2.1.4

[bk-cs]

New Commands

• identity-graphql
  'Invoke-FalconIdentityGraph'
• psfalcon
  'Add-FalconSensorTag'
  'Get-FalconSensorTag'
  'Remove-FalconSensorTag'

General Changes

• Added support for results from Identity Protection APIs to 'Write-Result'.

Command Changes

• Updated the 'Sort' values for the following commands:
  'Get-FalconCidGroup', 'Get-FalconCidGroupMember', 'Get-FalconGroupRole', 'Get-FalconIoaGroup',
  'Get-FalconIoaRole', 'Get-FalconIoc', 'Get-FalconMemberCid', 'Get-FalconScheduledReport',
  'Get-FalconQuarantine', 'Get-FalconUserGroup', 'Get-FalconUserGroupMember'.
• Updated the 'Limit' values for the following commands:
  'Get-FalconBehavior', 'Get-FalconIncident'.
• Updated the following commands to generate an error when the 'Path' parameter is given a directory:
  'Edit-FalconScript', 'Send-FalconPutFile', 'Send-FalconSample', 'Send-FalconScript'.
• Add-FalconHostTag
  Renamed to 'Add-FalconGroupingTag' to clarify purpose and prevent confusion with 'Add-FalconSensorTag'.
• Get-FalconHost
  Added list of accepted 'Sort' values based on related 'Filter' values accepted by 'devices-scroll' API.
• Invoke-FalconDeploy
  Added check for OS version and 'cd_temp' step to change to a default temporary directory (\Windows\Temp or
  /tmp) before the 'put' and 'run' commands.
• Invoke-FalconRtr
  Suppressed output of session init 'stdout' value so it doesn't display when the following command results in
  an error.
• Remove-FalconHostTag
  Renamed to 'Remove-FalconGroupingTag' to clarify purpose and prevent confusion with 'Remove-FalconSensorTag'.
• Request-FalconToken
  Added 'Authorization token request failed' message when token request fails to ensure that an error is
  produced when an HTTP 403 response is suppressed from the oauth2 API.

GitHub Issues

• Issue Invoke-FalconRtr doesn't return 'get' results in v2.1.3 #79: Fixed bug with 'Invoke-FalconRtr' using the 'get' command that prevented completion of 'get'
  requests and output of 'batch_get_cmd_req_id' value.
• Issue "Last x days/hours" not being properly replaced #82: Fixed typo causing relative 'Last X days/hours' value to not be properly calculated.
• Issue Ambiguous Error when running commands with invalid token #84: Added break to abort requests when missing authorization token.
• Issue "Edit-FalconDetection -ShowInUi" $false does not hide detections #85: Modified 'Update-FieldName' to ensure evaluation of [boolean] parameters.

---

This discussion was created from the release 2.1.4.

[bk-cs]

The module will be available on the PowerShell Gallery once the manifest signing is complete.

[bk-cs]

The module is now available on the PowerShell Gallery. If you already have PSFalcon installed, you can update using Update-Module -Name PSFalcon.

[bk-cs]

Invoke-FalconIdentityGraph is the first pass of the command. It's currently pretty simple as it passes the entire string you provide to the Identity Protection API.

For instance, if you wanted to follow along with the Identity Protection API documentation, this is how the first example would look within PSFalcon:

Invoke-FalconIdentityGraph -Query 'entities(roles:[BuiltinAdministratorRole] sortKey:PRIMARY_DISPLAY_NAME sortOrder:ASCENDING first:5) {nodes{primaryDisplayName secondaryDisplayName}}'

That Query value gets submitted to the API in this format:

{"query":"{entities(roles:[BuiltinAdministratorRole] sortKey:PRIMARY_DISPLAY_NAME sortOrder:ASCENDING first:5) {nodes{primaryDisplayName secondaryDisplayName}}}"}

And, if successful, the object that is returned will look like this:

PS> $Example = Invoke-FalconIdentityGraph -Query 'entities(roles:[BuiltinAdministratorRole] sortKey:PRIMARY_DISPLAY_NAME sortOrder:ASCENDING first:5) {nodes{primaryDisplayName secondaryDisplayName}}'
PS> $Example

entities
--------
@{nodes=System.Object[]}

PS> $Example.entities.nodes

primaryDisplayName secondaryDisplayName
------------------ --------------------
Administrator      PFO.COM\Administrator
Administrator      JTO.COM\Administrator
Administrator      SKO.COM\Administrator
Administrator      LPO.COM\Administrator
Administrator      LPO.COM\Administrator

I'm considering some logic to "drill down" into the results and return that $Example.entities.nodes value, but the Identity Protection API is new to me so I'm not sure if that can be improved much, or if it will be hard to predict how the results will be organized since the GraphQL standard allows for such a large array of different submissions and responses.