Invoke FalconHostAction

Invoke-FalconHostAction

SYNOPSIS

Perform actions on hosts

DESCRIPTION

Requires 'Hosts: Write', plus related permission(s) for 'Include' selection(s).

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Name	String	Action to perform			contain lift_containment hide_host unhide_host detection_suppress detection_unsuppress
Include	String[]	Include additional properties			agent_version cid external_ip first_seen host_hidden_status hostname last_seen local_ip mac_address os_build os_version platform_name product_type product_type_desc reduced_functionality_mode serial_number system_manufacturer system_product_name tags
Id	String[]	Host identifier				X	X

SYNTAX

Invoke-FalconHostAction [-Name] <String> [[-Include] <String[]>] [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /devices/entities/devices-actions/v2

falconpy

PerformActionV2

USAGE

Containing or lifting containment on hosts

Invoke-FalconHostAction -Name contain -Id <id>, <id>

Invoke-FalconHostAction -Name lift_containment -Id <id>, <id>

See Network contain a device by Hostname.

See Network contain a list of Hostnames from a CSV file.

Deleting and restoring hosts

Invoke-FalconHostAction -Name hide_host -Id <id>, <id>

Invoke-FalconHostAction -Name unhide_host -Id <id>, <id>

2023-04-25: PSFalcon v2.2.5