Invoke FalconIncidentAction

Invoke-FalconIncidentAction

SYNOPSIS

Perform actions on incidents

DESCRIPTION

Requires 'Incidents: Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Name	String	Action to perform			add_tag delete_tag unassign update_description update_name update_status update_assigned_to_v2
Value	String	Value for the chosen action
Action	Hashtable[]	One or more hashtables defining multiple name/value pairs
UpdateDetects	Boolean	Update status of related 'new' detections
OverwriteDetects	Boolean	Replace existing status for related detections
Id	String[]	Incident identifier				X	X

SYNTAX

Invoke-FalconIncidentAction [-Name] <String> [[-Value] <String>] [[-UpdateDetects] <Boolean>] [[-OverwriteDetects] <Boolean>] [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

Invoke-FalconIncidentAction [-Action] <Hashtable[]> [[-UpdateDetects] <Boolean>] [[-OverwriteDetects] <Boolean>] [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /incidents/entities/incident-actions/v1

falconpy

PerformIncidentAction

USAGE

Update the status of multiple incidents

Invoke-FalconIncidentAction -Name update_status -Value in_progress -Id <id>, <id>

Updating detection statuses to match incidents

Invoke-FalconIncidentAction -Name update_status -Value in_progress -Id <id>, <id> -UpdateDetects $true -OverwriteDetects $true

2024-09-03: PSFalcon v2.2.7