Recon - PSFalcon

The Recon API provides access to Falcon Intelligence Recon capabilities, enabling monitoring of external threat intelligence sources for brand protection, credential leaks, and domain reconnaissance.

Overview

Falcon Intelligence Recon helps organizations monitor the dark web, paste sites, and other external sources for:

Exposed credentials: Leaked usernames, passwords, and authentication data
Brand monitoring: Typosquatting, phishing, and impersonation
Data breaches: Compromised customer or employee information
Third-party risks: Supply chain and vendor exposure

Monitoring rules trigger notifications when threats are detected, with configurable actions for alerting and response.

Monitoring Rules

Search for monitoring rules

Get-FalconReconRule

Get-FalconReconRule [-Filter <string>] [-Query <string>] [-Sort <string>] [-SecondarySort <string>] [-Limit <int32>] [-Offset <int32>] [-Detailed] [-All] [-Total]

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results. Options: created_timestamp|asc, created_timestamp|desc, last_updated_timestamp|asc, last_updated_timestamp|desc

string

Secondary sort property and direction

int32

Maximum number of results per request (1-500)

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example: List all high-priority monitoring rules

Get-FalconReconRule -Filter "priority:'high'" -Detailed -All

Get rule details by ID

Get-FalconReconRule -Id <string[]>

string[]

required

Monitoring rule identifier(s)

Create a monitoring rule

New-FalconReconRule

New-FalconReconRule -Name <string> -Topic <string> -Filter <string> -Priority <string> -Permission <string> [-BreachMonitoring <boolean>] [-BreachMonitorOnly <boolean>] [-SubstringMatching <boolean>] [-MatchOnTsqResultType <string[]>] [-OriginatingTemplateId <string>]

string

required

Monitoring rule name

string

required

Monitoring rule topic. Options: SA_ALIAS, SA_AUTHOR, SA_BIN, SA_BRAND_PRODUCT, SA_CUSTOM, SA_CVE, SA_DOMAIN, SA_EMAIL, SA_IP, SA_THIRD_PARTY, SA_VIP

string

required

Falcon Query Language expression to define what to monitor

string

required

Monitoring rule priority: high, medium, or low

string

required

Permission level: public (All Intel users) or private (Recon Admins)

boolean

Monitor for breach data

boolean

Monitor only for breach data (requires BreachMonitoring: True)

boolean

Monitor for substring matches (Typosquatting topic only)

string[]

Monitor for basedomains and/or subdomains (Typosquatting topic only)

string

Identifier of originating rule template, if based on one

Example: Create a domain monitoring rule

New-FalconReconRule -Name "Monitor Company Domains" -Topic SA_DOMAIN -Filter "domain:*'example.com'" -Priority high -Permission private -BreachMonitoring $true

Modify a monitoring rule

Edit-FalconReconRule

Edit-FalconReconRule -Id <string> -Name <string> -Filter <string> -Priority <string> -Permission <string> [-BreachMonitoring <boolean>] [-BreachMonitorOnly <boolean>] [-SubstringMatching <boolean>] [-MatchOnTsqResultType <string[]>]

string

required

Monitoring rule identifier

string

required

Updated monitoring rule name

string

required

Updated monitoring rule filter

string

required

Updated priority: high, medium, or low

string

required

Updated permission level: public or private

Delete monitoring rules

Remove-FalconReconRule

Remove-FalconReconRule -Id <string[]> [-DeleteNotification <boolean>]

string[]

required

Monitoring rule identifier(s)

boolean

Delete notifications generated by rule(s)

Preview rule notifications

Get-FalconReconRulePreview

Get-FalconReconRulePreview -Topic <string> -Filter <string>

string

required

Monitoring rule topic

string

required

Monitoring rule filter to preview

Example: Preview notification count

Get-FalconReconRulePreview -Topic SA_EMAIL -Filter "email:*'@example.com'"

