Incidents

Get-FalconBehavior

Search for behaviors associated with incidents. Required Permission: Incidents: Read

Syntax

# Search for behaviors
Get-FalconBehavior [-Filter <string>] [-Sort <string>] [-Limit <int32>] [-Offset <int32>] 
  [-Detailed] [-All] [-Total]

# Get specific behaviors by ID
Get-FalconBehavior -Id <string[]>

Parameters

string[]

Behavior identifier(s). Can be provided via pipeline.Pattern: ^ind:[a-fA-F0-9]{32}:(\d|\-)+$Aliases: ids, behavior_id

string

Falcon Query Language (FQL) expression to limit results.Must be a valid FQL statement.

string

Property and direction to sort results.Valid values: timestamp.asc, timestamp.desc

int32

Maximum number of results per request.Range: 1-500

int32

Position to begin retrieving results (used for pagination).

switch

Retrieve detailed information for behaviors.

switch

Repeat requests until all available results are retrieved.

switch

Display total result count instead of results.

Examples

# Get all behaviors sorted by timestamp
Get-FalconBehavior -Sort timestamp.desc -All

# Get behaviors with specific filter
Get-FalconBehavior -Filter "severity:'high'" -Limit 100

# Get detailed behavior information
Get-FalconBehavior -Filter "timestamp:>'2026-03-01'" -Detailed -All

# Get specific behaviors by their IDs
$BehaviorIds = @('ind:abc123...', 'ind:def456...')
Get-FalconBehavior -Id $BehaviorIds

PSFalcon Wiki: Get-FalconBehavior

Get-FalconIncident

Search for incidents in the CrowdStrike Falcon platform. Required Permission: Incidents: Read

Syntax

# Search for incidents
Get-FalconIncident [-Filter <string>] [-Sort <string>] [-Limit <int32>] [-Offset <int32>] 
  [-Detailed] [-All] [-Total]

# Get specific incidents by ID
Get-FalconIncident -Id <string[]>

Parameters

string[]

Incident identifier(s). Can be provided via pipeline.Pattern: ^inc:[a-fA-F0-9]{32}:[a-fA-F0-9]{32}$Aliases: ids, incident_id

string

Falcon Query Language (FQL) expression to limit results.Must be a valid FQL statement.

string

Property and direction to sort results.Valid values: assigned_to.asc, assigned_to.desc, assigned_to_name.asc, assigned_to_name.desc, end.asc, end.desc, modified_timestamp.asc, modified_timestamp.desc, name.asc, name.desc, sort_score.asc, sort_score.desc, start.asc, start.desc, state.asc, state.desc, status.asc, status.desc

int32

Maximum number of results per request.Range: 1-500

int32

Position to begin retrieving results (used for pagination).

switch

Retrieve detailed information for incidents.

switch

Repeat requests until all available results are retrieved.

switch

Display total result count instead of results.

Examples

# Get all open incidents
Get-FalconIncident -Filter "state:'open'" -All

# Get incidents sorted by severity score
Get-FalconIncident -Sort sort_score.desc -Limit 50

# Get new incidents
Get-FalconIncident -Filter "status:'new'" -Sort start.desc

# Get incidents assigned to specific user
Get-FalconIncident -Filter "assigned_to_name:'user@example.com'"

# Get detailed incident information
Get-FalconIncident -Filter "state:'open'" -Detailed -All

# Get specific incidents by their IDs
$IncidentIds = @('inc:abc123...', 'inc:def456...')
Get-FalconIncident -Id $IncidentIds

# Get incident count
Get-FalconIncident -Filter "status:'new'" -Total

PSFalcon Wiki: Get-FalconIncident

Get-FalconScore

Search for CrowdScore values in the CrowdStrike Falcon platform. Required Permission: Incidents: Read

Syntax

Get-FalconScore [-Filter <string>] [-Sort <string>] [-Limit <int32>] [-Offset <int32>] 
  [-All] [-Total]

Parameters

string

Falcon Query Language (FQL) expression to limit results.Must be a valid FQL statement.

string

Property and direction to sort results.Valid values: score.asc, score.desc, timestamp.asc, timestamp.desc

int32

Maximum number of results per request.Range: 1-2500

int32

Position to begin retrieving results (used for pagination).

switch

Repeat requests until all available results are retrieved.

switch

Display total result count instead of results.

