### Get Azure Install Script using falconcpy

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconContainerAzureScript

This example shows how to use the falconcpy utility to get the Azure install script. This is a helper function for obtaining the script.

```python
[GetAzureInstallScript](https://github.com/CrowdStrike/falconcpy/wiki/kubernetes-protection#GetAzureInstallScript)
```

--------------------------------

### Remove Installation Tokens Example

Source: https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconInstallToken

This example demonstrates how to use the Remove-FalconInstallToken cmdlet to remove one or more installation tokens by their IDs. Ensure you have the correct token IDs before execution.

```powershell
Remove-FalconInstallToken -Id <id>, <id>
```

--------------------------------

### Silent Installation using Archive

Source: https://github.com/crowdstrike/psfalcon/wiki/Invoke-FalconDeploy

This example demonstrates performing a silent installation of an application by uploading an archive, specifying the executable within it, and providing silent installation arguments. It targets hosts within a specified group.

```powershell
Invoke-FalconDeploy -File ./npp.8.2.1.Installer.x64.exe -Argument '/S' -GroupId <group_id>
```

--------------------------------

### Download Falcon Sensor Installer

Source: https://github.com/crowdstrike/psfalcon/wiki/Receive-FalconInstaller

Example of how to use the Receive-FalconInstaller cmdlet to download a specific Falcon sensor installer by its ID to a specified path. Ensure you have the necessary permissions.

```powershell
Receive-FalconInstaller -Id <id> -Path .\WindowsSensor.exe
```

--------------------------------

### Create a Falcon Installation Token

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconInstallToken

Example of creating a new installation token with a specific label and expiration timestamp. Ensure the timestamp is in RFC3339 format or use 'null'. Requires 'Installation tokens: Write' permissions.

```powershell
New-FalconInstallToken -Label "My Token" -ExpiresTimestamp "2021-12-31T00:00:00Z"
```

--------------------------------

### Get information about an installation token

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallToken

Retrieve detailed information for one or more specific installation tokens by providing their IDs.

```powershell
Get-FalconInstallToken -Id <id>, <id>
```

--------------------------------

### Start an Event Stream

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconStream

This example demonstrates how to start an event stream using the Get-FalconStream command with a specified AppId.

```powershell
Get-FalconStream -AppId psfalcon
```

--------------------------------

### PSFalcon Module Directory Structure

Source: https://github.com/crowdstrike/psfalcon/wiki/Installation,-Upgrade-and-Removal

Example output showing the expected directory structure after successfully installing the PSFalcon module manually.

```powershell
Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d----           1/26/2021 10:40 AM                Class
d----           1/26/2021 10:40 AM                Private
d----           1/26/2021 10:40 AM                Public
-----           1/25/2021 10:37 AM           1946 LICENSE
-----           1/25/2021 10:37 AM          10838 PSFalcon.psd1
-----           1/25/2021 10:37 AM            944 PSFalcon.psm1
-----           1/25/2021 10:37 AM           1322 README.md
```

--------------------------------

### FalconPy Examples for Firewall Management

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconFirewallRule

These links provide examples for using FalconPy to query firewall rules, get rules, and query policy rules.

```python
[query_rules](https://github.com/CrowdStrike/falconpy/wiki/firewall-management#query_rules)<BR>[get_rules](https://github.com/CrowdStrike/falconpy/wiki/firewall-management#get_rules)<BR>[query_policy_rules](https://github.com/CrowdStrike/falconpy/wiki/firewall-management#query_policy_rules)
```

--------------------------------

### Get Installation Token by ID

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallToken

Retrieve information about a specific installation token using its ID.

```APIDOC
## GET /installation-tokens/entities/tokens/v1

### Description
Retrieve information about a specific installation token using its ID.

### Method
GET

### Endpoint
/installation-tokens/entities/tokens/v1

### Parameters
#### Query Parameters
- **id** (String[]) - Required - One or more installation token IDs.

### Request Example
```powershell
Get-FalconInstallToken -Id "your-token-id-1", "your-token-id-2"
```

### Response
#### Success Response (200)
- **resources** (Array) - List of installation tokens matching the provided IDs.
- **meta** (Object) - Metadata about the response.

#### Response Example
```json
{
  "resources": [
    {
      "created_timestamp": "2023-10-27T10:00:00Z",
      "expiration_timestamp": "2024-10-27T10:00:00Z",
      "id": "your-token-id",
      "name": "Example Token",
      "platform_id": "windows",
      "product_type_id": 1,
      "type": "REGISTRATION"
    }
  ],
  "meta": {
    "pagination": {
      "offset": 0,
      "limit": 100,
      "total": 1
    }
  }
}
```
```

--------------------------------

### Find Behaviors

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconBehavior

This example demonstrates how to find behaviors using the -Detailed and -All parameters. Use -Detailed to retrieve more information and -All to get all available results.

```powershell
Get-FalconBehavior -Detailed -All
```

