Host Groups

Get-FalconHostGroup

Search for host groups in your environment.

Get-FalconHostGroup [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Include] <String[]>] [[-Offset] <Int32>] [-Detailed] [-All] [-Total]
Get-FalconHostGroup -Id <String[]> [-Include <String[]>]

string[]

Host group identifier(s) to retrieve specific groupsAliases: ids

string

Falcon Query Language (FQL) expression to limit resultsExample: name:'*Production*'+group_type:'static'

string

Property and direction to sort resultsValid values: created_by.asc, created_by.desc, created_timestamp.asc, created_timestamp.desc, group_type.asc, group_type.desc, modified_by.asc, modified_by.desc, modified_timestamp.asc, modified_timestamp.desc, name.asc, name.desc

int32

Maximum number of results per request (1-500)

string[]

Include additional properties in the responseValid values: members - Include member host IDs

int32

Position to begin retrieving results (for pagination)

switch

Retrieve detailed information for host groups

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Required Permission: Host groups: Read

Examples

# Get all host groups
Get-FalconHostGroup -All

# Get detailed information for all groups
Get-FalconHostGroup -Detailed -All

# Get groups with member information
Get-FalconHostGroup -Include members -All

# Get a specific host group by ID
Get-FalconHostGroup -Id "group123abc..."

# Get multiple groups by ID
Get-FalconHostGroup -Id "group123abc...","group456def..."

# Find static host groups
Get-FalconHostGroup -Filter "group_type:'static'" -Detailed -All

# Find groups by name pattern
Get-FalconHostGroup -Filter "name:'*Production*'" -All

# Sort groups by modification date
Get-FalconHostGroup -Sort modified_timestamp.desc -All

New-FalconHostGroup

Create new host groups.

New-FalconHostGroup -GroupType <String> -Name <String> [-Description <String>] [-AssignmentRule <String>]
New-FalconHostGroup -InputObject <Object[]>

string

required

Type of host group to createValid values:

static - Manually managed membership
staticByID - Manually managed by device ID
dynamic - Automatically managed via FQL assignment rule

Aliases: group_type

string

required

Host group name

string

Host group description

string

FQL-based assignment rule (required for dynamic groups, not applicable for static groups)Example: platform_name:'Windows'+tags:'FalconGroupingTags/Production'Aliases: assignment_rule

object[]

One or more host group objects to create in a single request (up to 10 per request)Aliases: resources, Array

Required Permission: Host groups: Write

Examples

# Create a static host group
New-FalconHostGroup -GroupType static -Name "Production Servers" -Description "Production environment servers"

# Create a static group with ID-based membership
New-FalconHostGroup -GroupType staticByID -Name "Critical Assets" -Description "Business critical systems"

# Create a dynamic group with assignment rule
New-FalconHostGroup -GroupType dynamic -Name "Windows Production" -Description "All Windows production hosts" -AssignmentRule "platform_name:'Windows'+tags:'FalconGroupingTags/Production'"

# Create a dynamic group for Linux servers
New-FalconHostGroup -GroupType dynamic -Name "Linux Servers" -AssignmentRule "platform_name:'Linux'"

# Create multiple groups at once
$Groups = @(
    @{
        group_type = 'static'
        name = 'Web Servers'
        description = 'Production web servers'
    },
    @{
        group_type = 'static'
        name = 'Database Servers'
        description = 'Production database servers'
    }
)
New-FalconHostGroup -InputObject $Groups

Dynamic host groups automatically update membership based on the assignment rule. Static groups require manual membership management using Invoke-FalconHostGroupAction.

Edit-FalconHostGroup

Modify existing host groups.

Edit-FalconHostGroup [[-Name] <String>] [[-Description] <String>] [[-AssignmentRule] <String>] -Id <String>

string

New host group name

string

New host group description

string

New FQL-based assignment rule (only applicable for dynamic host groups)Aliases: assignment_rule

string

required

Host group identifier to modify

Required Permission: Host groups: Write

Examples

# Update group name
Edit-FalconHostGroup -Id "group123abc..." -Name "Production Web Servers"

# Update description
Edit-FalconHostGroup -Id "group123abc..." -Description "Updated description"

# Update multiple properties
Edit-FalconHostGroup -Id "group123abc..." -Name "New Name" -Description "New description"

# Update assignment rule for dynamic group
Edit-FalconHostGroup -Id "group123abc..." -AssignmentRule "platform_name:'Windows'+tags:'FalconGroupingTags/Production'+tags:'FalconGroupingTags/WebServer'"

# Update group from pipeline
Get-FalconHostGroup -Filter "name:'Old Name'" | Edit-FalconHostGroup -Name "New Name"

Remove-FalconHostGroup

Remove host groups.

