Invoke FalconItTask

Invoke-FalconItTask

SYNOPSIS

Initiate an existing Falcon for IT task, or create and run a task on target hosts

DESCRIPTION

Requires 'IT Automation - Task Executions: Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Id	String	Task identifier
Target	String	Falcon Query Language expression to define target hosts
Query	Object	Query
CompositeQuery	Object	Composite query
OsQuery	String	OsQuery statement
ExecutionArg	Object	Key/value pairs to define arguments during execution of an existing task
Trigger	Object[]	Trigger condition
DiscoverOffline	Boolean	Discover offline hosts
DiscoverNew	Boolean	Discover new hosts
Guardrail	Object	Execution guardrails and limits
Distribute	Boolean	Distribute task
OutputParser	Object	Specifies columns and delimiter for parsing script execution results
ExpirationInterval	String	Interval before task expires. Once expired, new and offline hosts won't be targeted

SYNTAX

Invoke-FalconItTask [-Id] <String> [-Target] <String> [[-ExecutionArg] <Object>] [[-Trigger] <Object[]>] [[-DiscoverOffline] <Boolean>] [[-DiscoverNew] <Boolean>] [[-Guardrail] <Object>] [[-Distribute] <Boolean>] [[-ExpirationInterval] <String>] [-WhatIf] [-Confirm] [<CommonParameters>]

Invoke-FalconItTask [-Target] <String> [[-Query] <Object>] [[-CompositeQuery] <Object>] [[-OsQuery] <String>] [[-DiscoverOffline] <Boolean>] [[-DiscoverNew] <Boolean>] [[-Guardrail] <Object>] [[-Distribute] <Boolean>] [[-OutputParser] <Object>] [[-ExpirationInterval] <String>] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /it-automation/entities/live-query-execution/v1
POST /it-automation/entities/task-executions/v1

falconpy

ITAutomationStartTaskExecution
ITAutomationRunLiveQuery

USAGE

Execute a query task

Invoke-FalconItTask -Target "platform_name:'Windows'" -Query @{ windows = @{ content = 'pwd'; language = 'powershell' }}

Execute a multi-column query task

Invoke-FalconItTask -Target "platform_name:'Windows'" -Query @{ windows = @{ content = 'echo "a,b"'; language = 'powershell' }} -OutputParser @{ default_group_by = $false; delimiter = ","; columns = @(@{ name = 'c1' },@{ name = 'c2' })}

Execute an existing task

Invoke-FalconItTask -Id <id> -Target "platform_name:'Windows'" -DiscoverOffline $false -DiscoverNew $false -Guardrail @{ run_time_limit_millis = 300000 } -Distribute $true -ExpirationInterval 1h

Execute an existing task with parameters

Invoke-FalconItTask -Id <id> -Target "platform_name:'Windows'" -DiscoverOffline $true -DiscoverNew $false -Guardrail @{ run_time_limit_millis = 300000 } -Distribute $true -ExpirationInterval 1h -ExecutionArg @{ file_path = 'C:\temp'; file_pattern = '*.log' }

Execute automated tasks

Invoke-FalconItTask -Id <id> -Target "platform_name:!'Linux'+platform_name:!'Mac'" -Trigger @{ statements = @(@{ task_id = <id>; key = 'script_output'; data_comparator = 'Equals'; data_type = 'StringType'; value = 'installed' }); operator = 'AND' }

_2025-09-02: PSFalcon v2.2.9_