2.2.7

[bk-cs]

New Commands

cloud-connect-cspm-azure

• Get-FalconCloudAzureGroup
• New-FalconCloudAzureGroup
• Remove-FalconCloudAzureGroup

cloud-connect-cspm-gcp

• Get-FalconCloudGcpAccount
• Get-FalconCloudGcpServiceAccount
• Invoke-FalconCloudGcpHealthCheck
• Receive-FalconCloudGcpScript
• Remove-FalconCloudGcpAccount

configuration-assessment

• Get-FalconConfigAssessmentRule

container-security

• Edit-FalconContainerPolicy
• Edit-FalconContainerPolicyGroup
• Get-FalconContainer
• Get-FalconContainerAlert
• Get-FalconContainerAssessment
• Get-FalconContainerCluster
• Get-FalconContainerDetection
• Get-FalconContainerCount
• Get-FalconContainerDriftIndicator
• Get-FalconContainerImage
• Get-FalconContainerIom
• Get-FalconContainerNode
• Get-FalconContainerPackage
• Get-FalconContainerPod
• Get-FalconContainerPolicy
• Get-FalconContainerPolicyExclusion
• Get-FalconContainerPolicyGroup
• Get-FalconContainerVulnerability
• New-FalconContainerImage
• New-FalconContainerPolicy
• New-FalconContainerPolicyExclusion
• New-FalconContainerPolicyGroup
• Remove-FalconContainerPolicy
• Remove-FalconContainerPolicyGroup
• Set-FalconContainerPolicyPrecedence

delivery-settings

• Get-FalconChannelControl
• Set-FalconChannelControl

exclusions

• Edit-FalconCertificateExclusion
• Get-FalconCertificate
• Get-FalconCertificateExclusion
• New-FalconCertificateExclusion
• Remove-FalconCertificateExclusion

fem

• Edit-FalconAsset

filevantage

• Get-FalconFileVantageAction
• Get-FalconFileVantageContent
• Invoke-FalconFileVantageAction
• Invoke-FalconFileVantageWorkflow

host-migration

• Get-FalconMigration
• Get-FalconMigrationCid
• Get-FalconMigrationHost
• Invoke-FalconMigrationAction
• New-FalconMigration
• Start-FalconMigration
• Stop-FalconMigration
• Remove-FalconMigration
• Rename-FalconMigration

intel

• Get-FalconMalwareFamily

loggingapi

• Get-FalconFoundryRepository
• Get-FalconFoundrySearch
• Get-FalconFoundryView

plugins

• Get-FalconWorkflowIntegration

psf-sensors

• Set-FalconSensorTag (Thanks @LyleWB)

snapshots

• Get-FalconSnapshot
• Get-FalconSnapshotScan
• New-FalconSnapshotScan

threatgraph

• Get-FalconThreatGraphIndicator
• Get-FalconThreatGraphVertex
• Get-FalconThreatGraphEdge

workflows

• Export-FalconWorkflow
• Get-FalconWorkflow
• Get-FalconWorkflowAction
• Get-FalconWorkflowInput
• Get-FalconWorkflowTrigger
• Import-FalconWorkflow
• Invoke-FalconWorkflow
• Redo-FalconWorkflow

