New FalconReconRule

New-FalconReconRule

SYNOPSIS

Create Falcon Intelligence Recon monitoring rules

DESCRIPTION

Requires 'Monitoring rules (Falcon Intelligence Recon): Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
InputObject	Object[]	One or more monitoring rules to create in a single request				X
Name	String	Monitoring rule name
Topic	String	Monitoring rule topic			SA_ALIAS SA_AUTHOR SA_BIN SA_BRAND_PRODUCT SA_CUSTOM SA_CVE SA_DOMAIN SA_EMAIL SA_IP SA_THIRD_PARTY SA_VIP
Filter	String	Falcon Query Language expression to limit results
Priority	String	Monitoring rule priority			high medium low
Permission	String	Permission level [public: 'All Intel users', private: 'Recon Admins']			private public
BreachMonitoring	Boolean	Monitor for breach data
BreachMonitorOnly	Boolean	Monitor only for breach data. Must be accompanied by BreachMonitoring: True.
SubstringMatching	Boolean	Monitor for substring matches. Only available for the 'Typosquatting' topic.
MatchOnTsqResultType	String[]	Monitor for basedomains and/or subdomains. Only available for the 'Typosquatting' topic.			basedomains subdomains
OriginatingTemplateId	String	Identifier of originating rule template, if based on one

SYNTAX

New-FalconReconRule [-Name] <String> [-Topic] <String> [-Filter] <String> [-Priority] <String> [-Permission] <String> [[-BreachMonitoring] <Boolean>] [[-BreachMonitorOnly] <Boolean>] [[-SubstringMatching] <Boolean>] [[-OriginatingTemplateId] <String>] [-WhatIf] [-Confirm] [<CommonParameters>]

New-FalconReconRule -InputObject <Object[]> [-WhatIf] [-Confirm] [<CommonParameters>]

New-FalconReconRule [[-MatchOnTsqResultType] <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /recon/entities/rules/v1
POST /recon/entities/rules/v1

falconpy

CreateRulesV1
UpdateRulesV1

USAGE

Creating a monitoring rule

New-FalconReconRule -Name psfalcon_example -Topic SA_AUTHOR -Filter "author:'example_author'" -Priority low -Permission private

Creating multiple monitoring rules in a single request

$Array = @(
    @{
        name = "psfalcon_example_1"
        topic = "SA_BRAND_PRODUCT"
        filter = "phrase:'psfalcon_example_phrase'"
        priority = "low"
        permissions = "private"
    },
    @{
        name = "psfalcon_example_2"
        topic = "SA_BIN"
        filter = "ccbin:'1234'"
        priority = "medium"
        permissions = "public"
    }
)
New-FalconReconRule -Array $Array

2024-12-19: PSFalcon v2.2.8