DOCSEARCHbyAlgolia
Submit Docs

PSFalcon Documentation

repository·master·Indexed 19 days ago

https://github.com/crowdstrike/psfalcon

A PowerShell module providing a wrapper around the CrowdStrike Falcon OAuth2 APIs. PSFalcon enables the automation of Falcon management tasks, such as modifying detections, incidents, policies, and rules, utilizing Real-time Response (RTR) across multiple devices, and managing malware samples or MSSP environments.

Tokens
556
Snippets
1
Records
5
Agent score
17%

What's inside PSFalcon

  1. Overview of PSFalcon

    master
    PSFalcon is a PowerShell module designed to help CrowdStrike Falcon users interact with CrowdStrike Falcon OAuth2 APIs. It enables automation of tasks that are otherwise manual in the Falcon UI, such as modifying large numbers of detections, incidents, policies, or rules; utilizing Real-time Response (RTR) across multiple devices; and managing malware samples or RTR files. It is also useful for configuring MSSP parent and child environments.

  2. Ask questions and participate in discussions

    master

    If you cannot find answers in the wiki or samples, use the GitHub Discussions board.

    Discussions are categorized as follows:

    • General: Catch-all for general discussions.
    • Ideas: For feature requests and suggestions.
    • Q&A: For questions regarding how to accomplish specific tasks.
    • Show and Tell: To share your projects and work with the community.

  3. Access PSFalcon command documentation

    master

    You can access documentation for PSFalcon commands directly from your PowerShell session using Get-Help.

    To view the full documentation online via the PSFalcon wiki, use the -Online switch with the command.

    Get-Help <command> -Online

  4. Requirements for using PSFalcon

    master

    To use PSFalcon, you must meet the following requirements:

    • Falcon Subscription: An active Falcon subscription with the appropriate modules.
    • PowerShell Version:
      • Windows: PowerShell 5.1 or higher.
      • Linux/MacOS: PowerShell 6 or higher.
    • API Access: A Falcon OAuth2 API Client configured with the appropriate roles for the actions you intend to perform.

  5. Report an issue or bug in PSFalcon

    master

    To report bugs, documentation/link updates, enhancement requests, or security concerns, use the GitHub issue reporting tool.

    Note on Escalation: If an issue is determined to be outside the scope of the PSFalcon SDK (e.g., a core CrowdStrike API issue), maintainers may refer you to official CrowdStrike technical support. If you are a CrowdStrike customer and prefer direct support, you can contact the CrowdStrike technical support team.