Falcon Intelligence

Manage threat intelligence including actors, reports, indicators, vulnerabilities, malware families, and detection rules.

Cmdlets

Get-FalconActor

Search for Falcon Intelligence threat actors. Permissions: Actors (Falcon Intelligence): Read

string[]

Threat actor identifier

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results. Valid values:

name|asc, name|desc
target_countries|asc, target_countries|desc
target_industries|asc, target_industries|desc
type|asc, type|desc
created_date|asc, created_date|desc
last_activity_date|asc, last_activity_date|desc
last_modified_date|asc, last_modified_date|desc

int32

Maximum number of results per request (1-5000)

string[]

Specific fields to return, or a predefined collection name surrounded by two underscores [default: basic]

string

Include additional information. Valid values: tactic_and_technique

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Search for actors targeting specific countries
Get-FalconActor -Filter "target_countries:'US'" -Detailed

# Get detailed information for a specific actor
Get-FalconActor -Id 'BEAR-001' -Field name,description,target_countries

# Search for actors with MITRE ATT&CK tactics and techniques
Get-FalconActor -Filter "type:'nation_state'" -Include tactic_and_technique -Detailed

Get-FalconAttck

Search for MITRE ATT&CK tactic and technique information related to specific actors. Permissions: Actors (Falcon Intelligence): Read

string[]

Tactic and technique identifier, by actor

string

Actor identifier (‘slug’)

Example

# Get MITRE ATT&CK tactics and techniques for an actor
Get-FalconAttck -Slug 'fancy-bear'

Get-FalconCve

Search for Falcon Intelligence CVE reports. Permissions: Vulnerabilities (Falcon Intelligence): Read

string[]

CVE identifier

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results

int

Maximum number of results per request

string

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Search for recent CVEs
Get-FalconCve -Filter "created_date:>'2024-01-01'" -Detailed

# Get details for a specific CVE
Get-FalconCve -Id 'CVE-2024-1234'

# Search for high severity vulnerabilities
Get-FalconCve -Filter "severity:'HIGH'" -All

Get-FalconIndicator

Search for Falcon Intelligence indicators. Permissions: Indicators (Falcon Intelligence): Read

string[]

Indicator identifier

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results. Valid values:

id|asc, id|desc
indicator|asc, indicator|desc
type|asc, type|desc
published_date|asc, published_date|desc
last_updated|asc, last_updated|desc
_marker|asc, _marker|desc

int32

Maximum number of results per request (1-5000)

boolean

Include previously deleted indicators

boolean

Include related indicators

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Search for malicious IP indicators
Get-FalconIndicator -Filter "type:'ip_address'" -Detailed

# Get indicators published in the last 7 days
Get-FalconIndicator -Filter "published_date:>'now-7d'" -IncludeRelation $true

# Search for domain indicators
Get-FalconIndicator -Query 'malicious-domain.com' -All

Get-FalconIntel

Search for Falcon Intelligence reports. Permissions: Reports (Falcon Intelligence): Read

string[]

Report identifier

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results. Valid values:

name|asc, name|desc
target_countries|asc, target_countries|desc
target_industries|asc, target_industries|desc
type|asc, type|desc
created_date|asc, created_date|desc
last_modified_date|asc, last_modified_date|desc

int32

Maximum number of results per request (1-5000)

string[]

Specific fields, or a predefined collection name surrounded by two underscores [default: basic]

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Search for recent intelligence reports
Get-FalconIntel -Filter "created_date:>'2024-01-01'" -Detailed

# Get a specific report
Get-FalconIntel -Id 'CSIT-12345'

# Search for reports targeting healthcare industry
Get-FalconIntel -Filter "target_industries:'Healthcare'" -All

Get-FalconMalwareFamily

Search for Falcon Intelligence malware families. Permissions: Malware Families (Falcon Intelligence): Read

string[]

Malware family identifier

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results

int32

Maximum number of results per request (1-5000)

string[]

Specific fields to return

int32

Position to begin retrieving results

switch

Retrieve MITRE TTP information for malware families

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Search for ransomware families
Get-FalconMalwareFamily -Filter "family_type:'ransomware'" -Detailed

# Get MITRE TTPs for a malware family
Get-FalconMalwareFamily -Id 'emotet' -Mitre

Get-FalconRule

Search for Falcon Intelligence rulesets. Permissions: Rules (Falcon Intelligence): Read

string[]

Ruleset identifier

string

required

Ruleset type. Valid values:

common-event-format
cql-changelog, cql-master, cql-update
netwitness
snort-suricata-changelog, snort-suricata-master, snort-suricata-update
yara-changelog, yara-master, yara-update

string[]

Ruleset name

string[]

Ruleset description

string[]