Issues Resolved

• Issue [ ENHANCEMENT ] Add error message when Receive-FalconInstaller fails due to timeout #310: Added default timeout of one minute for all requests in an effort to help produce error messages
  when a file download does not complete.
• Issue [ BUG ] Find-FalconHostname returns maximum of 100 results #369: Corrected Find-FalconHostname so it outputs the entire list of results instead of stopping with
  the first initial 100.
• Issue [ BUG ] 400: The ids parameter must be present... error when using Turkish display language #370: Changed all identifier parameter aliases from uppercase to lowercase to resolve matching issues
  when using Turkish as the default display language.
• Issue [ BUG ] Invoke-FalconDeploy incorrect execution order when queued #375: Added a second delay for Invoke-FalconDeploy between commands when using the offline queue to
  ensure that the proper processing order is retained.
• Issue [ BUG ] Import-FalconConfig ignores FirewallGroup  #380: Updated Compare-ImportData function to analyze items by each individual platform (or
  platform_name) to resolve bug where FirewallGroup items were being ignored.
• Issue [ BUG ] Receive commands generate index out of range errors even when successful #382: Removed output of successfully downloaded file information from Invoke-Falcon private function
  and relocated within the Invoke() class function to prevent Index out of range error on successful download
  requests.
• Issue [ BUG ] Add-SensorTag and Remove-SensorTag dont append/remove tags even through reboot #385: Re-wrote Add-FalconSensorTag and Remove-FalconSensorTag commands properly append/remove tags
  across all OSes, and fix issue where tags weren't applied at all.
• Issue [ BUG ] Id does not match pattern when using Get-FalconAsset #391: Removed pattern validation for the Id parameter for Get-FalconAsset to prevent errors when
  unexpected (but legitimate) Id values are provided.
• Issue [ BUG ] Import-FalconConfig improperly assigns non-existent rule_group_ids when creating FilewallPolicy #393: Updated Import-FalconConfig to properly remove rule_group_ids that aren't tied to
  FirewallGroup items that are also created during import.
• Issue [ BUG ] Get-FalconAlert -All -Detailed returns 413 - Request Too Large #396: Added maximum count of 1000 identifiers when building body content during Get-FalconAlert
  requests.
• Issue [ ENHANCEMENT ] Add ParameterSet to Invoke-FalconAlertAction and Invoke-FalconIncidentAction to allow for multiple actions in one API query #397: Added Action parameter to define multiple actions to perform in a single request when using
  Invoke-FalconAlertAction or Invoke-FalconIncidentAction.
• Issue [ BUG ] New-FalconIoaRule generates 400 error when following wiki example #399: Updated how field_values properties are selected to ensure that they're correctly passed as an
  array when using New-FalconIoaRule.
• Issue [ ENHANCEMENT ] Force lowercase for Cid parameter when using Add-FalconRole #401: Added Confirm-CidValue private function to check Cid input for checksum, remove it when present,
  and return the Cid value in lower case.
• Issue [ ENHANCEMENT ] Add Get-FalconScanFile results to Include for Get-FalconScan #411: Added Include with value of scan_file to Get-FalconScan, and added ScanId to
  Get-FalconScanFile to support Include for Get-FalconScan.
• Issue [ BUG ] Get-FalconScan and Get-FalconScanFile limited to 100 results #412: Added Limit of 500 to Get-FalconScan and Get-FalconScanFile to ensure both limit and
  offset are passed during pagination.

General Changes

• Added a weekly check of the PSGallery for PSFalcon module updates if the PSFalcon module was originally
  installed via the PSGallery. Update status is kept in a file called update_check.json in the base PSFalcon
  module folder. If the connection to the PSGallery fails, the update check is disabled. Deleting update_check.json
  will re-attempt connection the next time the module is loaded.

• Updated internal Build-Query function to automatically URL encode provided values during submission instead
  of only previously encoding +.

• Updated internal Log() method for [ApiClient] to support Falcon NGSIEM and CrowdStrike Parsing Standard.

• Added UserAgent value to [ApiClient] object for use with Log() method.

• Updated Request-FalconToken and Show-FalconModule to use new UserAgent value under [ApiClient].

• Removed filtering for unique values when supplying an array of identifiers to a command. This was originally
  added to prevent problems related to an array containing the same identifier twice, but it adds a lot of
  processing time when a large list of identifiers is provided. PSFalcon will now pass all given identifiers on
  to the relevant API, meaning that new error messages might appear if a user is not properly error checking
  their scripts and filtering out duplicate identifier values.

• Added Test-ActionParameter private function to support new Action parameter for Invoke-FalconAlertAction
  and Invoke-FalconIncidentAction.

• Added Select-CertificateProperty private function to support the new Edit-FalconCertificateExclusion and
  New-FalconCertificateExclusion commands.

• Corrected verbose output for various commands to ensure that the relevant command name was displayed when
  Invoke-Falcon makes a request to the target API.

• Re-wrote the internal function Confirm-Parameter to reduce necessary parameters when calling the function.

• Added internal Remove-EmptyValue function to strip empty values before submission when necessary.

• Corrected bug found when implementing new v2 endpoint for Get-FalconAsset -IoT where after would not
  be added properly when paginating without another criteria (i.e. filter, sort, etc.) using -All.

• Compressed SensorTag commands into a reusable function to de-duplicate code.