--------------------------------

### Create Installation Token

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconInstallToken

Creates a new installation token with specified label and expiration time. Requires the 'Installation tokens: Write' permission.

```APIDOC
## POST /install-tokens/entities/tokens/v1

### Description
Creates an installation token.

### Method
POST

### Endpoint
/install-tokens/entities/tokens/v1

### Parameters
#### Query Parameters
- **label** (string) - Required - Installation token label
- **expiresTimestamp** (string) - Optional - Installation token expiration time (RFC3339), or 'null'

### Request Example
```json
{
  "example": ""
}
```

### Response
#### Success Response (200)
- **token** (string) - The generated installation token
- **label** (string) - The label of the token
- **expiresTimestamp** (string) - The expiration timestamp of the token

#### Response Example
```json
{
  "example": "{\"token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NDM2NzM2MDB9.example_token\", \"label\": \"My Token\", \"expiresTimestamp\": \"2021-12-31T00:00:00Z\"}"
}
```
```

--------------------------------

### Get Falcon Install Tokens

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallToken

Search for installation tokens. This command allows you to find tokens based on various criteria.

```APIDOC
## GET /installation-tokens/entities/tokens/v1

### Description
Search for installation tokens. This endpoint allows filtering, sorting, and pagination of results.

### Method
GET

### Endpoint
/installation-tokens/entities/tokens/v1

### Parameters
#### Query Parameters
- **id** (String[]) - Optional - Installation token identifier.
- **filter** (String) - Optional - Falcon Query Language expression to limit results.
- **sort** (String) - Optional - Property and direction to sort results.
- **limit** (Int32) - Optional - Maximum number of results per request. (min: 1, max: 1000)
- **offset** (Int32) - Optional - Position to begin retrieving results.
- **detailed** (Switch) - Optional - Retrieve detailed information.
- **all** (Switch) - Optional - Repeat requests until all available results are retrieved.
- **total** (Switch) - Optional - Display total result count instead of results.

### Request Example
```powershell
Get-FalconInstallToken -Detailed -All
```

### Response
#### Success Response (200)
- **tokens** (Array) - List of installation tokens.
- **meta** (Object) - Metadata about the response.

#### Response Example
```json
{
  "resources": [
    {
      "created_timestamp": "2023-10-27T10:00:00Z",
      "expiration_timestamp": "2024-10-27T10:00:00Z",
      "id": "your-token-id",
      "name": "Example Token",
      "platform_id": "windows",
      "product_type_id": 1,
      "type": "REGISTRATION"
    }
  ],
  "meta": {
    "pagination": {
      "offset": 0,
      "limit": 100,
      "total": 1
    }
  }
}
```
```

--------------------------------

### View Installation Token Settings

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallTokenSetting

Use this command to view the current installation token settings. This requires the 'Installation tokens: Read' permission.

```powershell
Get-FalconInstallTokenSetting
```

--------------------------------

### Get Process Details by ID

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconIocProcess

This example demonstrates how to retrieve detailed information for one or more specific processes using their IDs.

```powershell
Get-FalconIOCProcess -Id <id>, <id>
```

--------------------------------

### PowerShell Examples

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconDetection

Examples of using PowerShell cmdlets to interact with the CrowdStrike Falcon detections.

```APIDOC
### Find Detections
```powershell
Get-FalconDetection -Filter "status:'new'+first_behavior:> '2020-01-01'" -Sort first_behavior.desc [ -Detailed ] [ -All ]
```

### Find Unassigned Detections
```powershell
Get-FalconDetection -Filter "assigned_to_uid:null" [ -All ]
```
```

--------------------------------

### PSFalcon Usage Examples

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconUserGroupMember

Examples of how to use the Get-FalconUserGroupMember cmdlet.

```APIDOC
## List the groups that a user belongs to
```powershell
Get-FalconUserGroupMember -UserId <user_id>
```
```

```APIDOC
## List members of a user group
```powershell
Get-FalconUserGroupMember -Id <user_group_id>
```
```

--------------------------------

### Find all available sensor installers for a specific OS version

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstaller

To find installers for a specific operating system version, use the -Filter parameter with the 'os:"<OS Name>"' syntax. For example, 'os:"Amazon Linux"'. The -Detailed and -All parameters can be used for more comprehensive results.

```powershell
Get-FalconInstaller -Filter "os:'Amazon Linux'" [-Detailed] [-All]
```

--------------------------------

### Falcon Score Usage Examples

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconScore

Examples demonstrating how to use the Get-FalconScore cmdlet.

```APIDOC
### Show CrowdScores
```powershell
Get-FalconScore -All
```

### Output the highest score for each available day
```powershell
# Retrieve all available scores
$Score = Get-FalconScore -All

# Convert 'timestamp' into local [datetime]
$Score | ForEach-Object { $_.timestamp = [datetime]$_.timestamp; $_ }

foreach ($Day in ($Score | ForEach-Object { $_.timestamp.ToString('yyyy-MM-dd') } | Select-Object -Unique | Sort-Object -Descending)) {
    # Output 'max_score' for each 'date'
    [PSCustomObject]@{ 
        date = $Day
        max_score = ($Score | Where-Object { $_.timestamp.date -eq $Day }).score | Sort-Object -Descending | Select-Object -First 1
    }
}
```
```

--------------------------------

### Download Azure Provisioning Script

Source: https://github.com/crowdstrike/psfalcon/wiki/Receive-FalconDiscoverAzureScript

This example shows how to download the Azure provisioning script to the current directory. Ensure you have the necessary permissions.

```powershell
Receive-FalconDiscoverAzureScript -Path .

