Detection Management

Manage detections including querying, filtering, assignment, status updates, and bulk operations.

Query Detections

Retrieve detections using filters and sorting.

# Get all detections (paginated automatically)
$Detections = Get-FalconDetection -Detailed -All

# Get detections from the last 24 hours
$Recent = Get-FalconDetection -Filter "last_behavior:>'now-24h'" -Detailed -All

# Get new/unassigned detections
$New = Get-FalconDetection -Filter "status:'new'" -Detailed -All

# Get detections with specific severity
$Critical = Get-FalconDetection -Filter "max_severity_displayname:'Critical'" -Detailed -All

# Sort by last behavior (most recent first)
$Sorted = Get-FalconDetection -Sort last_behavior.desc -Limit 100 -Detailed

# Get total count only
$Total = Get-FalconDetection -Total
Write-Host "Total detections: $Total"

Filter by Behavior

Find detections based on specific behaviors or indicators.

# Find detections involving a specific filename
$Filename = 'malware.exe'
$Detections = Get-FalconDetection -Filter "behaviors.filename:'$Filename'" -Detailed -All

# Find detections with specific command line
$CmdLine = 'powershell'
$Detections = Get-FalconDetection -Filter "behaviors.cmdline:*'$CmdLine'*" -Detailed -All

# Find detections by tactic
$Detections = Get-FalconDetection -Filter "behaviors.tactic:'Persistence'" -Detailed -All

# Find detections by technique
$Detections = Get-FalconDetection -Filter "behaviors.technique:'Scheduled Task'" -Detailed -All

Assign Detections

Assign detections to users for investigation.

Assign Detections by Filename to User

#Requires -Version 5.1
using module @{ModuleName='PSFalcon';ModuleVersion='2.2'}

param(
  [Parameter(Mandatory)]
  [string]$Username,
  
  [Parameter(Mandatory)]
  [string]$Filename
)

# Get user identifier
$Uuid = Get-FalconUser -Username $Username
if (!$Uuid) { 
  throw "No user identifier found for '$Username'." 
}

# Check if detections exist
if (!(Get-FalconDetection -Filter "behaviors.filename:'$Filename'")) {
  throw "No detections found for '$Filename'."
}

# Assign detections in batches of 1,000
do {
  if ($Id) { Start-Sleep -Seconds 5 }
  
  $Param = @{
    Filter = "behaviors.filename:'$Filename'+assigned_to_uuid:!'$Uuid'"
    Limit = 1000
    OutVariable = 'Id'
  }
  
  $Edit = Get-FalconDetection @Param | Edit-FalconDetection -AssignedToUuid $Uuid
  
  if ($Edit.writes.resources_affected) {
    Write-Host "Assigned $($Edit.writes.resources_affected) detection(s) to $Username..."
  }
} while ($Id)

Write-Host "Assignment complete."

Assign Detection to Current User

# Get current user UUID
$CurrentUser = Get-FalconUser -Username (whoami)

# Assign specific detection
$DetectionId = 'ldt:abc123...'
Edit-FalconDetection -Id $DetectionId -AssignedToUuid $CurrentUser

Update Detection Status

Change detection status and add comments.

# Mark detection as in progress
$DetectionId = 'ldt:abc123...'
Edit-FalconDetection -Id $DetectionId -Status in_progress

# Mark as true positive
Edit-FalconDetection -Id $DetectionId -Status true_positive

# Mark as false positive with comment
$Param = @{
  Id = $DetectionId
  Status = 'false_positive'
  Comment = 'Confirmed safe - internal security tool'
}
Edit-FalconDetection @Param

# Mark as closed
Edit-FalconDetection -Id $DetectionId -Status closed

Hide/Show Detections

Control detection visibility in the console.