• Renamed the Array parameter to InputObject to better match PowerShell style for the following commands:
  Edit-FalconDeviceControlPolicy, Edit-FalconFirewallPolicy, Edit-FalconIoc, Edit-FalconPreventionPolicy,
  Edit-FalconReconNotification, Edit-FalconReconRule, Edit-FalconResponsePolicy,
  Edit-FalconSensorUpdatePolicy, Find-FalconHostname, New-FalconDeviceControlPolicy,
  New-FalconFirewallPolicy, New-FalconHostGroup, New-FalconIoc, New-FalconPreventionPolicy,
  New-FalconReconRule, New-FalconResponsePolicy, and New-FalconSensorUpdatePolicy.

  Array has been kept as an alias to prevent issues with existing scripts.

• Changed the prefix from Horizon to Cloud for the following commands:
  Edit-FalconHorizonAwsAccount, Edit-FalconHorizonAzureAccount, Edit-FalconHorizonPolicy,
  Edit-FalconHorizonSchedule, Get-FalconFimChange, Get-FalconHorizonAwsAccount, Get-FalconHorizonAwsLink,
  Get-FalconHorizonAzureAccount, Get-FalconHorizonAzureCertificate, Get-FalconHorizonAzureGroup,
  Get-FalconHorizonIoa, Get-FalconHorizonIoaEvent, Get-FalconHorizonIoaUser, Get-FalconHorizonIom,
  Get-FalconHorizonPolicy, Get-FalconHorizonSchedule, New-FalconHorizonAwsAccount,
  New-FalconHorizonAzureAccount, New-FalconHorizonAzureGroup, Receive-FalconHorizonAwsScript,
  Receive-FalconHorizonAzureScript, Remove-FalconHorizonAwsAccount, Remove-FalconHorizonAzureAccount, and
  Remove-FalconHorizonAzureGroup.

  The original command names have been kept as aliases to prevent issues with existing scripts.

• Removed Compare-FalconPreventionPhase and accompanying policy json files due to Falcon Prevention Policy UI
  changes that enabled policy comparison in the Falcon console.

Command Changes

Add-FalconSensorTag

• Re-written to properly evaluate add tags across all OSes.
• Added support for passing uninstallation token when adding tags on MacOS (and presumably Linux in the future).
• Added properties to output to increase transparency in the use of RTR and the status of tag additions.

Edit-FalconCloudAwsAccount

• Added Environment, DspmEnabled, DspmRole and TargetOu.

Edit-FalconIoaRule

• Updated to use /ioarules/entities/rules/v2:patch endpoint.

Edit-FalconMlExclusion

• Added DescendentProcess.

Edit-FalconSvExclusion

• Added DescendentProcess.

Edit-FalconReconRule

• Added BreachMonitorOnly.

Edit-FalconFileVantageRule

• Added ContentRegistryValues, HashCapture and RegKeyPermission.

Export-FalconConfig

• Added error message when unable to create export in current directory.

Get-FalconAlert

• Updated to use /alerts/queries/alerts/v2:get endpoint.
• Added IncludeHidden (used when submitting Id values).

Get-FalconAsset

• Updated to use new /discover/queries/iot-hosts/v2:get endpoint with -IoT.
• Added -External switch to search for external assets.
• Updated to use new /discover/combined/hosts/v1:get endpoint when using -Detailed.
• Updated to use new /discover/combined/applications/v1:get when using -Application and -Detailed.
• The facet property has been joined together with Include for the relevant new /combined/ API
  endpoints for consistency with earlier PSFalcon version.
• Added error messages when invalid Limit or facet values (as Include) are supplied for their
  respective API endpoint. Tab-completion for Include will first offer all available values, and the
  command will error if one of the supplied values is invalid based on the eventual API endpoint
  being targeted.
• Updated code to properly append login_event when used with -Include for respective aid (when
  searching for Host) or account_id (when searching for Account) values.

Get-FalconCloudAwsAccount

• Added CspmLite.
• Renamed IsHorizonAcct parameter to IsFcsAccount. Kept IsHorizonAcct as an alias.

Get-FalconCloudAzureAccount

• Added CspmLite.
• Renamed IsHorizonAcct parameter to IsFcsAccount. Kept IsHorizonAcct as an alias.

Get-FalconContainerSensor

• Added check to verify proper credentials are available to avoid 401: Unauthorized errors when a token is not
  present.

Get-FalconInstaller

• Updated to use new v2 endpoints.

Get-FalconIocHost

• Updated to use /iocs/aggregates/device-count/v1:get endpoint.