```

--------------------------------

### PowerShell Usage Examples

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconReconAction

Examples of how to use the Get-FalconReconAction cmdlet in PowerShell.

```APIDOC
```powershell
Get-FalconReconAction [-Filter] <String> [-Query] <String> [-Sort] <String> [-Limit] <Int32>] [-Offset <Int32>] [-Detailed] [-All] [-Total] [<CommonParameters>]
```
```

```APIDOC
```powershell
Get-FalconReconAction -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]
```
```

```APIDOC
```powershell
# Querying monitoring rule actions
Get-FalconReconAction -Detailed
```
```

--------------------------------

### Upload a Directory of Samples

Source: https://github.com/crowdstrike/psfalcon/wiki/Send-FalconSample

This example demonstrates how to upload an entire directory of samples. It pipes the output of Get-ChildItem to Send-FalconSample.

```powershell
Get-ChildItem -Path C:\samples -File | Send-FalconSample
```

--------------------------------

### Create Falcon Complete Case for General Product Support

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconCompleteCase

Use this example to create a support case for general Falcon product issues. Ensure you have the correct user UUID.

```powershell
New-FalconCompleteCase -UserId <user_uuid> -Type 'fc:falcon-product-support' -Title 'contact support' -Content 'contact support'
```

--------------------------------

### Get Falcon Sensor Installers

Source: https://context7.com/crowdstrike/psfalcon/llms.txt

Searches for and retrieves Falcon sensor installer information. Filters can be applied for platform or OS, and installers can be retrieved by SHA256 hash.

```powershell
# Find all Linux sensor installers
Get-FalconInstaller -Filter "platform:'linux'" -Detailed -All
```

```powershell
# Find installers for a specific OS
Get-FalconInstaller -Filter "os:'Amazon Linux'" -Detailed -All
```

```powershell
# Get specific installer by SHA256 hash
Get-FalconInstaller -Id 'sha256_hash_value'
```

```powershell
# Find Windows installers
Get-FalconInstaller -Filter "platform:'windows'" -Detailed -All
```

--------------------------------

### Find installation tokens

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallToken

Use the -Detailed and -All switches to retrieve comprehensive information about all available installation tokens.

```powershell
Get-FalconInstallToken [-Detailed] [-All]
```

--------------------------------

### Get Falcon Installation Token Settings

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallTokenSetting

Retrieves the current installation token settings. This includes the maximum number of allowed installation tokens and whether they are required for installing the Falcon sensor. Requires the 'Installation tokens: Read' permission.

```APIDOC
## GET /install-token/entities/customer-settings/v1

### Description
Retrieves the maximum number of allowed installation tokens and whether they are required for installation of the Falcon sensor.

### Method
GET

### Endpoint
/install-token/entities/customer-settings/v1

### Parameters
#### Query Parameters
- **WhatIf** (boolean) - Optional - If true, simulates the request without making any changes.
- **Confirm** (boolean) - Optional - If true, confirms the request.

### Request Example
```powershell
Get-FalconInstallTokenSetting
```

### Response
#### Success Response (200)
- **max_tokens** (integer) - The maximum number of allowed installation tokens.
- **tokens_required** (boolean) - Indicates whether installation tokens are required for sensor installation.

#### Response Example
```json
{
  "resources": [
    {
      "max_tokens": 10,
      "tokens_required": true
    }
  ]
}
```
```

--------------------------------

### PowerShell Example: Get FalconResponsePolicyMember

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconResponsePolicyMember

Example of how to use the Get-FalconResponsePolicyMember cmdlet to show members of a Real-time Response policy.

```APIDOC
```powershell
Get-FalconResponsePolicyMember -Id <id> [-Detailed] [-All]
```
```

--------------------------------

### GET /sensors/queries/installers/v2

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstaller

Queries for Falcon sensor installers based on specific criteria, returning a count of matching installers.

```APIDOC
## GET /sensors/queries/installers/v2

### Description
Queries for Falcon sensor installers based on specified filter criteria. This endpoint is typically used to get a count of matching installers rather than the installers themselves.

### Method
GET

### Endpoint
/sensors/queries/installers/v2

### Parameters
#### Query Parameters
- **filter** (String) - Optional - Falcon Query Language expression to limit results.
- **sort** (String) - Optional - Property and direction to sort results.
- **limit** (Int32) - Optional - Maximum number of results per request (1-500).
- **offset** (Int32) - Optional - Position to begin retrieving results.
- **total** (Switch) - Required - Display total result count instead of results.

### Request Example
```json
{
  "filter": "platform:'windows'",
  "total": true
}
```

### Response
#### Success Response (200)
- **meta** (Object) - Metadata about the query.
  - **total_count** (Integer) - The total number of installers matching the query.

#### Response Example
```json
{
  "meta": {
    "total_count": 150
  }
}
```
```