Ruleset tag

int32

Filter results to those created on or after a date

string

Filter results to those created on or before a date

string

Perform a generic substring search across available fields

string

Property and direction to sort results

int32

Maximum number of results per request (1-5000)

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Get YARA master ruleset
Get-FalconRule -Type yara-master -Detailed

# Get Snort/Suricata rules from the last 30 days
Get-FalconRule -Type snort-suricata-changelog -MinCreatedDate (Get-Date).AddDays(-30).ToFileTimeUtc()

# Search for specific rule by tag
Get-FalconRule -Type yara-master -Tag 'ransomware'

Receive-FalconAttck

Download MITRE ATT&CK information for an actor. Permissions: Actors (Falcon Intelligence): Read

string

Export format. Valid values: csv, json [default: json]

string

Destination path (default: ./slug.format)

string

required

Actor identifier

switch

Overwrite an existing file when present

Example

# Download actor ATT&CK data as JSON
Receive-FalconAttck -Slug 'fancy-bear' -Path './actor-ttps.json'

# Download as CSV format
Receive-FalconAttck -Slug 'fancy-bear' -Format csv -Path './actor-ttps.csv' -Force

Receive-FalconIntel

Download a Falcon Intelligence report. Permissions: Reports (Falcon Intelligence): Read

string

Destination path (default: slug.pdf)

string

required

Report identifier

switch

Overwrite an existing file when present

Example

# Download an intelligence report
Receive-FalconIntel -Id 'CSIT-12345' -Path './threat-report.pdf'

# Download and overwrite existing file
Receive-FalconIntel -Id 'CSIT-12345' -Path './report.pdf' -Force

Receive-FalconMalwareFamilyAttck

Download MITRE ATT&CK information for a malware family. Permissions: Malware Families (Falcon Intelligence): Read

string

Export format. Valid values: CSV, JSON, JSON_NAVIGATOR [default: JSON]

string

Destination path (default: ./slug.format)

string

required

Malware family identifier

switch

Overwrite an existing file when present

Example

# Download malware family ATT&CK data
Receive-FalconMalwareFamilyAttck -Slug 'emotet' -Path './emotet-ttps.json'

# Download as CSV
Receive-FalconMalwareFamilyAttck -Slug 'emotet' -Format CSV -Path './emotet.csv'

Receive-FalconRule

Download the most recent or a specific Falcon Intelligence ruleset. Permissions: Rules (Falcon Intelligence): Read

string

Ruleset type, used to retrieve the latest ruleset. Valid values:

common-event-format
cql-changelog, cql-master, cql-update
netwitness
snort-suricata-changelog, snort-suricata-master, snort-suricata-update
yara-changelog, yara-master, yara-update

string

Download the latest rule set only if it doesn’t have a matching ‘tags’ value

string

Restrict results to those modified after a provided date (HTTP, ANSIC or RFC850 format)

string

required

Destination path (must end with .gz, .gzip, or .zip)

int32

Ruleset identifier, used for a specific ruleset

switch

Overwrite an existing file when present

Example

# Download latest YARA master ruleset
Receive-FalconRule -Type yara-master -Path './yara-rules.zip'

# Download specific ruleset by ID
Receive-FalconRule -Id 12345 -Path './ruleset.zip'

# Download only if modified
Receive-FalconRule -Type snort-suricata-master -Path './snort.zip' -IfModifiedSince 'Mon, 01 Jan 2024 00:00:00 GMT'

IOC Management

Manage custom indicators of compromise

MalQuery

Hunt for malware samples using YARA

Sandbox Analysis

Submit and analyze files in Falcon Sandbox

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Falcon Intelligence

Cmdlets

Get-FalconActor

Get-FalconAttck

Get-FalconCve

Get-FalconIndicator

Get-FalconIntel

Get-FalconMalwareFamily

Get-FalconRule

Receive-FalconAttck

Receive-FalconIntel

Receive-FalconMalwareFamilyAttck

Receive-FalconRule

IOC Management

MalQuery

Sandbox Analysis

​Cmdlets

​Get-FalconActor

​Get-FalconAttck

​Get-FalconCve

​Get-FalconIndicator

​Get-FalconIntel

​Get-FalconMalwareFamily

​Get-FalconRule

​Receive-FalconAttck

​Receive-FalconIntel

​Receive-FalconMalwareFamilyAttck

​Receive-FalconRule

​Related Resources

IOC Management

MalQuery

Sandbox Analysis

Cmdlets

Get-FalconActor

Get-FalconAttck

Get-FalconCve

Get-FalconIndicator

Get-FalconIntel

Get-FalconMalwareFamily

Get-FalconRule

Receive-FalconAttck

Receive-FalconIntel

Receive-FalconMalwareFamilyAttck

Receive-FalconRule

Related Resources