Hide Detections by Filename

#Requires -Version 5.1
using module @{ModuleName='PSFalcon';ModuleVersion='2.2'}

param(
  [Parameter(Mandatory)]
  [string]$Filename
)

# Create output file to track hidden detections
$OutputFile = Join-Path (Get-Location).Path "hidden_detections_$(Get-Date -Format FileDateTime).txt"

# Check if detections exist
if ($null -eq (Get-FalconDetection -Filter "behaviors.filename:'$Filename'" -Total)) {
  throw "No detections found for '$Filename'."
}

# Hide detections in batches of 1,000
do {
  if ($Id) { Start-Sleep -Seconds 5 }
  
  $Edit = Get-FalconDetection -Filter "behaviors.filename:'$Filename'" -Limit 1000 -OutVariable Id |
    Edit-FalconDetection -ShowInUi $false
  
  if ($Edit.writes.resources_affected) {
    Write-Host "Hid $($Edit.writes.resources_affected) detection(s)..."
    # Output detection IDs to file for reference
    $Id >> $OutputFile
  }
} while ($Id)

if (Test-Path $OutputFile) { 
  Get-ChildItem $OutputFile | Select-Object FullName,Length,LastWriteTime 
}

Show Hidden Detection

# Make detection visible again
$DetectionId = 'ldt:abc123...'
Edit-FalconDetection -Id $DetectionId -ShowInUi $true

Bulk Detection Operations

Perform actions on multiple detections.

# Get all 'new' detections from last 7 days and assign to SOC team lead
$SocLead = Get-FalconUser -Username 'soc.lead@company.com'
$Filter = "status:'new'+last_behavior:>'now-7d'"

$Detections = Get-FalconDetection -Filter $Filter -All
if ($Detections) {
  $Detections | Edit-FalconDetection -AssignedToUuid $SocLead -Status in_progress
  Write-Host "Assigned $($Detections.Count) detections to SOC lead"
}

Export Detections

Export detection data for reporting or analysis.

Export to JSON

# Export detections to JSON with full details
$Detections = Get-FalconDetection -Filter "last_behavior:>'now-24h'" -Detailed -All
$OutputFile = Join-Path (Get-Location).Path "detections_$(Get-Date -Format FileDateTime).json"

$Detections | ConvertTo-Json -Depth 16 | Out-File -FilePath $OutputFile
Get-ChildItem $OutputFile | Select-Object FullName,Length,LastWriteTime

Export to CSV

# Export detections to CSV with selected fields
$Detections = Get-FalconDetection -Detailed -All | Select-Object @(
  'detection_id',
  @{label='hostname';expression={$_.device.hostname}},
  @{label='status';expression={$_.status}},
  @{label='severity';expression={$_.max_severity_displayname}},
  @{label='first_behavior';expression={$_.first_behavior}},
  @{label='last_behavior';expression={$_.last_behavior}},
  @{label='assigned_to';expression={$_.assigned_to_name}}
)

$Detections | Export-Csv -Path 'detections.csv' -NoTypeInformation

Detection Patterns

Identify patterns in detections for investigation.

# Group detections by hostname
$ByHost = Get-FalconDetection -Detailed -All | Group-Object -Property {$_.device.hostname} | 
  Sort-Object Count -Descending

Write-Host "Top 10 hosts with most detections:"
$ByHost | Select-Object -First 10 | ForEach-Object {
  Write-Host "  $($_.Name): $($_.Count) detections"
}

# Group by tactic
$ByTactic = Get-FalconDetection -Detailed -All | ForEach-Object {
  $_.behaviors | Select-Object -ExpandProperty tactic -Unique
} | Group-Object | Sort-Object Count -Descending

Write-Host "`nMost common tactics:"
$ByTactic | Select-Object -First 5 | ForEach-Object {
  Write-Host "  $($_.Name): $($_.Count)"
}

Advanced Filtering

Combine multiple filters for precise queries.

# Multiple conditions with AND
$Filter = "status:'new'+max_severity_displayname:'Critical'+behaviors.tactic:'Execution'"
$Detections = Get-FalconDetection -Filter $Filter -Detailed -All

# Date range with severity
$Filter = "first_behavior:>'2024-01-01'+first_behavior:<'2024-01-31'+max_severity:'70'"
$Detections = Get-FalconDetection -Filter $Filter -Detailed -All

# Exclude assigned detections
$Filter = "status:'new'+assigned_to_uuid:!''"
$Detections = Get-FalconDetection -Filter $Filter -Detailed -All

# Multiple filenames (OR)
$Filter = "behaviors.filename:['malware.exe','suspicious.dll']"
$Detections = Get-FalconDetection -Filter $Filter -Detailed -All

Detection Workflow

Complete workflow for detection triage.