--------------------------------

### Update FalconDiscoverAwsSetting Example

Source: https://github.com/crowdstrike/psfalcon/wiki/Update-FalconDiscoverAwsSetting

This example shows how to set and update global settings by providing the CloudtrailBucketOwnerId. Ensure you have the necessary permissions.

```powershell
Update-FalconDiscoverAwsSetting -CloudtrailBucketOwnerId <id>
```

--------------------------------

### Upload a Sample File

Source: https://github.com/crowdstrike/psfalcon/wiki/Send-FalconSample

Use this example to upload a single sample file. Specify the file path, filename, and an optional comment for auditing.

```powershell
Send-FalconSample -Path C:\virus.exe -Filename virus.exe -Comment 'bad file'
```

--------------------------------

### Retrieve detailed information about a specific sensor installer

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstaller

To get detailed information for a particular sensor installer, use the -Id parameter followed by the installer's SHA256 hash value.

```powershell
Get-FalconInstaller -Id <id>
```

--------------------------------

### Get Installation Token Audit Event by ID

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallTokenEvent

Retrieves detailed information about a specific installation token audit event using its ID. Requires 'Installation tokens: Read' permission.

```APIDOC
## GET /installation-tokens/audit-events/v1/{id}

### Description
Retrieves detailed information about an installation token audit event.

### Method
GET

### Endpoint
/installation-tokens/audit-events/v1/{id}

### Parameters
#### Path Parameters
- **id** (String[]) - Installation token audit event identifier(s). (Required)

#### Query Parameters
- **whatIf** (Switch) - Simulates the request without making changes. (Optional)
- **confirm** (Switch) - Confirms the request. (Optional)

### Request Example
```powershell
Get-FalconInstallTokenAuditEvent -Id <String[]> -WhatIf -Confirm
```

### Response
#### Success Response (200)
- **event_id** (String) - The unique identifier for the audit event.
- **timestamp** (String) - The date and time when the event occurred.
- **actor** (Object) - Information about the entity that performed the action.
  - **type** (String) - The type of the actor (e.g., 'user', 'system').
  - **id** (String) - The unique identifier of the actor.
  - **email** (String) - The email address of the actor.
- **action_name** (String) - The name of the action performed.
- **target_entity** (Object) - Information about the entity that was affected by the action.
  - **type** (String) - The type of the target entity.
  - **id** (String) - The unique identifier of the target entity.
- **metadata** (Object) - Additional metadata related to the event.

#### Response Example
```json
{
  "event_id": "string",
  "timestamp": "string",
  "actor": {
    "type": "string",
    "id": "string",
    "email": "string"
  },
  "action_name": "string",
  "target_entity": {
    "type": "string",
    "id": "string"
  },
  "metadata": {}
}
```
```

--------------------------------

### Upload and Execute a File

Source: https://github.com/crowdstrike/psfalcon/wiki/Invoke-FalconDeploy

Use this example to upload a local executable to the 'Put Files' library and run it on specified hosts. Ensure the executable can run silently.

```powershell
Invoke-FalconDeploy -File .\File.exe -HostId <id>, <id> [-QueueOffline]
```

--------------------------------

### FalconPy FDR Schema Combined Event Get

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconReplicatorSchema

This example shows how to use the falconpy library to get the combined event schema for FDR.

```python
fdr_schema_combined_event_get
```

--------------------------------

### Get Falcon Discover AWS Script Example

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconDiscoverAwsScript

This is an example of how to use the Get-FalconDiscoverAwsScript cmdlet. It demonstrates generating a script for a specific organization ID.

```powershell
Get-FalconDiscoverAwsScript -OrganizationId "11111111-2222-3333-4444-555555555555"
```

--------------------------------

### Get-FalconFirewallSetting Usage Example

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconFirewallSetting

This example demonstrates how to view policy settings by providing one or more policy IDs to the Get-FalconFirewallSetting cmdlet.

```powershell
Get-FalconFirewallSetting -Id <id>, <id>
```

--------------------------------

### Create a Response Policy

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconResponsePolicy

Example of how to create a new Real-time Response policy for Windows. Ensure you have the 'Response policies: Write' permission.

```powershell
New-FalconResponsePolicy -PlatformName Windows -Name 'Test RTR Policy 2' -Description 'Short description of test RTR policy 2.'
```

--------------------------------

### falconpy - Get Rules Get

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconIoaRule

This example demonstrates how to retrieve a specific custom IOA rule by its ID using the falconpy library's 'get_rules_get' function.

```python
get_rules_get(rule_id='YOUR_RULE_ID')
```

--------------------------------

### Get Specific Remediations PowerShell Example

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconRemediation

Use this example to retrieve information about specific remediations by providing their IDs. Ensure you have the necessary 'Vulnerabilities: Read' permissions.

```powershell
Get-FalconRemediation -Id <id>, <id>
```

