Receive FalconRule

Receive-FalconRule

SYNOPSIS

Download the most recent ruleset, or a specific ruleset

DESCRIPTION

Requires 'Rules (Falcon Intelligence): Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Type	String	Ruleset type, used to retrieve the latest ruleset			snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness
Path	String	Destination path
Id	Int32	Ruleset identifier, used for a specific ruleset				X	X
Force	Switch	Overwrite an existing file when present

SYNTAX

Receive-FalconRule [-Path] <String> [-Id] <Int32> [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]

Receive-FalconRule [-Type] <String> [-Path] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /intel/entities/rules-files/v1
GET /intel/entities/rules-latest-files/v1

falconpy

GetIntelRuleFile
GetLatestIntelRuleFile

USAGE

Download the latest rule set

Receive-FalconRule -Type yara-master -Path .\yara-master.zip

Download a specific rule set

Receive-FalconRule -Id <id> -Path .
ules.zip

2023-04-25: PSFalcon v2.2.5