Remove-FalconHostGroup -Id <String[]>

string[]

required

Host group identifier(s) to removeAliases: ids

Required Permission: Host groups: Write

Examples

# Remove a single host group
Remove-FalconHostGroup -Id "group123abc..."

# Remove multiple host groups
Remove-FalconHostGroup -Id "group123abc...","group456def..."

# Remove groups matching a filter
Get-FalconHostGroup -Filter "name:'*Test*'" | Remove-FalconHostGroup

Removing a host group is permanent and cannot be undone. Ensure you have the correct group ID before executing.

Get-FalconHostGroupMember

Search for members of a host group.

Get-FalconHostGroupMember [[-Id] <String>] [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Offset] <Int32>] [-Detailed] [-All] [-Total]

string

Host group identifier to retrieve members from

string

Falcon Query Language (FQL) expression to limit member results

string

Property and direction to sort results

int32

Maximum number of results per request (1-500)

int32

Position to begin retrieving results

switch

Retrieve detailed member information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Required Permission: Host groups: Read

Examples

# Get all members of a host group
Get-FalconHostGroupMember -Id "group123abc..." -All

# Get detailed member information
Get-FalconHostGroupMember -Id "group123abc..." -Detailed -All

# Get member count
Get-FalconHostGroupMember -Id "group123abc..." -Total

# Get members with filter
Get-FalconHostGroupMember -Id "group123abc..." -Filter "platform_name:'Windows'" -All

# Get sorted members
Get-FalconHostGroupMember -Id "group123abc..." -Sort "hostname.asc" -All

# Get members from pipeline
Get-FalconHostGroup -Filter "name:'Production'" | Get-FalconHostGroupMember -All

Invoke-FalconHostGroupAction

Add or remove hosts from host groups.

Invoke-FalconHostGroupAction -Name <String> -Id <String> -HostId <String[]>

string

required

Action to performValid values:

add-hosts - Add hosts to the group
remove-hosts - Remove hosts from the group

Aliases: action_name

string

required

Host group identifier to modify

string[]

required

Host identifier(s) to add or remove (processed in batches of 500)Aliases: ids, device_id, HostIds

Required Permission: Host groups: Write

Examples

# Add a single host to a group
Invoke-FalconHostGroupAction -Name add-hosts -Id "group123abc..." -HostId "host123def..."

# Add multiple hosts to a group
$HostIds = @("host123def...","host456ghi...")
Invoke-FalconHostGroupAction -Name add-hosts -Id "group123abc..." -HostId $HostIds

# Remove a host from a group
Invoke-FalconHostGroupAction -Name remove-hosts -Id "group123abc..." -HostId "host123def..."

# Remove multiple hosts from a group
$HostIds = @("host123def...","host456ghi...")
Invoke-FalconHostGroupAction -Name remove-hosts -Id "group123abc..." -HostId $HostIds

# Add hosts from search results to a group
Get-FalconHost -Filter "platform_name:'Linux'" | Invoke-FalconHostGroupAction -Name add-hosts -Id "group123abc..."

# Remove hosts from a group
Get-FalconHostGroupMember -Id "group123abc..." -Filter "last_seen:<'2024-01-01'" | Invoke-FalconHostGroupAction -Name remove-hosts -Id "group123abc..."

Host membership actions are processed in batches of 500. For large operations, the cmdlet automatically handles batching.

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Get-FalconHostGroup

Examples

New-FalconHostGroup

Examples

Edit-FalconHostGroup

Examples

Remove-FalconHostGroup

Examples

Get-FalconHostGroupMember

Examples

Invoke-FalconHostGroupAction

Examples

​Get-FalconHostGroup

​Examples

​New-FalconHostGroup

​Examples

​Edit-FalconHostGroup

​Examples

​Remove-FalconHostGroup

​Examples

​Get-FalconHostGroupMember

​Examples

​Invoke-FalconHostGroupAction

​Examples

Get-FalconHostGroup

Examples

New-FalconHostGroup

Examples

Edit-FalconHostGroup

Examples

Remove-FalconHostGroup

Examples

Get-FalconHostGroupMember

Examples

Invoke-FalconHostGroupAction

Examples