Skip to main content

​
Module Structure

PSFalcon v2.2.9 is organized around CrowdStrike Falcon API service categories, with cmdlets grouped by functionality:

OAuth2 & Authentication

Token management and authentication

Host & Device Management

Host groups, device control, and grouping tags

Prevention & Response

Prevention policies, response policies, and IOA rules

Real-Time Response

Interactive command sessions and remote actions

Detection & Incidents

Alerts, detections, behaviors, and incident management

Threat Intelligence

Actors, indicators, malware families, and reports

Cloud Security

AWS, Azure, GCP account management and posture

Container Security

Container policies, images, registries, and vulnerabilities

​
Naming Conventions

PSFalcon follows PowerShell best practices with consistent verb-noun patterns:

​
Standard Verbs

VerbPurposeExample
Get-Retrieve resourcesGet-FalconHost, Get-FalconAlert
New-Create new resourcesNew-FalconHostGroup, New-FalconIoc
Edit-Modify existing resourcesEdit-FalconHostGroup, Edit-FalconUser
Remove-Delete resourcesRemove-FalconHostGroup, Remove-FalconIoc
Invoke-Perform actionsInvoke-FalconHostAction, Invoke-FalconRtr
Request-Request credentials/tokensRequest-FalconToken
Revoke-Revoke credentials/tokensRevoke-FalconToken
Start-Start operationsStart-FalconSession, Start-FalconScan
Stop-Stop operationsStop-FalconScan, Stop-FalconMigration
Send-Upload files/dataSend-FalconSample, Send-FalconPutFile
Receive-Download files/dataReceive-FalconInstaller, Receive-FalconArtifact

​
Noun Structure

All cmdlets use the Falcon prefix followed by the resource type: 
[Verb]-Falcon[Resource][Qualifier]
Examples:
  • Get-FalconHost - Get host information
  • Get-FalconHostGroup - Get host group information
  • Get-FalconHostGroupMember - Get host group membership
  • New-FalconIoaExclusion - Create IOA exclusion
  • Edit-FalconFirewallPolicy - Modify firewall policy

​
Common Parameters

PSFalcon cmdlets share common parameter patterns for consistency:

​
Identifiers

​
Id
string or array
Resource identifier(s), typically 32-character hexadecimal valuesPattern: ^[a-fA-F0-9]{32}$Aliases: ids, device_id, device_ids, host_ids, etc.
​
Filter
string
Falcon Query Language (FQL) expression to limit resultsExample: "hostname:'DESKTOP-*'+platform_name:'Windows'"
​
Sort
string
Property and direction to sort resultsFormat: property_name.asc or property_name.descExample: "last_seen.desc"
​
Limit
integer
Maximum number of results per requestDefault: Varies by cmdlet (typically 100 or 500)Maximum: Varies by API endpoint (typically 5000)
​
Offset
integer
Position to begin retrieving results for paginationDefault: 0
​
All
switch
Retrieve all available results using automatic pagination
​
Detailed
switch
Retrieve detailed information instead of identifier-only results

​
Common Properties

​
Name
string
Resource name (policies, groups, etc.)
​
Description
string
Resource description

​
PowerShell Features

All cmdlets support standard PowerShell features:
  • Pipeline support: Most cmdlets accept pipeline input via ValueFromPipeline or ValueFromPipelineByPropertyName
  • Parameter validation: Built-in validation for patterns, sets, and custom scripts
  • ShouldProcess: Many modification cmdlets support -WhatIf and -Confirm
  • Progress indicators: Long-running operations display progress

​
API Credential Caching

PSFalcon caches your API credentials and token after successful authentication: Cached Information:
  • ClientId - OAuth2 client identifier
  • ClientSecret - OAuth2 client secret
  • Hostname - CrowdStrike API hostname/cloud
  • MemberCid - Member CID for multi-CID environments
  • Expiration - Token expiration timestamp
The module automatically requests a new token when the current token expires in less than 240 seconds.

​
Error Handling

PSFalcon cmdlets return detailed error information: 
try {
    Get-FalconHost -Id 'invalid'
} catch {
    Write-Host "Error: $($_.Exception.Message)"
    Write-Host "Status: $($_.CategoryInfo.Category)"
}

​
Module Information

​
ModuleVersion
string
2.2.9
​
Author
string
Brendan Kremian
​
Company
string
CrowdStrike
​
PowerShellVersion
string
5.1 minimum required
​
CompatiblePSEditions
array
Desktop, Core (cross-platform support)

​
Next Steps

OAuth2 Authentication

Learn how to authenticate and manage tokens

Host Management

Manage hosts, groups, and device actions

Real-Time Response

Execute commands on remote hosts

Prevention Policies

Configure prevention and response policies

Build docs developers (and LLMs) love

Get started for freeTalk to us