Edit FalconIoc

Edit-FalconIoc

SYNOPSIS

Modify custom indicators

DESCRIPTION

Requires 'IOC Manager APIs: Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Action	String	Action to perform when a host observes the indicator					X
Platform	String[]	Operating system platform					X
Source	String	Origination source	1	256			X
Severity	String	Severity level					X
Description	String	Indicator description					X
Filename	String	Indicator filename, used with hash values					X
Tag	String[]	Indicator tag					X
MobileAction	String	Action to perform when a mobile device observes the indicator			no_action allow detect prevent		X
HostGroup	String[]	Host group identifier					X
AppliedGlobally	Boolean	Assign to all host groups					X
Expiration	String	Expiration date. When an indicator expires, its action is set to 'no_action' but it remains in your indicator list.					X
Comment	String	Audit log comment					X
FromParent	Boolean	Inheritance from parent CID					X
Retrodetect	Boolean	Generate retroactive detections for hosts that have observed the indicator
IgnoreWarning	Boolean	Ignore warnings and modify all indicators
Id	String	Indicator identifier					X

SYNTAX

Edit-FalconIoc [[-Action] <String>] [[-Platform] <String[]>] [[-Source] <String>] [[-Severity] <String>] [[-Description] <String>] [[-Filename] <String>] [[-Tag] <String[]>] [[-MobileAction] <String>] [[-HostGroup] <String[]>] [[-AppliedGlobally] <Boolean>] [[-Expiration] <String>] [[-Comment] <String>] [[-FromParent] <Boolean>] [[-Retrodetect] <Boolean>] [[-IgnoreWarning] <Boolean>] [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /iocs/entities/indicators/v1

falconpy

indicator_update_v1

USAGE

Updating an indicator by identifier

Edit-FalconIoc -Id <id> -Source testSource -Action detect -Severity low -Description 'test description update' -Platforms windows -Tags test_tag2 -HostGroup all -Expiration '2021-05-01T12:00:00Z'

2023-04-25: PSFalcon v2.2.5