psfalcon

Removed Commands

ioa

• Get-FalconCloudIoaEvent
• Get-FalconCloudIoaUser

New Commands

billing-dashboards-usage

• Get-FalconHostAverage

device-content

• Get-FalconContentState

identity-protection

• Get-FalconIdentityRule
• New-FalconIdentityRule
• Remove-FalconIdentityRule

policy-content-update

• Edit-FalconContentPolicy
• Get-FalconContentPolicy
• Get-FalconContentPolicyMember
• Invoke-FalconContentPolicyAction
• New-FalconContentPolicy
• Remove-FalconContentPolicy
• Set-FalconContentPrecedence

quickscanpro

• Remove-FalconQuickScan
• Remove-FalconQuickScanFile
• Send-FalconQuickScanFile

snapshots

• Get-FalconSnapshotCredential
• New-FalconSnapshotAwsAccount

Issues Resolved

• Issue #421: Updated internal function to evaluate FalconSensorTags and re-wrote scripts for FalconSensorTag manipulation through Real-time Response to fix the inability to add/remove FalconSensorTags on Linux. This also fixed the same issue that was impacting MacOS hosts.
• Issue #424: Increased [System.Net.Http.HttpClient] default timeout to 5 minutes from 1 minute. Updated Invoke-FalconAdminCommand, Invoke-FalconCommand, and Invoke-FalconResponderCommand to only attempt to append batch_id to results that have a session_id.
• Issue #426: Updated Uninstall-FalconSensor to properly select bash uninstall script when targeting Linux hosts.
• Issue #427: Added tar to valid Command list for Invoke-FalconAdminCommand and Invoke-FalconResponderCommand and corrected Invoke-FalconAdminCommand to properly include the Command value update query.
• Issue #433: Modified Edit-FalconFirewallGroup to ensure that null values for rule_ids and rule_versions are converted into empty arrays, and that single values are forced into arrays.
• Issue #435: Updated uninstall_sensor.sh script to incorporate the use of systemd to uninstall falcon-sensor on Linux hosts utilizing some additional code from an existing uninstaller script. Thanks @carlosmmatos and @cs-APreston-ghAccount!

General Changes

• Fixed some error message output for Request-FalconToken and Test-FalconToken.

Command Changes

ConvertTo-FalconFirewallRule

• Added protocol as a required field for the Map table and rule creation.

Edit-FalconReconRule

• Added MatchOnTsqResultType.

Export-FalconConfig

• Added ContentPolicy as a value for Select parameter.

Get-FalconChannelControl

• Renamed to Get-FalconContentControl. Get-FalconChannelControl has been kept as an alias.

Get-FalconHost

• Added content_state as an Include value.

Get-FalconIoaExclusion

• Added ClRegex and IfnRegex.

Get-FalconQuickScan

• Updated to use new QuickScan Pro API.

Get-FalconVulnerability

• Updated to set Limit to 400 when using All without Detailed to prevent 5000 is an invalid page size, must be between 1 and 400 error.

Import-FalconConfig

• Added support for Content Update policies.
• Added ContentPolicy as a value for ModifyExisting and ModifyDefault parameters.

Invoke-FalconAdminCommand

• Added tar as a valid Command value.

Invoke-FalconResponderCommand

• Added tar as a valid Command value.
• Added update query as a valid Command which was mistakenly removed in a previous release.

New-FalconCompleteCase

• Added MalwareSubmissionId and ReconRuleType.

New-FalconQuickScan

• Updated to use new QuickScan Pro API, which is replacing the regular QuickScan API.

New-FalconReconRule

• Added MatchOnTsqResultType.

Receive-FalconCloudAwsScript

• Added DspmEnabled, DspmRegion, and DspmRole.

Receive-FalconScheduledReport

• Updated to use a combination of the last_execution.id and report_params.format fields to define a filename if Path is left undefined and is being passed a report via p

New Commands

cloud-connect-cspm-azure

• Get-FalconCloudAzureGroup
• New-FalconCloudAzureGroup
• Remove-FalconCloudAzureGroup

cloud-connect-cspm-gcp

• Get-FalconCloudGcpAccount
• Get-FalconCloudGcpServiceAccount
• Invoke-FalconCloudGcpHealthCheck
• Receive-FalconCloudGcpScript
• Remove-FalconCloudGcpAccount

configuration-assessment

• Get-FalconConfigAssessmentRule

container-security

• Edit-FalconContainerPolicy
• Edit-FalconContainerPolicyGroup
• Get-FalconContainer
• Get-FalconContainerAlert
• Get-FalconContainerAssessment
• Get-FalconContainerCluster
• Get-FalconContainerDetection
• Get-FalconContainerCount
• Get-FalconContainerDriftIndicator
• Get-FalconContainerImage
• Get-FalconContainerIom
• Get-FalconContainerNode
• Get-FalconContainerPackage
• Get-FalconContainerPod
• Get-FalconContainerPolicy
• Get-FalconContainerPolicyExclusion
• Get-FalconContainerPolicyGroup
• Get-FalconContainerVulnerability
• New-FalconContainerImage
• New-FalconContainerPolicy
• New-FalconContainerPolicyExclusion
• New-FalconContainerPolicyGroup
• Remove-FalconContainerPolicy
• Remove-FalconContainerPolicyGroup
• Set-FalconContainerPolicyPrecedence

