Scheduled Reports

# Search for scheduled reports
Get-FalconScheduledReport [[-Filter] <string>] [[-Query] <string>] [[-Sort] <string>] [[-Limit] <int32>] [-Offset <int32>] [-Detailed] [-All] [-Total]

# Get report by ID
Get-FalconScheduledReport -Id <string[]>

# Search for report executions
Get-FalconScheduledReport -Execution [[-Filter] <string>] [[-Query] <string>] [[-Sort] <string>] [[-Limit] <int32>] [-Offset <int32>] [-Detailed] [-All] [-Total]

# Get execution by ID
Get-FalconScheduledReport -Execution -Id <string[]>

Invoke-FalconScheduledReport [-Id] <string>

Redo-FalconScheduledReport [-Id] <string>

Receive-FalconScheduledReport [[-Path] <object>] [-Id] <string> [-Force]

# Execute a report
$execution = Invoke-FalconScheduledReport -Id 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6'

# Wait for completion (poll every 30 seconds)
do {
  Start-Sleep -Seconds 30
  $status = Get-FalconScheduledReport -Execution -Id $execution.id
} while ($status.status -eq 'running')

# Download completed report
if ($status.status -eq 'done') {
  Receive-FalconScheduledReport -Path 'C:\Reports\latest.csv' -Id $execution.id
}

# Find all failed executions from the last week
$lastWeek = (Get-Date).AddDays(-7).ToString('yyyy-MM-dd')
$failed = Get-FalconScheduledReport -Execution -Filter "status:'failed'+last_execution_on:>'$lastWeek'" -Detailed -All

# Retry each failed execution
foreach ($report in $failed) {
  Write-Host "Retrying report: $($report.id)"
  Redo-FalconScheduledReport -Id $report.id
}

# Get all executions from the last 24 hours
$yesterday = (Get-Date).AddDays(-1).ToString('yyyy-MM-dd')
$executions = Get-FalconScheduledReport -Execution -Filter "last_execution_on:>'$yesterday'+status:'done'" -Detailed -All

# Create download directory
$downloadDir = 'C:\Reports\' + (Get-Date -Format 'yyyy-MM-dd')
New-Item -Path $downloadDir -ItemType Directory -Force

# Download each completed report
foreach ($exec in $executions) {
  $filename = if ($exec.result_metadata.report_file_name) {
    $exec.result_metadata.report_file_name
  } else {
    "$($exec.id).$($exec.report_params.format)"
  }
  
  $path = Join-Path $downloadDir $filename
  Receive-FalconScheduledReport -Path $path -Id $exec.id
}

# Get all scheduled reports
$reports = Get-FalconScheduledReport -Detailed -All

# Display summary
$reports | Select-Object id, name, 
  @{N='LastRun';E={$_.last_execution.last_execution_on}},
  @{N='Status';E={$_.last_execution.status}},
  @{N='NextRun';E={$_.next_execution_on}} |
  Format-Table -AutoSize

# Export to CSV
$reports | Select-Object id, name, schedule, 
  @{N='last_execution_on';E={$_.last_execution.last_execution_on}},
  @{N='status';E={$_.last_execution.status}} |
  Export-Csv 'C:\Reports\report_status.csv' -NoTypeInformation