Receive FalconRule

Receive-FalconRule

SYNOPSIS

Download the most recent ruleset, or a specific ruleset

DESCRIPTION

Requires 'Rules (Falcon Intelligence): Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Type	String	Ruleset type, used to retrieve the latest ruleset			common-event-format netwitness snort-suricata-changelog snort-suricata-master snort-suricata-update yara-changelog yara-master yara-update
IfNoneMatch	String	Download the latest rule set only if it doesn't a matching 'tags' value
IfModifiedSince	String	Restrict results to those modified after a provided date (HTTP, ANSIC or RFC850 format)
Path	String	Destination path
Id	Int32	Ruleset identifier, used for a specific ruleset				X	X
Force	Switch	Overwrite an existing file when present

SYNTAX

Receive-FalconRule [-Path] <String> [-Id] <Int32> [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]

Receive-FalconRule [-Type] <String> [[-IfNoneMatch] <String>] [[-IfModifiedSince] <String>] [-Path] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /intel/entities/rules-files/v1
GET /intel/entities/rules-latest-files/v1

falconpy

GetIntelRuleFile
GetLatestIntelRuleFile

USAGE

Download the latest rule set

Receive-FalconRule -Type yara-master -Path .\yara-master.zip

Download a specific rule set

Receive-FalconRule -Id <id> -Path .
ules.zip

2023-11-27: PSFalcon v2.2.6