Notifications

Search for notifications

Get-FalconReconNotification

Get-FalconReconNotification [-Filter <string>] [-Query <string>] [-Sort <string>] [-Limit <int32>] [-Offset <int32>] [-Detailed] [-All] [-Total] [-Intel] [-Translate] [-Combined]

string

Falcon Query Language expression to limit results

string

Perform a generic substring search

string

Property and direction to sort results. Options: created_date|asc, created_date|desc, updated_date|asc, updated_date|desc

int32

Maximum number of results per request (1-500)

switch

Include raw intelligence content

switch

Translate to English

switch

Include raw intelligence content and translate to English

Example: Get recent high-priority notifications

Get-FalconReconNotification -Filter "rule.priority:'high'+created_date:>'2024-01-01'" -Sort "created_date|desc" -Detailed -All

Get notification details by ID

Get-FalconReconNotification -Id <string[]> [-Intel] [-Translate] [-Combined]

string[]

required

Notification identifier(s)

Modify notification status

Edit-FalconReconNotification

Edit-FalconReconNotification -Id <string> -Status <string> -AssignedToUuid <string> [-Message <string>] [-IdpSendStatus <string>]

string

required

Notification identifier

string

required

Notification status: new, in-progress, closed-false-positive, or closed-true-positive

string

required

User identifier to assign the notification to

string

Optional message or note

Example: Assign and close a notification

Edit-FalconReconNotification -Id "abc123" -Status closed-true-positive -AssignedToUuid "user-uuid-here" -Message "Confirmed credential leak, reset performed"

Delete notifications

Remove-FalconReconNotification -Id <string[]>

string[]

required

Notification identifier(s)

Exposed Data Records

Search for exposed data records

Get-FalconReconRecord

Get-FalconReconRecord [-Filter <string>] [-Query <string>] [-Sort <string>] [-Limit <int>] [-Offset <int>] [-Detailed] [-All] [-Total]

string

Falcon Query Language expression to limit results

string

Perform a generic substring search

string

Property and direction to sort results

Example: Search for records by domain

Get-FalconReconRecord -Filter "email_domain:'example.com'" -Detailed -All

Get record details by ID

Get-FalconReconRecord -Id <string[]>

string[]

required

Exposed data record identifier(s)

Rule Actions

Search for actions

Get-FalconReconAction

Get-FalconReconAction [-Filter <string>] [-Query <string>] [-Sort <string>] [-Limit <int32>] [-Offset <int32>] [-Detailed] [-All] [-Total]

string

Falcon Query Language expression to limit results

Get action details by ID

Get-FalconReconAction -Id <string[]>

string[]

required

Action identifier(s)

Create a rule action

New-FalconReconAction

New-FalconReconAction -RuleId <string> -Type <string> -Frequency <string> -Recipient <string[]> [-ContentFormat <string>] [-TriggerMatchless <boolean>]

string

required

Monitoring rule identifier

string

required

Notification type: email

string

required

Notification frequency: asap, daily, or weekly

string[]

required

Email address(es) for notifications

string

Email format: standard or enhanced

boolean

Send email when no matches are found

Example: Create email action for a rule

New-FalconReconAction -RuleId "rule-uuid" -Type email -Frequency asap -Recipient "security@example.com" -ContentFormat enhanced

Modify an action

Edit-FalconReconAction

Edit-FalconReconAction -Id <string> -Frequency <string> -Recipient <string[]> -Status <string> -ContentFormat <string> -TriggerMatchless <boolean>

string

required

Action identifier

string

required

Action frequency: asap, daily, or weekly

string[]

required

Email address(es)

string

required

Action status: enabled or muted

string

required

Email format: standard or enhanced

boolean

required

Send email when no matches are found

Delete an action

Remove-FalconReconAction -Id <string>

string

required

Action identifier

Export Jobs

Create an export job

Invoke-FalconReconExport

Invoke-FalconReconExport -Entity <string> -Filter <string> -Sort <string> -ExportType <string> -HumanReadable <boolean>

string

required

Entity type: notification-exposed-data-record

string

required

Falcon Query Language expression to filter export data

string

required

Property and direction to sort results (see cmdlet help for full list)

string

required

Export file format: csv or json

boolean

required

Use property names that match the Falcon UI

Example: Export exposed credentials

$JobId = Invoke-FalconReconExport -Entity notification-exposed-data-record -Filter "email_domain:'example.com'" -Sort "created_date|desc" -ExportType csv -HumanReadable $true

