Get FalconDeviceControlPolicy

Get-FalconDeviceControlPolicy

SYNOPSIS

Search for Falcon Device Control policies

DESCRIPTION

Requires 'Device control policies: Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Id	String[]	Policy identifier				X	X
Filter	String	Falcon Query Language expression to limit results created_by created_timestamp description enabled groups modified_by modified_timestamp name name.raw platform_name
Sort	String	Property and direction to sort results			created_by.asc created_by.desc created_timestamp.asc created_timestamp.desc enabled.asc enabled.desc modified_by.asc modified_by.desc modified_timestamp.asc modified_timestamp.desc name.asc name.desc platform_name.asc platform_name.desc precedence.asc precedence.desc
Limit	Int32	Maximum number of results per request	1	5000
Include	String[]	Include additional properties			members
Offset	Int32	Position to begin retrieving results
Default	Switch	Retrieve default Device Control policy, including notification content
Detailed	Switch	Retrieve detailed information
All	Switch	Repeat requests until all available results are retrieved
Total	Switch	Display total result count instead of results

SYNTAX

Get-FalconDeviceControlPolicy [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Include] <String[]>] [-Offset <Int32>] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconDeviceControlPolicy -Id <String[]> [[-Include] <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconDeviceControlPolicy [[-Filter] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Include] <String[]>] [-Offset <Int32>] -Detailed [-All] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconDeviceControlPolicy -Default [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /policy/combined/device-control/v1
GET /policy/entities/default-device-control/v1
GET /policy/entities/device-control/v1
GET /policy/queries/device-control/v1

falconpy

queryDeviceControlPolicies
getDeviceControlPolicies
queryCombinedDeviceControlPolicies
getDefaultDeviceControlPolicies

USAGE

Find policy details using a filtered search

Get-FalconDeviceControlPolicy -Filter "name:'policy'" -Sort created_timestamp.asc -Detailed

List policy ids using a filtered search

Get-FalconDeviceControlPolicy -Filter "name:'diana.hudson'" -Sort name.desc -Detailed

List details about specific policies

Get-FalconDeviceControlPolicy -Id <id>, <id>

Export a list of policy members including the most recent interactive user

NOTE: The example uses a name filter to target a policy named my_policy.

foreach ($Policy in (Get-FalconDeviceControlPolicy -Filter "name:'my_policy'" -Include members -Detailed)) {
    foreach ($Device in (Get-FalconHost -Id $Policy.members.device_id -Login)) {
        foreach ($Member in @($Policy.members).Where({ $_.device_id -eq $Device.device_id })) {
            $Recent = @($Device.recent_logins).Where({ $_.user_name -match $Member.hostname }) | Select-Object -First 1
            [PSCustomObject]@{
                policy_id = $Policy.id
                policy_name = $Policy.name
                device_id = $Member.device_id
                hostname = $Member.hostname
                most_recent_user_name = $Recent.user_name
                most_recent_login_time = $Recent.login_time
            } | Export-Csv .\policy_members.csv -NoTypeInformation -Append
        }
    }
}

2023-04-25: PSFalcon v2.2.5