Examples

# Get all CrowdScores
Get-FalconScore -All

# Get CrowdScores sorted by value
Get-FalconScore -Sort score.desc -Limit 100

# Get CrowdScores from specific timeframe
Get-FalconScore -Filter "timestamp:>'2026-03-01'" -Sort timestamp.desc

# Get high scores
Get-FalconScore -Filter "score:>70" -Sort score.desc -All

PSFalcon Wiki: Get-FalconScore

Invoke-FalconIncidentAction

Perform actions on incidents in the CrowdStrike Falcon platform. Required Permission: Incidents: Write

Syntax

# Perform a single action
Invoke-FalconIncidentAction -Name <string> [-Value <string>] [-UpdateDetects <boolean>] 
  [-OverwriteDetects <boolean>] -Id <string[]>

# Perform multiple actions
Invoke-FalconIncidentAction -Action <hashtable[]> [-UpdateDetects <boolean>] 
  [-OverwriteDetects <boolean>] -Id <string[]>

Parameters

string

required

Action to perform on the incident(s).Valid values:

add_tag - Add a tag to the incident
delete_tag - Remove a tag from the incident
unassign - Unassign the incident
update_description - Update the incident description
update_name - Update the incident name
update_status - Update the incident status
update_assigned_to_v2 - Assign incident to a user

string

Value for the chosen action (e.g., tag name, description text, user ID, status value).

hashtable[]

One or more hashtables defining multiple name/value pairs for batch operations.Aliases: action_parametersExample: @(@{name='add_tag'; value='investigated'}, @{name='update_status'; value='closed'})

boolean

Update status of related ‘new’ detections when updating incident status.Aliases: update_detects

boolean

Replace existing status for related detections when updating incident status.Aliases: overwrite_detects

string[]

required

Incident identifier(s). Can be provided via pipeline.Pattern: ^inc:[a-fA-F0-9]{32}:[a-fA-F0-9]{32}$Aliases: ids, incident_id

Examples

# Update status of an incident
Invoke-FalconIncidentAction -Name update_status -Value 'closed' -Id $IncidentId

# Update status and related detections
Invoke-FalconIncidentAction -Name update_status -Value 'in_progress' -UpdateDetects $true -Id $IncidentId

# Add a tag to incidents
Invoke-FalconIncidentAction -Name add_tag -Value 'investigated' -Id $IncidentIds

# Remove a tag from incidents
Invoke-FalconIncidentAction -Name delete_tag -Value 'pending' -Id $IncidentIds

# Assign incident to a user
Invoke-FalconIncidentAction -Name update_assigned_to_v2 -Value 'user@example.com' -Id $IncidentId

# Unassign incident
Invoke-FalconIncidentAction -Name unassign -Id $IncidentId

# Update incident name
Invoke-FalconIncidentAction -Name update_name -Value 'Critical Security Incident' -Id $IncidentId

# Update incident description
Invoke-FalconIncidentAction -Name update_description -Value 'Investigation completed on 2026-03-05' -Id $IncidentId

# Perform multiple actions on an incident
$Actions = @(
    @{name='add_tag'; value='reviewed'},
    @{name='update_status'; value='closed'},
    @{name='update_description'; value='No threat detected'}
)
Invoke-FalconIncidentAction -Action $Actions -Id $IncidentId

# Process incidents from pipeline
Get-FalconIncident -Filter "status:'new'" | 
    Invoke-FalconIncidentAction -Name update_status -Value 'in_progress' -UpdateDetects $true

Notes

Maximum of 1000 incident IDs can be processed per request
When using -Action, multiple operations can be performed in a single API call
The -UpdateDetects parameter automatically updates related detections when changing incident status
Use -OverwriteDetects to replace existing detection statuses instead of only updating ‘new’ detections

PSFalcon Wiki: Invoke-FalconIncidentAction

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Get-FalconBehavior

Syntax

Parameters

Examples

Get-FalconIncident

Syntax

Parameters

Examples

Get-FalconScore

Syntax

Parameters

Examples

Invoke-FalconIncidentAction

Syntax

Parameters

Examples

Notes

​Get-FalconBehavior

​Syntax

​Parameters

​Examples

​Related Links

​Get-FalconIncident

​Syntax

​Parameters

​Examples

​Related Links

​Get-FalconScore

​Syntax

​Parameters

​Examples

​Related Links

​Invoke-FalconIncidentAction

​Syntax

​Parameters

​Examples

​Notes

​Related Links

Get-FalconBehavior

Syntax

Parameters

Examples

Related Links

Get-FalconIncident

Syntax

Parameters

Examples

Related Links

Get-FalconScore

Syntax

Parameters

Examples

Related Links

Invoke-FalconIncidentAction

Syntax

Parameters

Examples

Notes

Related Links