Check export job status

Get-FalconReconExport

Get-FalconReconExport -Id <string[]>

string[]

required

Recon export job identifier(s)

Download export file

Receive-FalconReconExport

Receive-FalconReconExport -Path <string> -Id <string>

string

required

Destination path for downloaded file

string

required

Recon export job identifier

Example: Download completed export

Receive-FalconReconExport -Path ./exposed-data.csv -Id $JobId

Delete export job

Remove-FalconReconExport -Id <string[]>

string[]

required

Recon export job identifier(s)

Common Workflows

Monitor for exposed credentials

# Create monitoring rule
$Rule = New-FalconReconRule -Name "Employee Email Monitoring" -Topic SA_EMAIL -Filter "email:*'@example.com'" -Priority high -Permission private -BreachMonitoring $true

# Create email alert action
New-FalconReconAction -RuleId $Rule.id -Type email -Frequency asap -Recipient "soc@example.com" -ContentFormat enhanced

# Check for new notifications
Get-FalconReconNotification -Filter "rule.id:'$($Rule.id)'+status:'new'" -Detailed -All

Review and triage notifications

# Get high-priority notifications
$Notifications = Get-FalconReconNotification -Filter "rule.priority:'high'+status:'new'" -Detailed -All

# Review and assign
foreach ($Notification in $Notifications) {
    Edit-FalconReconNotification -Id $Notification.id -Status in-progress -AssignedToUuid "analyst-uuid" -Message "Investigating"
}

Export and analyze breach data

# Start export job
$Job = Invoke-FalconReconExport -Entity notification-exposed-data-record -Filter "created_date:>'2024-01-01'" -Sort "created_date|desc" -ExportType csv -HumanReadable $true

# Wait for completion
do {
    Start-Sleep -Seconds 5
    $Status = Get-FalconReconExport -Id $Job.id
} until ($Status.status -eq 'done')

# Download results
Receive-FalconReconExport -Path ./breach-data.csv -Id $Job.id

# Clean up
Remove-FalconReconExport -Id $Job.id

Requires Monitoring rules (Falcon Intelligence Recon): Read and Write permissions.

​Overview

​Monitoring Rules

​Search for monitoring rules

​Get rule details by ID

​Create a monitoring rule

​Modify a monitoring rule

​Delete monitoring rules

​Preview rule notifications

​Notifications

​Search for notifications

​Get notification details by ID

​Modify notification status

​Delete notifications

​Exposed Data Records

​Search for exposed data records

​Get record details by ID

​Rule Actions

​Search for actions

​Get action details by ID

​Create a rule action

​Modify an action

​Delete an action

​Export Jobs

​Create an export job

​Check export job status

​Download export file

​Delete export job

​Common Workflows

​Monitor for exposed credentials

​Review and triage notifications

​Export and analyze breach data

Overview

Monitoring Rules

Search for monitoring rules

Get rule details by ID

Create a monitoring rule

Modify a monitoring rule

Delete monitoring rules

Preview rule notifications

Notifications

Search for notifications

Get notification details by ID

Modify notification status

Delete notifications

Exposed Data Records

Search for exposed data records

Get record details by ID

Rule Actions

Search for actions

Get action details by ID

Create a rule action

Modify an action

Delete an action

Export Jobs

Create an export job

Check export job status

Download export file

Delete export job

Common Workflows

Monitor for exposed credentials

Review and triage notifications

Export and analyze breach data