Test FalconIoaRule

Test-FalconIoaRule

SYNOPSIS

Validate fields and patterns of a custom Indicator of Attack rule

DESCRIPTION

Requires 'Custom IOA Rules: Write'.

PARAMETERS

Name	Type	Min	Max	Allowed	Pipeline	PipelineByName	Description
Field	Object[]					X	An array of rule properties

SYNTAX

Test-FalconIoaRule [-Field] <Object[]> [-WhatIf] [-Confirm] [<CommonParameters>]

USAGE

Validating field values

$Fields = @(     @{         label = 'Grandparent Image Filename'         name = 'GrandparentImageFilename'         type = 'excludable'         values = @(             @{                 label = 'include'                 value = '.+attacker.exe'             }         )     } ) Test-FalconIoaRule -Fields $Fields

Generated 2022-10-06 using PSFalcon v2.2.3