Invoke FalconResponderCommand

Invoke-FalconResponderCommand

SYNOPSIS

Issue a Real-time Response active-responder command to an existing single-host or batch session

DESCRIPTION

Requires 'Real Time Response: Write'.

PARAMETERS

Name	Type	Min	Max	Pattern	Allowed	Pipeline	PipelineByName	Description
Command	String				cat cd clear cp csrutil encrypt env eventlog backup eventlog export eventlog list eventlog view filehash get getsid help history ifconfig ipconfig kill ls map memdump mkdir mount mv netstat ps reg delete reg load reg query reg set reg unload restart rm runscript shutdown umount unmap update history update install update list update install users xmemdump zip	False	False	Real-time Response command
Argument	String					False	False	Arguments to include with the command
OptionalHostId	String[]			^[a-fA-F0-9]{32}$		False	False	Restrict execution to specific host identifiers
Timeout	Int32	30	600			False	False	Length of time to wait for a result, in seconds
SessionId	String			^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$		False		Session identifier
BatchId	String			^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$		False		Batch session identifier
Wait	Switch					False	False	Use 'Confirm-FalconResponderCommand' to retrieve single-host command results

SYNTAX

Invoke-FalconResponderCommand [-Command] <String> [[-Argument] <String>] [[-OptionalHostId] <String[]>] [[-Timeout] <Int32>] -BatchId <String> [-Wait] [-WhatIf] -Confirm] [<CommonParameters>]

Invoke-FalconResponderCommand [-Command] <String> [[-Argument] <String>] -SessionId <String> [-Wait] [-WhatIf] [-Confirm] [<CommonParameters>]

Generated 20220922 using PSFalcon v2.2.3