Skip to main content

​
Get-FalconCloudIoa

Search for Falcon Cloud Security Indicators of Attack (IOA). Required Permission: CSPM registration: Read Alias: Get-FalconHorizonIoa

​
Syntax

​
Parameters

​
string
required
Cloud platform to search.Valid values: aws, azureAliases: cloud_provider, cloud_platform
​
string
Cloud account identifier. Can be provided via pipeline.Aliases: account_id
​
string
AWS account identifier (12-digit number).Pattern: ^\d{12}$Aliases: aws_account_id
​
string
Azure subscription identifier (GUID format).Pattern: UUID/GUID formatAliases: azure_subscription_id, subscription_id
​
string
Azure tenant identifier (GUID format).Pattern: UUID/GUID formatAliases: azure_tenant_id, tenant_id
​
string[]
Resource identifier(s) to filter results.Aliases: resource_id
​
string[]
Resource UUID(s) to filter results.Aliases: resource_uuid
​
string
Indicator of Attack severity level.Valid values: High, Medium, Informational
​
string
Cloud service to filter results.Valid values include: ACM, ACR, App Engine, AppService, BigQuery, Cloud Load Balancing, Cloud Logging, Cloud SQL, Cloud Storage, CloudFormation, CloudTrail, CloudWatch Logs, Cloudfront, Compute Engine, Config, Disk, DynamoDB, EBS, EC2, ECR, EFS, EKS, ELB, EMR, Elasticache, GuardDuty, IAM, Identity, KMS, KeyVault, Kinesis, Kubernetes, Lambda, LoadBalancer, Monitor, NLB/ALB, NetworkSecurityGroup, PostgreSQL, RDS, Redshift, S3, SES, SNS, SQLDatabase, SQLServer, SQS, SSM, Serverless Application Repository, StorageAccount, Subscriptions, VPC, VirtualMachine, VirtualNetwork
​
string
Indicator of Attack state.Valid values: open, closed
​
string
Filter events using a duration string (e.g., 24h, 7d, 30d).
​
string
Include results that occur after a specific date and time (RFC3339 format).Aliases: date_time_since
​
int32
Maximum number of results per request.Range: 1-1000
​
string
Pagination token to retrieve the next set of results.Aliases: next_token
​
switch
Repeat requests until all available results are retrieved.
​
switch
Display total result count instead of results.

​
Examples

​
Get-FalconCloudIom

Search for Falcon Cloud Security Indicators of Misconfiguration (IOM). Required Permission: CSPM registration: Read Alias: Get-FalconHorizonIom

​
Syntax

​
Parameters

​
string[]
Falcon Cloud Security Indicator of Misconfiguration identifier(s). Can be provided via pipeline.Aliases: ids
​
string
Falcon Query Language (FQL) expression to limit results.Must be a valid FQL statement.
​
string
Property and direction to sort results.Valid values: account_name.asc, account_name.desc, account_id.asc, account_id.desc, attack_types.asc, attack_types.desc, azure_subscription_id.asc, azure_subscription_id.desc, cloud_provider.asc, cloud_provider.desc, cloud_service_keyword.asc, cloud_service_keyword.desc, status.asc, status.desc, is_managed.asc, is_managed.desc, policy_id.asc, policy_id.desc, policy_type.asc, policy_type.desc, resource_id.asc, resource_id.desc, region.asc, region.desc, scan_time.asc, scan_time.desc, severity.asc, severity.desc, severity_string.asc, severity_string.desc, timestamp.asc, timestamp.desc
​
int
Maximum number of results per request.Range: 1-1000
​
int
Position to begin retrieving results (used for pagination).
​
string
Pagination token to retrieve the next set of results.Aliases: next_token
​
switch
Retrieve detailed information for IOMs.
​
switch
Repeat requests until all available results are retrieved.
​
switch
Display total result count instead of results.

​
Examples

​
Notes

  • Use the -Detailed switch to retrieve complete IOM information
  • The -Filter parameter supports complex FQL queries for precise filtering
  • Results can be sorted by multiple properties including severity, timestamp, and account information