New FalconIoc

New-FalconIoc

SYNOPSIS

Create custom indicators

DESCRIPTION

Requires 'IOC Manager APIs: Write'.

PARAMETERS

Name	Type	Min	Max	Pattern	Allowed	Pipeline	PipelineByName	Description
Array	Object[]					True	False	An array of indicators to create in a single request
Action	String				no_action allow prevent_no_ui detect prevent	False	False	Action to perform when a host observes the indicator
Platform	String[]				android ios linux mac windows	False	False	Operating system platform
Source	String	1	256			False	False	Origination source
Severity	String				informational low medium high critical	False	False	Severity level
Description	String					False	False	Indicator description
Filename	String					False	False	Indicator filename,used with hash values
Tag	String[]					False	False	Indicator tag
MobileAction	String				no_action allow detect prevent	False	False	Action to perform when a mobile device observes the indicator
HostGroup	String[]			^[a-fA-F0-9]{32}$		False	False	Host group identifier
AppliedGlobally	Boolean					False	False	Assign to all host groups
Expiration	String			`^(\d{4}-\d{2}-\d{2}	\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z)$`		False	False
Comment	String					False	False	Audit log comment
Retrodetect	Boolean					False	False	Generate retroactive detections for hosts that have observed the indicator
IgnoreWarning	Boolean					False	False	Ignore warnings and create all indicators
Type	String				domain ipv4 ipv6 md5 sha256	False	False	Indicator type
Value	String					False	False	String representation of the indicator

SYNTAX

New-FalconIoc [-Action] <String> [-Platform] <String[]> [[-Source] <String>] [[-Severity] <String>] [[-Description] <String>] [[-Filename] <String>] [[-Tag] 
<String[]>] [[-MobileAction] <String>] [[-HostGroup] <String[]>] [[-AppliedGlobally] <Boolean>] [[-Expiration] <String>] [[-Comment] <String>] [[-Retrodetect] 
<Boolean>] [[-IgnoreWarning] <Boolean>] [-Type] <String> [-Value] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

New-FalconIoc -Array <Object[]> [[-Comment] <String>] [[-Retrodetect] <Boolean>] [[-IgnoreWarning] <Boolean>] [-WhatIf] [-Confirm] [<CommonParameters>]

Generated 20220922 using PSFalcon v2.2.3