# Get current user for assignment
$CurrentUser = Get-FalconUser -Username (whoami)

# Get new critical detections
$Detections = Get-FalconDetection -Filter "status:'new'+max_severity_displayname:'Critical'" -Detailed -All

foreach ($Detection in $Detections) {
  Write-Host "`nProcessing detection: $($Detection.detection_id)"
  Write-Host "  Host: $($Detection.device.hostname)"
  Write-Host "  Severity: $($Detection.max_severity_displayname)"
  Write-Host "  Behaviors: $($Detection.behaviors.Count)"
  
  # Assign to self and mark as in progress
  Edit-FalconDetection -Id $Detection.detection_id -AssignedToUuid $CurrentUser -Status in_progress
  
  # Add your investigation logic here
  
  # Example: Auto-contain hosts with specific indicators
  $SuspiciousFiles = @('malware.exe', 'ransomware.dll')
  $MatchingBehaviors = $Detection.behaviors | Where-Object {
    $_.filename -in $SuspiciousFiles
  }
  
  if ($MatchingBehaviors) {
    Write-Host "  ACTION: Containing host due to suspicious file"
    Invoke-FalconHostAction -Name contain -Id $Detection.device.device_id
    
    # Update detection with comment
    Edit-FalconDetection -Id $Detection.detection_id -Comment "Auto-contained: Matched known malware signature"
  }
}

Always test detection filters with -Limit before using -All to avoid retrieving thousands of detections. Use -Total to check counts first.

Detection Metrics

Generate metrics for reporting.

# Daily detection summary
$Today = Get-FalconDetection -Filter "first_behavior:>'now-24h'" -Total
$Critical = Get-FalconDetection -Filter "first_behavior:>'now-24h'+max_severity_displayname:'Critical'" -Total
$New = Get-FalconDetection -Filter "status:'new'+first_behavior:>'now-24h'" -Total
$Assigned = Get-FalconDetection -Filter "first_behavior:>'now-24h'+assigned_to_uuid:!''" -Total

Write-Host "Detection Summary (Last 24 Hours)"
Write-Host "  Total: $Today"
Write-Host "  Critical: $Critical"
Write-Host "  New (Unassigned): $New"
Write-Host "  Assigned: $Assigned"
Write-Host "  Assignment Rate: $(($Assigned/$Today*100).ToString('0.0'))%"

Detection IDs follow the format ldt:<UUID> for detections. Use the full detection_id when updating or querying specific detections.

Common Tasks

Advanced Scenarios

Detection Management

Query Detections

Filter by Behavior

Assign Detections

Assign Detections by Filename to User

Assign Detection to Current User

Update Detection Status

Hide/Show Detections

Hide Detections by Filename

Show Hidden Detection

Bulk Detection Operations

Export Detections

Export to JSON

Export to CSV

Detection Patterns

Advanced Filtering

Detection Workflow

Detection Metrics

Next Steps

Host Operations

Custom IOC Workflows

​Query Detections

​Filter by Behavior

​Assign Detections

​Assign Detections by Filename to User

​Assign Detection to Current User

​Update Detection Status

​Hide/Show Detections

​Hide Detections by Filename

​Show Hidden Detection

​Bulk Detection Operations

​Export Detections

​Export to JSON

​Export to CSV

​Detection Patterns

​Advanced Filtering

​Detection Workflow

​Detection Metrics

​Next Steps

Host Operations

Custom IOC Workflows

Query Detections

Filter by Behavior

Assign Detections

Assign Detections by Filename to User

Assign Detection to Current User

Update Detection Status

Hide/Show Detections

Hide Detections by Filename

Show Hidden Detection

Bulk Detection Operations

Export Detections

Export to JSON

Export to CSV

Detection Patterns

Advanced Filtering

Detection Workflow

Detection Metrics

Next Steps