRule -RulegroupId $Group.id -Name 'BugRule' -PatternSeverity critical -RuletypeId 5 -DispositionId 30 -FieldValue $FieldValue

Generated 2022-15-06 using PSFalcon v2.2.3