Data/Patterns.psd1
|
@{ # Default regex patterns for 'id' and 'ids' parameters "^/cloud-connect-(cspm-)?aws/" = "\d{12}" "^/cloud-connect-(cspm-)?azure/" = "\w{8}-\w{4}-\w{4}-\w{4}-\w{12}" "^/cloud-connect-(cspm-)?gcp/" = "\d{10,}" "^/detects/" = "^ldt:\w{32}:\d+$" "^/devices/" = "\w{32}" "^/falconx/entities/(reports|report-summaries|submissions)/" = "\w{32}_\w{32}" "^/falconx/entities/artifacts/" = "\w{64}" "^/fwmgr/entities/policies/" = "\w{32}" "^/incidents/entities/behaviors/GET/" = "ind:\w{32}:\d+" "^/incidents/entities/incident(s/GET|-actions)/" = "inc:\w{32}:\w{32}" "^/installation-tokens/entities/" = "\w{32}" "^/intel/entities/actors/" = "\d{4,}" "^/intel/entities/report(s|-files)/" = "\d{2,}" "^/intel/entities/rules(-latest-files|-files)?/" = "\d{4,}" "^/ioarules/entities/rule-types/" = "\d{1,}$" "^/ioarules/entities/pattern-severities/" = "^(critical|high|medium|low|informational)$" "^/ioarules/entities/platforms/" = "^(windows|mac|linux)$" "^/malquery/entities/requests/" = "\w{8}-\w{4}-\w{4}-\w{4}-\w{12}" "^/policy/" = "\w{32}" "^/processes/entities/processes/" = "pid:\w{32}:\d{1,}" "^/real-time-response/entities/(scripts|put-files)/" = "\w{32}_\w{32}" "^/real-time-response/entities/(queued-)?sessions/GET/" = "\w{8}-\w{4}-\w{4}-\w{4}-\w{12}" "^/samples/entities/samples/" = "\w{64}" "^/scanner/entities/scans" = "\w{32}_\w{32}" "^/sensors/(combined|entities|queries)/(installers|download-installer)/" = "\w{64}" "^/spotlight/entities/remediations/" = "\w{32}" "^/spotlight/entities/vulnerabilities/" = "\w{32}_\w{32}" "^/users/(entities|queries)/(users|user-uuids-by-email)/" = "\w{8}-\w{4}-\w{4}-\w{4}-\w{12}" } |