Alerts

# Get all alerts with a specific severity
Get-FalconAlert -Filter "severity:'High'" -All

# Search for alerts using a query string
Get-FalconAlert -Query "malware" -Limit 100

# Retrieve detailed alert information
Get-FalconAlert -Detailed -Filter "status:'new'" -Limit 50

# Get specific alerts by their IDs
$AlertIds = @('ldt:abc123...', 'ldt:def456...')
Get-FalconAlert -Id $AlertIds

# Include hidden alerts
Get-FalconAlert -Id $AlertIds -IncludeHidden $true

# Add a tag to specific alerts
Invoke-FalconAlertAction -Name add_tag -Value 'investigated' -Id $AlertIds

# Update the status of alerts
Invoke-FalconAlertAction -Name update_status -Value 'in_progress' -Id $AlertIds

# Assign alerts to a user
Invoke-FalconAlertAction -Name assign_to_user_id -Value 'user@example.com' -Id $AlertIds

# Perform multiple actions on alerts
$Actions = @(
    @{name='add_tag'; value='reviewed'},
    @{name='append_comment'; value='Investigated on 2026-03-05'},
    @{name='update_status'; value='closed'}
)
Invoke-FalconAlertAction -Action $Actions -Id $AlertIds

# Process alerts from pipeline
Get-FalconAlert -Filter "status:'new'" | 
    Invoke-FalconAlertAction -Name update_status -Value 'in_progress'