API Reference Overview

Module Structure

PSFalcon v2.2.9 is organized around CrowdStrike Falcon API service categories, with cmdlets grouped by functionality:

OAuth2 & Authentication

Token management and authentication

Host & Device Management

Host groups, device control, and grouping tags

Prevention & Response

Prevention policies, response policies, and IOA rules

Real-Time Response

Interactive command sessions and remote actions

Detection & Incidents

Alerts, detections, behaviors, and incident management

Threat Intelligence

Actors, indicators, malware families, and reports

Cloud Security

AWS, Azure, GCP account management and posture

Container Security

Container policies, images, registries, and vulnerabilities

Naming Conventions

PSFalcon follows PowerShell best practices with consistent verb-noun patterns:

Standard Verbs

Verb	Purpose	Example
`Get-`	Retrieve resources	`Get-FalconHost`, `Get-FalconAlert`
`New-`	Create new resources	`New-FalconHostGroup`, `New-FalconIoc`
`Edit-`	Modify existing resources	`Edit-FalconHostGroup`, `Edit-FalconUser`
`Remove-`	Delete resources	`Remove-FalconHostGroup`, `Remove-FalconIoc`
`Invoke-`	Perform actions	`Invoke-FalconHostAction`, `Invoke-FalconRtr`
`Request-`	Request credentials/tokens	`Request-FalconToken`
`Revoke-`	Revoke credentials/tokens	`Revoke-FalconToken`
`Start-`	Start operations	`Start-FalconSession`, `Start-FalconScan`
`Stop-`	Stop operations	`Stop-FalconScan`, `Stop-FalconMigration`
`Send-`	Upload files/data	`Send-FalconSample`, `Send-FalconPutFile`
`Receive-`	Download files/data	`Receive-FalconInstaller`, `Receive-FalconArtifact`

Noun Structure

All cmdlets use the Falcon prefix followed by the resource type:

[Verb]-Falcon[Resource][Qualifier]

Examples:

Get-FalconHost - Get host information
Get-FalconHostGroup - Get host group information
Get-FalconHostGroupMember - Get host group membership
New-FalconIoaExclusion - Create IOA exclusion
Edit-FalconFirewallPolicy - Modify firewall policy

Common Parameters

PSFalcon cmdlets share common parameter patterns for consistency:

Identifiers

string or array

Resource identifier(s), typically 32-character hexadecimal valuesPattern: ^[a-fA-F0-9]{32}$Aliases: ids, device_id, device_ids, host_ids, etc.

Filtering & Search

string

Falcon Query Language (FQL) expression to limit resultsExample: "hostname:'DESKTOP-*'+platform_name:'Windows'"

string

Property and direction to sort resultsFormat: property_name.asc or property_name.descExample: "last_seen.desc"

integer

Maximum number of results per requestDefault: Varies by cmdlet (typically 100 or 500)Maximum: Varies by API endpoint (typically 5000)

integer

Position to begin retrieving results for paginationDefault: 0

switch

Retrieve all available results using automatic pagination

switch

Retrieve detailed information instead of identifier-only results

Common Properties

string

Resource name (policies, groups, etc.)

string

Resource description

PowerShell Features

All cmdlets support standard PowerShell features:

Pipeline support: Most cmdlets accept pipeline input via ValueFromPipeline or ValueFromPipelineByPropertyName
Parameter validation: Built-in validation for patterns, sets, and custom scripts
ShouldProcess: Many modification cmdlets support -WhatIf and -Confirm
Progress indicators: Long-running operations display progress

API Credential Caching

PSFalcon caches your API credentials and token after successful authentication: Cached Information:

ClientId - OAuth2 client identifier
ClientSecret - OAuth2 client secret
Hostname - CrowdStrike API hostname/cloud
MemberCid - Member CID for multi-CID environments
Expiration - Token expiration timestamp

The module automatically requests a new token when the current token expires in less than 240 seconds.

Error Handling

PSFalcon cmdlets return detailed error information:

try {
    Get-FalconHost -Id 'invalid'
} catch {
    Write-Host "Error: $($_.Exception.Message)"
    Write-Host "Status: $($_.CategoryInfo.Category)"
}

$Result = Get-FalconHost -Filter "hostname:'DESKTOP-01'"
if ($Result) {
    Write-Host "Found: $($Result.hostname)"
} else {
    Write-Host "No hosts found"
}

Module Information

string

2.2.9

string

Brendan Kremian

string

CrowdStrike

string

5.1 minimum required

array

Desktop, Core (cross-platform support)

Next Steps

OAuth2 Authentication

Learn how to authenticate and manage tokens

Host Management

Manage hosts, groups, and device actions

Real-Time Response

Execute commands on remote hosts

Prevention Policies

Configure prevention and response policies

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

API Reference Overview

Module Structure

OAuth2 & Authentication

Host & Device Management

Prevention & Response

Real-Time Response

Detection & Incidents

Threat Intelligence

Cloud Security

Container Security

Naming Conventions

Standard Verbs

Noun Structure

Common Parameters

Identifiers

Filtering & Search

Common Properties

PowerShell Features

API Credential Caching

Error Handling

Module Information

Next Steps

OAuth2 Authentication

Host Management

Real-Time Response

Prevention Policies

​Module Structure

OAuth2 & Authentication

Host & Device Management

Prevention & Response

Real-Time Response

Detection & Incidents

Threat Intelligence

Cloud Security

Container Security

​Naming Conventions

​Standard Verbs

​Noun Structure

​Common Parameters

​Identifiers

​Filtering & Search

​Common Properties

​PowerShell Features

​API Credential Caching

​Error Handling

​Module Information

​Next Steps

OAuth2 Authentication

Host Management

Real-Time Response

Prevention Policies

Module Structure

Naming Conventions

Standard Verbs

Noun Structure

Common Parameters

Identifiers

Filtering & Search

Common Properties

PowerShell Features

API Credential Caching

Error Handling

Module Information

Next Steps