public/fdr.ps1
|
function Get-FalconReplicatorEvent { <# .SYNOPSIS Search for Falcon Data Replicator events .DESCRIPTION Requires 'Falcon Data Replicator: Read'. .PARAMETER Id Falcon Data Replicator event identifier .PARAMETER Filter Falcon Query Language expression to limit results .PARAMETER Sort Property and direction to sort results .PARAMETER Limit Maximum number of results per request .PARAMETER Offset Position to begin retrieving results .PARAMETER Detailed Retrieve detailed information .PARAMETER All Repeat requests until all available results are retrieved .PARAMETER Total Display total result count instead of results .LINK https://github.com/crowdstrike/psfalcon/wiki/Get-FalconReplicatorEvent #> [CmdletBinding(DefaultParameterSetName='/fdr/queries/schema-events/v1:get',SupportsShouldProcess)] param( [Parameter(ParameterSetName='/fdr/entities/schema-events/v1:get',Mandatory,ValueFromPipelineByPropertyName, ValueFromPipeline)] [Alias('ids')] [string[]]$Id, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get',Position=1)] [ValidateScript({ Test-FqlStatement $_ })] [string]$Filter, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get',Position=2)] [ValidateSet('name.asc','name.desc','description.asc','description.desc','platform.asc','platform.desc', 'version.asc','version.desc',IgnoreCase=$false)] [string]$Sort, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get',Position=3)] [int]$Limit, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get')] [int]$Offset, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get')] [switch]$Detailed, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get')] [switch]$All, [Parameter(ParameterSetName='/fdr/queries/schema-events/v1:get')] [switch]$Total ) begin { $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName } [System.Collections.Generic.List[string]]$List = @() } process { if ($Id) { @($Id).foreach{ $List.Add($_) }}} end { if ($List) { $PSBoundParameters['Id'] = @($List | Select-Object -Unique) } Invoke-Falcon @Param -UserInput $PSBoundParameters } } function Get-FalconReplicatorField { <# .SYNOPSIS Search for Falcon Data Replicator fields .DESCRIPTION Requires 'Falcon Data Replicator: Read'. .PARAMETER Id Falcon Data Replicator field identifier .PARAMETER Filter Falcon Query Language expression to limit results .PARAMETER Sort Property and direction to sort results .PARAMETER Limit Maximum number of results per request .PARAMETER Offset Position to begin retrieving results .PARAMETER Detailed Retrieve detailed information .PARAMETER All Repeat requests until all available results are retrieved .PARAMETER Total Display total result count instead of results .LINK https://github.com/crowdstrike/psfalcon/wiki/Get-FalconReplicatorField #> [CmdletBinding(DefaultParameterSetName='/fdr/queries/schema-fields/v1:get',SupportsShouldProcess)] param( [Parameter(ParameterSetName='/fdr/entities/schema-fields/v1:get',Mandatory,ValueFromPipelineByPropertyName, ValueFromPipeline)] [Alias('ids')] [string[]]$Id, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get',Position=1)] [ValidateScript({ Test-FqlStatement $_ })] [string]$Filter, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get',Position=2)] [ValidateSet('name.asc','name.desc','description.asc','description.desc','type.asc','type.desc', 'universal.asc','universal.desc','values.asc','values.desc',IgnoreCase=$false)] [string]$Sort, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get',Position=3)] [int]$Limit, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get')] [int]$Offset, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get')] [switch]$Detailed, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get')] [switch]$All, [Parameter(ParameterSetName='/fdr/queries/schema-fields/v1:get')] [switch]$Total ) begin { $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName } [System.Collections.Generic.List[string]]$List = @() } process { if ($Id) { @($Id).foreach{ $List.Add($_) }}} end { if ($List) { $PSBoundParameters['Id'] = @($List | Select-Object -Unique) } Invoke-Falcon @Param -UserInput $PSBoundParameters } } function Get-FalconReplicatorSchema { <# .SYNOPSIS List all Falcon Data Replicator schema, including fields and events .DESCRIPTION Requires 'Falcon Data Replicator: Read'. .LINK https://github.com/crowdstrike/psfalcon/wiki/Get-FalconReplicatorSchema #> [CmdletBinding(DefaultParameterSetName='/fdr/combined/schema-members/v1:get',SupportsShouldProcess)] param() process { Invoke-Falcon -Endpoint $PSCmdlet.ParameterSetName } } |