LogScale (Foundry)

The LogScale API enables integration between PSFalcon and Falcon LogScale (formerly Humio) or Falcon NGSIEM for streaming security events and executing saved searches within Falcon Foundry applications.

Overview

PSFalcon’s LogScale integration provides:

Event streaming: Send PSFalcon command results to LogScale repositories
Saved searches: Execute queries and retrieve results from Falcon Foundry apps
Repository discovery: List available LogScale repositories and views
Audit logging: Track PSFalcon API activity in external log systems

Event Collector Configuration

Register LogScale destination

Register-FalconEventCollector -Uri <System.Uri> -Token <string> [-Enable <string[]>]

System.Uri

required

Falcon LogScale cloud or Falcon NGSIEM HEC ingestion URI. Supported formats:

LogScale: https://cloud.us.humio.com/ (token determines repository)
NGSIEM: https://ngsiem-instance.com:8088/services/collector/ (Splunk HEC endpoint)

string

required

Ingestion token:

LogScale: 32-character hexadecimal token
NGSIEM: UUID format HEC token

string[]

Define which events to send to the collector. Options:

requests: Log all API requests made by PSFalcon
responses: Log all API responses received by PSFalcon

Example: Register LogScale endpoint

Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" -Enable requests,responses

Example: Register NGSIEM endpoint

Register-FalconEventCollector -Uri "https://ngsiem.example.com:8088/services/collector/" -Token "12345678-1234-1234-1234-123456789abc" -Enable responses

Once configured, PSFalcon will automatically send enabled event types to the collector. The module will not send events until Enable options are chosen.

View current collector configuration

Show-FalconEventCollector

Show-FalconEventCollector

Displays the currently configured LogScale or NGSIEM endpoint, token, and enabled event types. Example

Show-FalconEventCollector

Output

Uri    : https://cloud.us.humio.com/api/v1/ingest/humio-structured/
Token  : a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
Enable : {requests, responses}

Remove collector configuration

Unregister-FalconEventCollector

Unregister-FalconEventCollector

Removes the existing LogScale or NGSIEM configuration and stops event transmission. Example

Unregister-FalconEventCollector

Sending Events

Send custom events

Send-FalconEvent

Send-FalconEvent -Object <object>

object

required

PSFalcon command output or custom object to send as an event

Sends events to the configured LogScale or NGSIEM destination. Objects are automatically formatted based on the target platform. Example: Send detection events

# Register collector first
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "your-token-here"

# Get detections and send to LogScale
Get-FalconDetection -Filter "status:'new'" -Detailed -All | Send-FalconEvent

Example: Send host information

Get-FalconHost -Filter "platform_name:'Windows'" -Detailed -All | Send-FalconEvent

Example: Send custom event

$CustomEvent = [PSCustomObject]@{
    timestamp = Get-Date -Format o
    event_type = "security_scan"
    host_count = 150
    status = "completed"
    findings = 5
}

Send-FalconEvent -Object $CustomEvent

Use pipeline to automatically stream any PSFalcon command results to LogScale:

Get-FalconAlert -Filter "severity:['High','Critical']" -All | Send-FalconEvent

Falcon Foundry Integration

List available repositories

Get-FalconFoundryRepository

Get-FalconFoundryRepository [-CheckTestData <boolean>]

boolean

Include whether test data is present in the application repository

Lists available Falcon Foundry application repositories. Example

Get-FalconFoundryRepository -CheckTestData $true

List available views

Get-FalconFoundryView

Get-FalconFoundryView [-CheckTestData <boolean>]

boolean

Include whether test data is present in the application repository

Lists available Falcon Foundry views. Example

Get-FalconFoundryView -CheckTestData $true

Execute saved search

Get-FalconFoundrySearch

Get-FalconFoundrySearch -Id <string> [-AppId <string>] [-InferJsonTypes <boolean>] [-Limit <string>] [-MatchResponseSchema <boolean>] [-Metadata <boolean>] [-JobStatusOnly <boolean>] [-Offset <string>]

string

required

Search identifier (job ID)

string

Foundry application identifier

boolean

Whether to try to infer data types in JSON event response instead of returning map[string]string

string

Maximum number of results per request

boolean

Whether to validate search results against their schema

boolean

Whether to include metadata in the response

boolean

Whether to include job status and remove results in the response

string

Position to begin retrieving results

Example: Execute saved search

# Get search results
$Results = Get-FalconFoundrySearch -Id "saved-search-id" -Limit 100

# Process results
$Results | ForEach-Object {
    Write-Host "Event: $($_.event_type) at $($_.timestamp)"
}

Example: Check search job status

Get-FalconFoundrySearch -Id "job-id" -JobStatusOnly $true

Common Workflows

Stream API activity to LogScale

# Register collector with API logging enabled
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "your-token" -Enable requests,responses

# All subsequent PSFalcon commands will automatically log to LogScale
Get-FalconDetection -Filter "status:'new'" -All
Get-FalconHost -Filter "platform_name:'Linux'" -All

# API requests and responses are now searchable in LogScale

Audit security operations

# Configure collector for response logging
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "your-token" -Enable responses

# Perform security operations
$Detections = Get-FalconDetection -Filter "severity:'Critical'" -Detailed -All

foreach ($Detection in $Detections) {
    # Update detection status
    $Update = Edit-FalconDetection -Id $Detection.detection_id -Status in_progress
    
    # Each operation is logged to LogScale
}

# Query LogScale to audit all detection status changes

Send scheduled reports

# Register collector
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "your-token"

# Generate daily security report
$Report = [PSCustomObject]@{
    report_date = Get-Date -Format "yyyy-MM-dd"
    report_type = "daily_security_summary"
    
