New FalconFileVantageRule

New-FalconFileVantageRule

SYNOPSIS

Create a rule within a FileVantage rule group

DESCRIPTION

Requires 'Falcon FileVantage: Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Path	String	Path of the directory, file, or registry key to monitor	1	250
Depth	String	Monitoring depth below the initial target directory/file/registry key			1 2 3 4 5 ANY
Severity	String	Rule severity			Low Medium High Critical
Description	String	Rule description		500
Include	String	User Restrict monitoring to changes made by one or more users
Exclude	String	User Exclude changes made by one or more users
IncludeProcess	String	Restrict monitoring to changes made by one or more processes
ExcludeProcess	String	Exclude changes made by one or more processes
IncludeUser	String	Restrict monitoring to changes made by one or more users
ExcludeUser	String	Exclude changes made by one or more users
DirectoryAttribute	Boolean	Track directory attribute change events
DirectoryCreate	Boolean	Track directory create events
DirectoryDelete	Boolean	Track directory delete events
DirectoryPermission	Boolean	Track directory permission change events
DirectoryRename	Boolean	Track directory rename events
FileAttribute	Boolean	Track file attribute change events
FileChange	Boolean	Track file change events
FileDelete	Boolean	Track file delete events
FilePermission	Boolean	Track file permission change events
FileRename	Boolean	Track file rename events
FileWrite	Boolean	Track file write events
RegKeyCreate	Boolean	Track registry key create events
RegKeyDelete	Boolean	Track registry key delete events
RegKeyRename	Boolean	Track registry key rename events
RegKeySet	Boolean	Track registry key set events
RegValueCreate	Boolean	Track registry value create events
RegValueDelete	Boolean	Track registry value delete events
RuleGroupId	String	FileVantage rule group identifier				X	X

SYNTAX

New-FalconFileVantageRule [-Path] <String> [[-Depth] <String>] [[-Severity] <String>] [[-Description] <String>] [[-Include] <String>] [[-Exclude] <String>] [[-IncludeProcess] <String>] [[-ExcludeProcess] <String>] [[-IncludeUser] <String>] [[-ExcludeUser] <String>] [[-DirectoryAttribute] <Boolean>] [[-DirectoryCreate] <Boolean>] [[-DirectoryDelete] <Boolean>] [[-DirectoryPermission] <Boolean>] [[-DirectoryRename] <Boolean>] [[-FileAttribute] <Boolean>] [[-FileChange] <Boolean>] [[-FileDelete] <Boolean>] [[-FilePermission] <Boolean>] [[-FileRename] <Boolean>] [[-FileWrite] <Boolean>] [[-RegKeyCreate] <Boolean>] [[-RegKeyDelete] <Boolean>] [[-RegKeyRename] <Boolean>] [[-RegKeySet] <Boolean>] [[-RegValueCreate] <Boolean>] [[-RegValueDelete] <Boolean>] -RuleGroupId <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /filevantage/entities/rule-groups-rules/v1

falconpy

createRules

USAGE

2023-09-14: PSFalcon v2.2.6