Skip to content

Receive FalconRule

bk-cs edited this page Nov 30, 2023 · 20 revisions

Receive-FalconRule

SYNOPSIS

Download the most recent ruleset, or a specific ruleset

DESCRIPTION

Requires 'Rules (Falcon Intelligence): Read'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
Type String Ruleset type, used to retrieve the latest ruleset common-event-format
netwitness
snort-suricata-changelog
snort-suricata-master
snort-suricata-update
yara-changelog
yara-master
yara-update
IfNoneMatch String Download the latest rule set only if it doesn't a matching 'tags' value
IfModifiedSince String Restrict results to those modified after a provided date (HTTP, ANSIC or RFC850 format)
Path String Destination path
Id Int32 Ruleset identifier, used for a specific ruleset X X
Force Switch Overwrite an existing file when present

SYNTAX

Receive-FalconRule [-Path] <String> [-Id] <Int32> [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]
Receive-FalconRule [-Type] <String> [[-IfNoneMatch] <String>] [[-IfModifiedSince] <String>] [-Path] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /intel/entities/rules-files/v1
GET /intel/entities/rules-latest-files/v1

falconpy

GetIntelRuleFile
GetLatestIntelRuleFile

USAGE

Download the latest rule set

Receive-FalconRule -Type yara-master -Path .\yara-master.zip

Download a specific rule set

Receive-FalconRule -Id <id> -Path .
ules.zip

2023-11-27: PSFalcon v2.2.6

Clone this wiki locally