Get FalconZta

Get-FalconZta

SYNOPSIS

Search for Zero Trust Assessment results

DESCRIPTION

Requires 'Zero Trust Assessment: Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Id	String[]	Host identifier				X	X
Filter	String	Falcon Query Language expression to limit results
Sort	String	Property and direction to sort results			score|desc score|asc
Limit	Int32	The maximum records to return	1	1000
After	String	Pagination token to retrieve the next set of results
Detailed	Switch	Retrieve detailed information
All	Switch	Repeat requests until all available results are retrieved
Total	Switch	Display total result count instead of results

SYNTAX

Get-FalconZta [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconZta [-Id] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconZta [-Filter] <String> [[-Sort] <String>] [[-Limit] <Int32>] [-After <String>] [-Detailed] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /zero-trust-assessment/entities/assessments/v1
GET /zero-trust-assessment/entities/audit/v1
GET /zero-trust-assessment/queries/assessments/v1

falconpy

getAuditV1
getAssessmentV1
getAssessmentsByScoreV1

USAGE

Retrieving Zero Trust Assessment data by host

Get-FalconZta -Id <id>, <id>

NOTE: The Include parameter can be used to append Zero Trust Assessment results to Get-FalconHost output.

See Get-FalconHost.

Retrieving CID aggregate info

Get-FalconZta

2023-04-25: PSFalcon v2.2.5