--------------------------------

### Submit an uploaded sample for analysis in a sandbox environment

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconSubmission

Use this example to submit a file, identified by its SHA256 hash, to a specific sandbox environment. The file must have been previously uploaded using Send-FalconSample.

```powershell
New-FalconSubmission -Sha256 <sha256> -EnvironmentId win7_x86 -SubmitName virus.exe
```

--------------------------------

### Delete Installation Tokens using falconcpy

Source: https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconInstallToken

This example shows how to delete installation tokens using the falconcpy tool. It references a GitHub wiki page for detailed instructions.

```python
[tokens_delete](https://github.com/CrowdStrike/falconcpy/wiki/installation-tokens#tokens_delete)
```

--------------------------------

### Start FalconSession syntax

Source: https://github.com/crowdstrike/psfalcon/wiki/Start-FalconSession

This is the general syntax for the Start-FalconSession command, showing optional parameters like QueueOffline, ExistingBatchId, Timeout, HostTimeout, Id, WhatIf, Confirm, and CommonParameters.

```powershell
Start-FalconSession [[-QueueOffline] <Boolean>] [[-ExistingBatchId] <String>] [[-Timeout] <Int32>] [[-HostTimeout] <Int32>] -Id <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]
```

--------------------------------

### Get Information About an Installation Token Audit Event

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallTokenEvent

Retrieve specific installation token audit events by providing their IDs. This is useful for fetching details about particular events.

```powershell
Get-FalconInstallTokenEvent -Id <id>, <id>
```

--------------------------------

### Get-FalconIncident: Get Incidents Sorted by Start Time

Source: https://context7.com/crowdstrike/psfalcon/llms.txt

Retrieve incidents sorted in descending order by their start time. This helps in analyzing the chronological order of incident occurrence.

```powershell
# Get incidents sorted by start time
Get-FalconIncident -Sort start.desc -Detailed -All
```

--------------------------------

### Retrieve distro values

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconKernel

This example demonstrates how to retrieve distinct distro values, sorted by vendor, to understand available distribution options for kernel compatibility.

```powershell
Get-FalconKernel -Field distro -Sort vendor.asc
```

--------------------------------

### Setup Discover for Cloud and Containers with CloudFormation

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconDiscoverAwsAccount

This command sets up Falcon Discover for cloud and containers using CloudFormation. It generates a URL to launch the AWS setup guide.

```powershell
$Created = New-FalconDiscoverAwsAccount -Id "<id>" -Mode cloudformation
```

```powershell
Start-Process $Created.cloudformation_url
```

--------------------------------

### Get IOA Exclusions

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconIoaExclusion

Retrieves a list of Indicator of Attack exclusions. This is a basic usage example.

```powershell
Get-FalconIoaExclusion [-Detailed]
```

--------------------------------

### List Available Firewall Fields

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconFirewallField

This example shows how to list all available firewall fields with detailed information using the Get-FalconFirewallField cmdlet with the -Detailed switch. This is useful for understanding all configurable options.

```powershell
Get-FalconFirewallField -Detailed
```

--------------------------------

### GET /sensors/entities/installers/v2

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstaller

Retrieves specific entities of Falcon sensor installers, allowing retrieval by ID.

```APIDOC
## GET /sensors/entities/installers/v2

### Description
Retrieves specific Falcon sensor installer entities, primarily by their SHA256 hash.

### Method
GET

### Endpoint
/sensors/entities/installers/v2

### Parameters
#### Query Parameters
- **id** (String[]) - Required - One or more SHA256 hash values of the installers to retrieve.

### Request Example
```json
{
  "id": ["a1b2c3d4e5f67890...", "f0e9d8c7b6a54321..."]
}
```

### Response
#### Success Response (200)
- **resources** (Array) - List of installer resources matching the provided IDs.
  - **id** (String) - The SHA256 hash of the installer.
  - **platform** (String) - The operating system platform.
  - **os_version** (String) - The specific OS version.
  - **build_id** (String) - The build identifier.
  - **created_timestamp** (String) - The timestamp when the installer was created.
  - **file_name** (String) - The name of the installer file.
  - **file_type** (String) - The type of the installer file.
  - **file_size** (Integer) - The size of the installer file in bytes.
  - **download_url** (String) - The URL to download the installer.
  - **sha256_hash** (String) - The SHA256 hash of the installer file.

#### Response Example
```json
{
  "resources": [
    {
      "id": "a1b2c3d4e5f67890...",
      "platform": "windows",
      "os_version": "10",
      "build_id": "1.2.3",
      "created_timestamp": "2023-10-27T10:00:00Z",
      "file_name": "FalconInstaller.exe",
      "file_type": "exe",
      "file_size": 125829120,
      "download_url": "https://example.com/installers/FalconInstaller.exe",
      "sha256_hash": "a1b2c3d4e5f67890..."
    }
  ]
}
```
```

