Get FalconIocHost

Get-FalconIocHost

SYNOPSIS

Search for hosts that have observed a custom indicator

DESCRIPTION

Requires 'IOCs: Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Type	String	Indicator type			domain ipv4 ipv6 md5 sha256		X
Value	String	Indicator value					X
Limit	String	Maximum number of results per request	1	100
Offset	Int32	Position to begin retrieving results
All	Switch	Repeat requests until all available results are retrieved
Total	Switch	Display the total result count instead of results

SYNTAX

Get-FalconIocHost [-Type] <String> [-Value] <String> [[-Limit] <String>] [-Offset <Int32>] [-All] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconIocHost [-Type] <String> [-Value] <String> -Total [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /indicators/queries/devices/v1
GET /iocs/aggregates/indicators/device-count/v1

falconpy

DevicesRanOn
indicator_get_device_count_v1

USAGE

Getting the host count

Get-FalconIocHost -Type <string> -Value <string> -Total

Getting the list of hosts that have seen an IOC

Get-FalconIocHost -Type <string> -Value <string>

2024-09-03: PSFalcon v2.2.7