-
Notifications
You must be signed in to change notification settings - Fork 81
Installation, Upgrade and Removal

The PowerShell Gallery is the recommended way to install the module. If not present, you must install PowerShell before proceeding.
The module included on the PowerShell Gallery is signed and requires an ExecutionPolicy of RemoteSigned or
lower. If your ExecutionPolicy is set to Restricted you will not be able to install the module from the
PowerShell Gallery. You can check your current ExecutionPolicy with Get-ExecutionPolicy and change it to
RemoteSigned using Set-ExecutionPolicy.
Get-ExecutionPolicyUse the Install-Module command to download and install the module under your user account.
Install-Module -Name PSFalcon -Scope CurrentUserYou may be prompted with a warning that the PowerShell Gallery is an untrusted repository. You can accept and
continue to install the module. You can permanently change this using Set-PSRepository. You may also be
prompted to update your NuGet package to interact with the PowerShell Gallery. This is the method that the gallery
uses to install modules and is required to use it.
If you're running an older version of PSFalcon, you must include the Force parameter to verify that you'd like
to install the latest version alongside the old version. You can use Uninstall-Module -Name PSFalcon -AllVersions
to remove all existing versions of the module.
If the PowerShell Gallery isn't accessible in your environment or the installation failed you can install using a GitHub release.
Installing using a GitHub release is only recommended if the PowerShell Gallery is not available within your environment. If the installation from the PowerShell Gallery worked, there's no need to follow any of the steps included in this section.
- Download the latest release
- Unpack the archive and move the contents of the folder into your User Modules directory
See Installing PowerShell Modules.
NOTE: You may receive an error about the destination folders not existing when attempting to move the module files. If you do, create the folders first then move the module files into them.
Expand-Archive ./psfalcon-<version>.zip .
Move-Item ./psfalcon-<version>/ $HOME/.local/share/powershell/Modules/PSFalcon/<version>/ -ForceExpand-Archive .\psfalcon-<version>.zip .
Move-Item .\psfalcon-<version>\ $HOME\Documents\PowerShell\Modules\PSFalcon\<version>\ -ForceExpand-Archive .\psfalcon-<version>.zip .
Move-Item .\psfalcon-<version>\ $HOME\Documents\WindowsPowerShell\Modules\PSFalcon\<version>\ -ForceIf done correctly, your PSFalcon\<version> folder will look similar to the following example.
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 1/26/2021 10:40 AM Class
d---- 1/26/2021 10:40 AM Private
d---- 1/26/2021 10:40 AM Public
----- 1/25/2021 10:37 AM 1946 LICENSE
----- 1/25/2021 10:37 AM 10838 PSFalcon.psd1
----- 1/25/2021 10:37 AM 944 PSFalcon.psm1
----- 1/25/2021 10:37 AM 1322 README.mdIf you have folder redirection in place, the $HOME folder may not be properly recognized by PowerShell. In these
cases, you can extract PSFalcon and import the module directly.
Expand-Archive .\psfalcon-<version>.zip .
Move-Item .\psfalcon-<version>\ .\PSFalconIf the PowerShell Gallery was used to install the module, it can also be used to upgrade.
Update-Module -Name PSFalconNOTE: If the update fails, remove all existing versions of PSFalcon and install the new version. If the module was manually installed, delete your existing PSFalcon module folder and install the new version.
If the PSFalcon module folder exists within the proper module path, you can use Uninstall-Module to remove it.
Including the optional AllVersions parameter will ensure that all instances of PSFalcon are removed.
Uninstall-Module -Name PSFalcon -AllVersionsIf PSFalcon was manually installed, simply delete the module folder.

- Using PSFalcon
-
Commands by Permission
- Actors (Falcon Intelligence)
- Alerts
- API integrations
- App Logs
- Assets
- CAO Hunting
- Case Templates
- Cases
- Channel File Control Settings
- Cloud Security API Assets
- Configuration Assessment
- Content Update Policies
- Correlation Rules
- CSPM registration
- Custom IOA rules
- Device Content
- Device control policies
- Event streams
- Falcon Complete Dashboards
- Falcon Container Image
- Falcon Data Replicator
- Falcon FileVantage
- Falcon FileVantage Content
- Firewall management
- Flight Control
- Host groups
- Host Migration
- Hosts
- Identity Protection Entities
- Identity Protection GraphQL
- Identity Protection Policy Rules
- Incidents
- Indicators (Falcon Intelligence)
- Installation tokens
- Installation token settings
- IOA Exclusions
- IOC Manager APIs
- IOCs
- IT Automation - Policies
- IT Automation - Task Executions
- IT Automation - Tasks
- IT Automation - User Groups
- Kubernetes Protection
- Machine Learning exclusions
- MalQuery
- Malware Families (Falcon Intelligence)
- Message Center
- Mobile Enrollment
- Monitoring rules (Falcon Intelligence Recon)
- NGSIEM
- NGSIEM Dashboards
- NGSIEM Lookup Files
- NGSIEM Parsers
- NGSIEM Saved Queries
- On demand scans (ODS)
- OverWatch Dashboard
- Prevention Policies
- Quarantined Files
- QuickScan Pro
- Real time response
- Real time response (admin)
- Reports (Falcon Intelligence)
- Response policies
- Rules (Falcon Intelligence)
- Sample uploads
- Sandbox (Falcon Intelligence)
- Scheduled Reports
- Sensor Download
- Sensor update policies
- Sensor Usage
- Sensor Visibility Exclusions
- Snapshot
- Snapshot Scanner Image Download
- Tailored Intelligence
- Threatgraph
- User management
- Vulnerabilities
- Vulnerabilities (Falcon Intelligence)
- Workflow
- Zero Trust Assessment
- Other Commands
- Examples
-
CrowdStrike SDKs
- FalconPy - Python 3
- goFalcon - Go
- Rusty Falcon - Rust