--------------------------------

### Create a Device Control Policy

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconDeviceControlPolicy

Example of how to create a new Device Control policy for Windows with a specified name and description.

```powershell
New-FalconDeviceControlPolicy -PlatformName Windows -Name 'My Device Control Policy' -Description 'Short description of my Device Control policy.'
```

--------------------------------

### Get-FalconInstallToken Syntax

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallToken

This is the general syntax for the Get-FalconInstallToken cmdlet, showing all available parameters.

```powershell
Get-FalconInstallToken [-Filter] <String>
  [-Sort] <String>
  [-Limit] <Int32>
  [-Offset <Int32>]
  [-Detailed]
  [-All]
  [-Total]
  [-WhatIf]
  [-Confirm]
  [<CommonParameters>]
```

--------------------------------

### PowerShell Example for Creating Scheduled Exclusions

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconFileVantageExclusion

This example demonstrates how to create a scheduled exclusion using the New-FalconFileVantageExclusion cmdlet. It specifies the policy ID, exclusion name, start and end times, and the processes to exclude.

```powershell
createScheduledExclusions
    -policyId "a1b2c3d4-e5f6-7890-1234-567890abcdef"
    -name "Daily Scan Exclusion"
    -ScheduleStart "2023-11-27T08:00:00Z"
    -ScheduleEnd "2023-11-27T09:00:00Z"
    -Process "powershell.exe, notepad.exe"
```

--------------------------------

### GET /sensors/combined/installers/v2

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstaller

Retrieves combined information about Falcon sensor installers, supporting filtering, sorting, and pagination.

```APIDOC
## GET /sensors/combined/installers/v2

### Description
Searches for Falcon sensor installers, returning combined information. Supports filtering by platform, OS, and other criteria. Can retrieve detailed information and all available results.

### Method
GET

### Endpoint
/sensors/combined/installers/v2

### Parameters
#### Query Parameters
- **filter** (String) - Optional - Falcon Query Language expression to limit results.
- **sort** (String) - Optional - Property and direction to sort results.
- **limit** (Int32) - Optional - Maximum number of results per request (1-500).
- **offset** (Int32) - Optional - Position to begin retrieving results.
- **detailed** (Switch) - Optional - Retrieve detailed information.
- **all** (Switch) - Optional - Repeat requests until all available results are retrieved.
- **total** (Switch) - Optional - Display total result count instead of results.

### Request Example
```json
{
  "filter": "platform:'linux'",
  "detailed": true,
  "all": true
}
```

### Response
#### Success Response (200)
- **resources** (Array) - List of installer resources.
  - **id** (String) - The SHA256 hash of the installer.
  - **platform** (String) - The operating system platform.
  - **os_version** (String) - The specific OS version.
  - **build_id** (String) - The build identifier.
  - **created_timestamp** (String) - The timestamp when the installer was created.
  - **file_name** (String) - The name of the installer file.
  - **file_type** (String) - The type of the installer file.
  - **file_size** (Integer) - The size of the installer file in bytes.
  - **download_url** (String) - The URL to download the installer.
  - **sha256_hash** (String) - The SHA256 hash of the installer file.

#### Response Example
```json
{
  "resources": [
    {
      "id": "a1b2c3d4e5f67890...",
      "platform": "linux",
      "os_version": "Amazon Linux 2",
      "build_id": "1.2.3",
      "created_timestamp": "2023-10-27T10:00:00Z",
      "file_name": "falcon-sensor-6.50.12345-1.x86_64.rpm",
      "file_type": "rpm",
      "file_size": 104857600,
      "download_url": "https://example.com/installers/falcon-sensor-6.50.12345-1.x86_64.rpm",
      "sha256_hash": "a1b2c3d4e5f67890..."
    }
  ]
}
```
```

--------------------------------

### New-FalconQuickScan Usage Example

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconQuickScan

Demonstrates how to use the New-FalconQuickScan cmdlet to scan files by providing SHA256 hash values.

```powershell
New-FalconQuickScan -Id <sha256>, <sha256>
```

--------------------------------

### Get-FalconInstalledPatch Endpoint Reference

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstalledPatch

This is the API endpoint reference for retrieving installed patches. It corresponds to the GET /spotlight/combined/installed-patches/v1 request.

```http
GET /spotlight/combined/installed-patches/v1
```

--------------------------------

### Deploy and Execute from Archive

Source: https://github.com/crowdstrike/psfalcon/wiki/Invoke-FalconDeploy

Upload a zip archive containing an executable and other files, then execute a specific file from within the archive on target hosts. The '-Run' parameter specifies the file to execute after extraction.

```powershell
Invoke-FalconDeploy -Archive npp_installer.zip -Run 'npp.8.2.1.Installer.x64.exe' -Argument '/S' -HostId <id>
```

--------------------------------

### List User Groups by ID

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconUserGroup

This example demonstrates how to list user groups, optionally retrieving detailed information and all available results. Use this when you need to see all user groups or specific details about them.

```powershell
Get-FalconUserGroup [-Detailed] [-All]
```