    # Get counts
    new_detections = (Get-FalconDetection -Filter "created_timestamp:>'last 24 hours'" -Total)
    critical_alerts = (Get-FalconAlert -Filter "severity:'Critical'+created_timestamp:>'last 24 hours'" -Total)
    new_hosts = (Get-FalconHost -Filter "first_seen:>'last 24 hours'" -Total)
    
    # Get details
    top_detections = Get-FalconDetection -Filter "created_timestamp:>'last 24 hours'" -Limit 10 -Detailed
}

# Send to LogScale
Send-FalconEvent -Object $Report

Export investigation data

# Register collector
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "your-token"

# Investigate an incident
$IncidentId = "inc:abc123:1234567890"

# Get all related data and send to LogScale for analysis
Get-FalconIncident -Id $IncidentId -Detailed | Send-FalconEvent
Get-FalconDetection -Filter "incident_id:'$IncidentId'" -Detailed -All | Send-FalconEvent
Get-FalconAlert -Filter "incident_id:'$IncidentId'" -Detailed -All | Send-FalconEvent

# Query LogScale to correlate and analyze incident timeline

Monitor real-time events

# Register collector for real-time monitoring
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token "your-token"

# Continuous monitoring loop
while ($true) {
    # Get new detections in last minute
    $Since = (Get-Date).AddMinutes(-1).ToString('yyyy-MM-ddTHH:mm:ssZ')
    $NewDetections = Get-FalconDetection -Filter "created_timestamp:>'$Since'" -Detailed -All
    
    if ($NewDetections) {
        # Send to LogScale
        $NewDetections | Send-FalconEvent
        
        Write-Host "Sent $($NewDetections.Count) new detections to LogScale"
    }
    
    # Wait before next check
    Start-Sleep -Seconds 60
}

Integrate with Foundry apps

# List available Foundry repositories
$Repos = Get-FalconFoundryRepository -CheckTestData $true

foreach ($Repo in $Repos) {
    Write-Host "Repository: $($Repo.name)"
    Write-Host "  Description: $($Repo.description)"
    Write-Host "  Has test data: $($Repo.has_test_data)"
}

# List available views
$Views = Get-FalconFoundryView -CheckTestData $true

foreach ($View in $Views) {
    Write-Host "View: $($View.name)"
    Write-Host "  Repository: $($View.repository)"
}

Event Formats

LogScale Event Format

[
  {
    "tags": {
      "host": "workstation-01",
      "source": "PSFalcon/2.2"
    },
    "events": [
      {
        "timestamp": "2024-01-15T10:30:00Z",
        "attributes": {
          "detection_id": "ldt:abc123:1234567890",
          "severity": "Critical",
          "status": "new"
        }
      }
    ]
  }
]

NGSIEM Event Format

{
  "event": {
    "detection_id": "ldt:abc123:1234567890",
    "severity": "Critical",
    "status": "new"
  },
  "@timestamp": 1705315800000,
  "@sourcetype": "PSFalcon/2.2"
}

Supported LogScale Clouds

PSFalcon includes auto-completion for common LogScale cloud endpoints:

https://cloud.community.humio.com/
https://cloud.humio.com/
https://cloud.us.humio.com/

For Falcon NGSIEM or on-premises LogScale, provide the full HEC ingestion URL.

Tips

Enable Selective Logging

Use -Enable responses for audit trails of what data was retrieved
Use -Enable requests for debugging API calls
Use -Enable requests,responses for complete API activity logging

Performance Considerations

Sending large result sets can impact performance
Consider batching events or filtering to reduce volume
Use -Limit parameters to control result set sizes

Requires App Logs: Read permission for Foundry operations.Event collector configuration is stored in the current PSFalcon session and does not persist between PowerShell sessions.

Protect your ingestion tokens. Store them securely and never commit them to source control.

# Use secure input
$Token = Read-Host "Enter LogScale token" -AsSecureString
$PlainToken = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
    [Runtime.InteropServices.Marshal]::SecureStringToBSTR($Token)
)
Register-FalconEventCollector -Uri "https://cloud.us.humio.com/" -Token $PlainToken

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

LogScale (Foundry)

Overview

Event Collector Configuration

Register LogScale destination

View current collector configuration

Remove collector configuration

Sending Events

Send custom events

Falcon Foundry Integration

List available repositories

List available views

Execute saved search

Common Workflows

Stream API activity to LogScale

Audit security operations

Send scheduled reports

Export investigation data

Monitor real-time events

Integrate with Foundry apps

Event Formats

LogScale Event Format

NGSIEM Event Format

Supported LogScale Clouds

Tips

​Overview

​Event Collector Configuration

​Register LogScale destination

​View current collector configuration

​Remove collector configuration

​Sending Events

​Send custom events

​Falcon Foundry Integration

​List available repositories

​List available views

​Execute saved search

​Common Workflows

​Stream API activity to LogScale

​Audit security operations

​Send scheduled reports

​Export investigation data

​Monitor real-time events

​Integrate with Foundry apps

​Event Formats

​LogScale Event Format

​NGSIEM Event Format

​Supported LogScale Clouds

​Tips

Overview

Event Collector Configuration

Register LogScale destination

View current collector configuration

Remove collector configuration

Sending Events

Send custom events

Falcon Foundry Integration

List available repositories

List available views

Execute saved search

Common Workflows

Stream API activity to LogScale

Audit security operations

Send scheduled reports

Export investigation data

Monitor real-time events

Integrate with Foundry apps

Event Formats

LogScale Event Format

NGSIEM Event Format

Supported LogScale Clouds

Tips