Get-FalconReconRule

• Added SecondarySort.

Get-FalconRole

• Added Detailed switch.

Get-FalconSensorTag

• Re-written to pull tags directly from devices API instead of using RTR on Linux and Mac.

Get-FalconUninstallToken

• Re-wrote command to group all device_id values together and make requests in appropriately sized groups,
  instead of individually when using Include. This should drastically increase performance when requesting
  large numbers of uninstall_token values with other device properties included.

Get-FalconVulnerability

• Updated Limit to a maximum of 5,000 for Detailed requests. If retrieving identifiers only, the command
  will force Limit to a maximum of 400.

Invoke-FalconAlertAction

• Added Action for performing multiple actions on alerts in a single request. Thanks @datorr2!

Invoke-FalconIncidentAction

• Added Action for performing multiple actions on incidents in a single request. Thanks @datorr2!
• Removed mandatory attribute from Value to ensure that it works when using unassign with Name parameter.

Invoke-FalconMobileAction

• Updated to use /enrollments/entities/details/v4:post endpoint.
• Added EnrollmentType.

Import-FalconConfig

• Added additional verbose output during analysis of items to import to help with future troubleshooting.
• Added additional verbose output to show when rule_group_ids are being assigned and/or the removal of
  non-existent values when FirewallPolicy items are being created and modified.
• Added FirewallPolicy settings values to final CSV output.
• Added various improvements for handling SensorUpdatePolicy with unavailable sensor build versions. When
  an invalid build version is found, it is stripped. When a build is updated with a matching tagged version,
  sensor_version and stage are also updated. These changes also affect variants for LinuxArm64.
• Fixed issues preventing SensorUpdatePolicy from being evaluated for changes with ModifyExisting. Updated
  final output to properly record changes.
• Various improvements related to policy analysis and changes for policy settings.

Invoke-FalconAlertAction

• Added IncludeHidden.

Invoke-FalconRtr

• Forced the private function that is keeping the the RTR session alive every 30 seconds by default to help
  prevent results from being lost when hosts that recently went offline (i.e. didn't meet the cutoff for
  the offline queue) delay the RTR session start long enough for the session itself to die before the eventual
  command is properly issued. This should help eliminate cases of Invoke-FalconRtr "not doing anything"
  because a host is unable to be added to the session and/or the results aren't returned quickly enough after
  the session begins.

New-FalconCloudGcpAccount

• Updated to use new /cloud-connect-cspm-gcp/entities/account/v2:post endpoint.
• Added ServiceAccountId, ClientId, ClientEmail, PrivateKey, PrivateKeyId, ProjectId, and
  ServiceAccountCondition.

New-FalconCloudAwsAccount

• Added DspmEnabled and DspmRole.

New-FalconFileVantageRule

• Added ContentRegistryValues, HashCapture and RegKeyPermission.

New-FalconSvExclusion

• Added IsDescendentProcess.

New-FalconReconRule

• Added BreachMonitorOnly.
• Added OriginatingTemplateId.

New-FalconFileVantageRule

• Added ContentRegistryValues.

Receive-FalconCloudAwsScript

• Added OrganizationId, Template, Account, AccountType,AwsProfile, CustomRole, BehaviorAssessment,
  SensorManagement, and ExistingCloudtrail.

Receive-FalconCloudAzureScript

• Added AzureManagementGroup.

Receive-FalconInstaller

• Updated to use new v2 endpoint.

Register-FalconEventCollector

• Updated to support Falcon NGSIEM HTTP Event Collector ingestion.

Remove-FalconContainerImage

• Updated to use new /container-security/entities/base-images/v1:delete endpoint.

Remove-FalconSensorTag

• Re-written to properly evaluate and remove specific tags across all OSes.
• Added support for passing uninstallation token when removing tags on MacOS (and presumably Linux in the future).
• Added properties to output to increase transparency in the use of RTR and the status of tag removal.

Request-FalconRegistryCredential

• Removed mandatory requirement for SensorType and added a prompt if it is not present.
• Added additional error messages to notify when token or expires_in is missing from a token request response.
• Made various changes to ensure all token-related content was properly cached/retrieved from cache.

Request-FalconToken

• Added us-gov-2 as Cloud and Hostname option.

Send-FalconEvent

• Updated to support Falcon NGSIEM HTTP Event Collector ingestion.

---

This discussion was created from the release 2.2.7.