--------------------------------

### Get-FalconDetection: Get Detections by Severity

Source: https://context7.com/crowdstrike/psfalcon/llms.txt

Retrieve detections filtered by their severity level. This example fetches all 'Critical' severity detections with full details.

```powershell
# Get detections by severity
Get-FalconDetection -Filter "max_severity_displayname:'Critical'" -Detailed -All
```

--------------------------------

### Query Rules Example (falconpy)

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconTailoredRule

Example of how to query tailored rules using the falconpy library.

```python
QueryRules(filter="").
GetRulesEntities()
```

--------------------------------

### Retrieve Detailed Windows Policies

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconSensorUpdatePolicy

Use this command to get detailed information about Windows policies. Ensure the PSFalcon module is installed and configured.

```powershell
Get-FalconSensorUpdatePolicy -Filter "platform_name:'Windows'" -Detailed
```

--------------------------------

### Create Falcon IT Policy

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconItPolicy

Example of creating a new Falcon IT policy with specified name, description, platform, and configuration settings. Ensure the 'IT Automation - Policies: Write' permission is available.

```powershell
$Config = @{
  concurrency = @{
    concurrent_host_file_transfer_limit = 500
    concurrent_host_limit = 1000
    concurrent_task_limit = 5
  }
  execution = @{
    enable_os_query = $true
    enable_python_execution = $true
    enable_script_execution = $true
    execution_timeout = 1
    execution_timeout_unit = 'Minutes'
  }
  resources = @{
    cpu_throttle = 100
    memory_allocation = 150
    memory_allocation_unit = 'MB'
  }
}
New-FalconItPolicy -Name 'test policy' -Description 'description' -Platform Windows -Config $Config
```

--------------------------------

### Create a New User

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconUser

Example of creating a new user with a specified username. The user will be emailed their password if not provided.

```powershell
New-FalconUser -Username jane.doe@example.com
```

--------------------------------

### GET /sensors/queries/installers/ccid/v1

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconCcid

Retrieves your Customer Checksumn Identifier (CID) which is requested during the installation of the Falcon Sensor. Requires 'Sensor Download: Read' permission.

```APIDOC
## GET /sensors/queries/installers/ccid/v1

### Description
Retrieves your Customer Checksumn Identifier (CID) which is requested during the installation of the Falcon Sensor. Requires 'Sensor Download: Read' permission.

### Method
GET

### Endpoint
/sensors/queries/installers/ccid/v1

### Parameters
#### Query Parameters
- **WhatIf** (boolean) - Optional - If true, the request will be simulated but no data will be returned.
- **Confirm** (boolean) - Optional - If true, the request will be confirmed and data will be returned.

### Request Example
```powershell
Get-FalconCcid -WhatIf
```

### Response
#### Success Response (200)
- **cid** (string) - Your Customer Checksumn Identifier (CID).

#### Response Example
```json
{
  "cid": "YOUR_CUSTOMER_CID"
}
```
```

--------------------------------

### GET /spotlight/combined/installed-patches/v1

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstalledPatch

Retrieves a list of installed patches across your environment. This endpoint requires 'Vulnerabilities: Read' permissions. You can filter, sort, and paginate the results.

```APIDOC
## GET /spotlight/combined/installed-patches/v1

### Description
Search for Falcon Spotlight installed patches. Requires 'Vulnerabilities: Read' permission.

### Method
GET

### Endpoint
/spotlight/combined/installed-patches/v1

### Parameters
#### Query Parameters
- **Filter** (String) - Optional - Falcon Query Language expression to limit results.
- **Sort** (String) - Optional - Property and direction to sort results.
- **Limit** (Int32) - Optional - Maximum number of results per request. Minimum: 1, Maximum: 400.
- **After** (String) - Optional - Pagination token to retrieve the next set of results.
- **All** (Switch) - Optional - Repeat requests until all available results are retrieved.
- **Total** (Switch) - Optional - Display total result count instead of results.

### Request Example
```json
{
  "example": "GET /spotlight/combined/installed-patches/v1?Filter=device_id:12345&Limit=100"
}
```

### Response
#### Success Response (200)
- **resources** (Array) - A list of installed patch objects.
- **meta** (Object) - Metadata about the response, including pagination information.

#### Response Example
```json
{
  "example": "{\"resources\": [{\"device_id\": \"a1b2c3d4-e5f6-7890-1234-567890abcdef\", \"hostname\": \"example-host\", \"patch_id\": \"KB1234567\", \"published_date\": \"2023-10-26T10:00:00Z\", \"created_timestamp\": \"2023-10-26T11:00:00Z\"}], \"meta\": { \"pagination\": { \"offset\": \"2023-10-26T11:00:00Z\", \"limit\": 100, \"total\": 500 } }}"
}
```
```

--------------------------------

### Create Falcon Complete Case with Detection Support

Source: https://github.com/crowdstrike/psfalcon/wiki/New-FalconCompleteCase

Use this example to create a support case related to a specific detection. Ensure you have the correct user UUID and detection IDs.

```powershell
New-FalconCompleteCase -UserId <user_uuid> -Type 'fc:detection-support' -Title 'support case with detection' -Content 'case with detection' -DetectionId <id>, <id>
```