delivery-settings

• Get-FalconChannelControl
• Set-FalconChannelControl

exclusions

• Edit-FalconCertificateExclusion
• Get-FalconCertificate
• Get-FalconCertificateExclusion
• New-FalconCertificateExclusion
• Remove-FalconCertificateExclusion

fem

• Edit-FalconAsset

filevantage

• Get-FalconFileVantageAction
• Get-FalconFileVantageContent
• Invoke-FalconFileVantageAction
• Invoke-FalconFileVantageWorkflow

host-migration

• Get-FalconMigration
• Get-FalconMigrationCid
• Get-FalconMigrationHost
• Invoke-FalconMigrationAction
• New-FalconMigration
• Start-FalconMigration
• Stop-FalconMigration
• Remove-FalconMigration
• Rename-FalconMigration

intel

• Get-FalconMalwareFamily

loggingapi

• Get-FalconFoundryRepository
• Get-FalconFoundrySearch
• Get-FalconFoundryView

plugins

• Get-FalconWorkflowIntegration

psf-sensors

• Set-FalconSensorTag (Thanks @LyleWB)

snapshots

• Get-FalconSnapshot
• Get-FalconSnapshotScan
• New-FalconSnapshotScan

threatgraph

• Get-FalconThreatGraphIndicator
• Get-FalconThreatGraphVertex
• Get-FalconThreatGraphEdge

workflows

• Export-FalconWorkflow
• Get-FalconWorkflow
• Get-FalconWorkflowAction
• Get-FalconWorkflowInput
• Get-FalconWorkflowTrigger
• Import-FalconWorkflow
• Invoke-FalconWorkflow
• Redo-FalconWorkflow

Issues Resolved

• Issue #310: Added default timeout of one minute for all requests in an effort to help produce error messages when a file download does not complete.
• Issue #369: Corrected Find-FalconHostname so it outputs the entire list of results instead of stopping with the first initial 100.
• Issue #370: Changed all identifier parameter aliases from uppercase to lowercase to resolve matching issues when using Turkish as the default display language.
• Issue #375: Added a second delay for Invoke-FalconDeploy between commands when using the offline queue to ensure that the proper processing order is retained.
• Issue #380: Updated Compare-ImportData function to analyze items by each individual platform (or platform_name) to resolve bug where FirewallGroup items were being ignored.
• Issue #382: Removed output of successfully downloaded file information from Invoke-Falcon private function and relocated within the Invoke() class function to prevent Index out of range error on successful download requests.
• Issue #385: Re-wrote Add-FalconSensorTag and Remove-FalconSensorTag commands properly append/remove tags across all OSes, and fix issue where tags weren't applied at all.
• Issue #391: Removed pattern validation for the Id parameter for Get-FalconAsset to prevent errors when unexpected (but legitimate) Id values are

New Commands

cloud-connect-azure

• Get-FalconDiscoverAzureTenant

configuration-assessment

• Get-FalconConfigAssessment
• Get-FalconConfigAssessmentLogic

falcon-complete-dashboards

• Get-FalconCompleteAlert

filevantage

• Add-FalconFileVantageHostGroup
• Add-FalconFileVantageRuleGroup
• Edit-FalconFileVantageExclusion
• Edit-FalconFileVantagePolicy
• Edit-FalconFileVantageRule
• Edit-FalconFileVantageRuleGroup
• Get-FalconFileVantageExclusion
• Get-FalconFileVantagePolicy
• Get-FalconFileVantageRule
• Get-FalconFileVantageRuleGroup
• New-FalconFileVantageExclusion
• New-FalconFileVantagePolicy
• New-FalconFileVantageRule
• New-FalconFileVantageRuleGroup
• Remove-FalconFileVantageExclusion
• Remove-FalconFileVantageHostGroup
• Remove-FalconFileVantagePolicy
• Remove-FalconFileVantageRule
• Remove-FalconFileVantageRuleGroup
• Set-FalconFileVantagePrecedence
• Set-FalconFileVantageRulePrecedence
• Set-FalconFileVantageRuleGroupPrecedence

identity-protection

• Get-FalconIdentityHost

real-time-response

• Get-FalconLibraryScript

Removed Commands

cloud-connect-aws (deprecated)

• Confirm-FalconDiscoverAwsAccess
• Edit-FalconDiscoverAwsAccount
• Get-FalconDiscoverAwsAccount
• Get-FalconDiscoverAwsLink
• Get-FalconDiscoverAwsSetting
• New-FalconDiscoverAwsAccount
• Receive-FalconDiscoverAwsScript
• Remove-FalconDiscoverAwsAccount
• Update-FalconDiscoverAwsSetting

cloud-connect-azure (deprecated)

