Invoke FalconIncidentAction

Invoke-FalconIncidentAction

SYNOPSIS

Perform actions on incidents

DESCRIPTION

Requires 'Incidents: Write'.

PARAMETERS

Name	Type	Min	Max	Allowed	Pipeline	PipelineByName	Description
Name	String			add_tag delete_tag unassign update_description update_name update_status update_assigned_to_v2			Action to perform
Value	String						Value for the chosen action
UpdateDetects	Boolean						Update status of related 'new' detections
OverwriteDetects	Boolean						Replace existing status for related detections
Id	String[]				X	X	Incident identifier

SYNTAX

Invoke-FalconIncidentAction [-Name] <String> [-Value] <String> [[-UpdateDetects] <Boolean>] [[-OverwriteDetects] <Boolean>] [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

SDK Reference

falconpy

PerformIncidentAction

USAGE

Update the status of multiple incidents

Invoke-FalconIncidentAction -Name update_status -Value in_progress -Id <id>, <id>

Updating detection statuses to match incidents

Invoke-FalconIncidentAction -Name update_status -Value in_progress -Id <id>, <id> -UpdateDetects $true -OverwriteDetects $true

2022-10-31: PSFalcon v2.2.3