--------------------------------

### falconpy IOC Severity Query v1 Usage

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconIocSeverity

This example shows how to use the falconpy library to query IOC severities. Ensure you have the library installed and configured.

```python
from falconpy.ioc import Severity

# Assuming you have an authenticated Falcon object named 'falcon'
severity_query = Severity(falcon=falcon)

# Example: Get all severities
resp = severity_query.query(limit=100)
print(resp)

# Example: Get severities with offset and limit
resp_offset = severity_query.query(limit=50, offset=10)
print(resp_offset)
```

--------------------------------

### FalconPy Query and Get Notifications

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconReconRecord

These examples demonstrate how to query and retrieve notification data using the FalconPy library. Refer to the FalconPy documentation for detailed usage.

```python
QueryNotificationExposedDataRecordsV1(https://github.com/CrowdStrike/falconpy/wiki/QueryNotificationExposedDataRecordsV1)
```

```python
GetNotificationsExposedDataRecordsV1(https://github.com/CrowdStrike/falconpy/wiki/GetNotificationsExposedDataRecordsV1)
```

--------------------------------

### Generate CSV of All Available Uninstall Tokens

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconUninstallToken

This example demonstrates how to create a CSV file containing uninstall tokens for all hosts. It pipes the output of Get-FalconHost to Get-FalconUninstallToken, including the hostname property.

```powershell
Get-FalconHost -All | Get-FalconUninstallToken -Include hostname | Export-Csv .	oken_list.csv -NoTypeInformation
```

--------------------------------

### Get-FalconInstallToken by ID

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstallToken

This syntax shows how to retrieve specific installation tokens by providing their IDs.

```powershell
Get-FalconInstallToken -Id <String[]> [-WhatIf]
  [-Confirm]
  [<CommonParameters>]
```

--------------------------------

### POST /samples/entities/samples/v3

Source: https://github.com/crowdstrike/psfalcon/wiki/Send-FalconSample

Upload a sample file to the Falcon Sandbox. A successful upload provides a 'sha256' value that can be used in submissions to the Falcon Sandbox or Falcon QuickScan. Maximum file size is 256MB. ZIP and 7z archives will automatically redirect to 'Send-FalconSampleArchive'. Requires 'Sample uploads: Write' permission.

```APIDOC
## POST /samples/entities/samples/v3

### Description
Upload a sample file to the Falcon Sandbox.

### Method
POST

### Endpoint
/samples/entities/samples/v3

### Parameters
#### Query Parameters
- **IsConfidential** (Boolean) - Optional - Prohibit sample from being displayed in MalQuery [default: True]
- **Comment** (String) - Optional - Audit log comment
- **Name** (String) - Optional - File name

#### Request Body
- **Path** (String) - Required - Path to local file

### Request Example
```powershell
Send-FalconSample -Path C:\virus.exe -Filename virus.exe -Comment 'bad file'
```

### Response
#### Success Response (200)
- **sha256** (String) - The SHA256 hash of the uploaded sample.

#### Response Example
```json
{
  "sha256": "a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890"
}
```
```

--------------------------------

### Get Firewall Platforms with Pagination

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconFirewallPlatform

Retrieves firewall management platforms with control over the number of results per request and the starting position. Requires 'Firewall management: Read' permissions.

```powershell
Get-FalconFirewallPlatform -Limit <Int32> -Offset <Int32>
```

--------------------------------

### Get-FalconInstaller Syntax with Detailed Option

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconInstaller

This syntax enables the retrieval of detailed information for installers, in addition to filtering and pagination options.

```powershell
Get-FalconInstaller [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [-Offset <Int32>] -Detailed [-All] [-WhatIf] [-Confirm] [<CommonParameters>]
```

--------------------------------

### falconpy UploadFileQuickScanPro Example

Source: https://github.com/crowdstrike/psfalcon/wiki/Send-FalconQuickScanFile

This example demonstrates how to use the UploadFileQuickScanPro method from the falconpy library. Refer to the falconpy wiki for detailed usage instructions.

```python
from falconpy import QuickScanPro

# Example usage (details omitted as per instructions)
# See: https://github.com/CrowdStrike/falconpy/wiki/quickscanpro#UploadFileQuickScanPro
```

--------------------------------

### Get Falcon OverWatch Incidents in Past 48 Hours

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconOverWatchIncident

This example demonstrates how to retrieve the total number of Falcon OverWatch incidents from the last 48 hours using the Filter parameter.

```powershell
Get-FalconOverWatchIncident -Filter "detect_time:> 'now-48h'"
```

--------------------------------

### Retrieve Specific Task Group Detail

Source: https://github.com/crowdstrike/psfalcon/wiki/Get-FalconItTaskGroup

Use this example to get detailed information about a single task group by providing its ID. Requires the 'IT Automation - Tasks: Read' permission.

```powershell
Get-FalconItTaskGroup -Id <id>
```