• Get-FalconDiscoverAzureAccount
• Get-FalconDiscoverAzureCertificate
• Get-FalconDiscoverAzureTenant
• New-FalconDiscoverAzureAccount
• Receive-FalconDiscoverAzureScript
• Update-FalconDiscoverAzureAccount

cloud-connect-gcp (deprecated)

• Get-FalconDiscoverGcpAccount
• New-FalconDiscoverGcpAccount
• Receive-FalconDiscoverGcpScript

discover

• Get-FalconDiscoverNetwork
• Get-FalconDiscoverRule
• Get-FalconDiscoverScan
• Get-FalconDiscoverScanner

settings-discover (deprecated)

• Get-FalconDiscoverAwsScript

Issues Resolved

• Issue #313: Reorganized parameters for Get-FalconRole and removed UserId from a specific ParameterSet to ensure proper output.
• Issue #315: Modified script used by Uninstall-FalconSensor to match 64 instead of equal 64-bit to correct error caused when bit value is reported as 64 bit instead of 64-bit.
• Issue #316: Added if check to Confirm-Parameter for $Required and $Allowed to ensure that blank values do not count when verifying objects under PowerShell Core.
• Issue #327: Modified Invoke-FalconDeploy to properly change directories and execute scripts when working with .cmd and .bat files. Thanks @MatthewCKelly!
• Issue #342: Modified Invoke-FalconMalQuery and Get-FalconMalQuery to select the reqid,reqtype and/or status properties in their final output, when present.
• Issue #360: Fixed bug where Get-FalconAsset would not append results when using -Include login_event with a single asset result.
• Issue #363: Added critical as a severity for Edit-FalconHorizonPolicy.

General Changes

• Modified all authorization token validation checks to request a new token when the current token is due to expire within 4 minutes instead of 1 minute. This should help reduce the number of expired authorization tokens during long-running requests (like Get-FalconVulnerability).
• Migrated Wait-RetryAfter function from private\Private.ps1 to class\Class.ps1 under ApiClient.Invoke() function.
• Streamlined ApiClient.Invoke() under class\Class.ps1 in an effort to improve verbose logging and performance.
• Modified private functions Invoke-Falcon and Request-FalconToken to compensate for changes to ApiClient.Invoke().
• Modified Write-Result to ensure each error will be individually produced when a single API call generates multiple errors.
• Rearranged how ApiClient.Invoke() downloads

New Commands

container-security

• Edit-FalconContainerRegistry
• Get-FalconContainerRegistry
• New-FalconContainerRegistry
• Remove-FalconContainerRegistry

discover

• Get-FalconDiscoverNetwork
• Get-FalconDiscoverRule
• Get-FalconDiscoverScan
• Get-FalconDiscoverScanner

falconx

• Receive-FalconMemoryDump

fwmgr

• Edit-FalconFirewallLocation
• Edit-FalconFirewallLocationSetting
• Get-FalconFirewallLocation
• New-FalconFirewallLocation
• Remove-FalconFirewallLocation
• Set-FalconFirewallLocationPrecedence

kubernetes-protection

• Get-FalconContainerAccount
• Get-FalconContainerAzureScript
• Get-FalconContainerAzureTenant
• Get-FalconContainerScript

Issues Resolved

• Issue #283: Added platform during creation of FirewallGroup items when using Import-FalconConfig.
• Issue #294: Modified the FQL query being used by Get-FalconQueue to account for an API change that made the previous query stop working.
• Issue #295: Added code to the sub-function Invoke-Loop inside Invoke-Falcon to strip all query parameters when paginating Get-FalconHorizonIom.
• Issue #296: Updated Get-FalconAsset to ensure proper attachment of login_event results for each asset when using -Include login_event.
• Issue #283: Modified New-FalconSensorUpdatePolicy to remove scheduler under settings when set as disabled to prevent errors when creating policies.

General Changes

• Updated reference policies for Compare-FalconPreventionPhase.
• Switched from using Write-Verbose to PSCmdlet.WriteVerbose() to increase content when using Verbose with commands.
• Added additional verbose message output when commands send their requests to display the endpoint being used.
• Added (local) timestamp at the beginning of verbose output messages through the creation of a Verbose function within class\Class.ps1 and the private function unnamed.
• Added Start-RtrUpdate and Stop-RtrUpdate functions to manage PowerShell background jobs to refresh Real-time Response sessions when using Invoke-FalconRtr or Invoke-FalconDeploy.
• Changed the Wait parameter for Invoke-FalconAdminCommand, Invoke-FalconBatchGet, Invoke-FalconCommand, and Invoke-FalconResponderCommand to wait until completion instead of a maximum of 60 seconds.
• Added Wait-RtrCommand and Wait-RtrGet private functions when using Wait with Real-time Response commands.
• Streamlined some of the code of Write-Result to increase performance.