Get FalconActor

Get-FalconActor

SYNOPSIS

Search for threat actors

DESCRIPTION

Requires 'Actors (Falcon Intelligence): Read'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Id	String[]	Threat actor identifier				X	X
Filter	String	Falcon Query Language expression to limit results actor_type capability capability.value created_date description ecrime_kill_chain.attribution ecrime_kill_chain.crimes ecrime_kill_chain.customers ecrime_kill_chain.marketing ecrime_kill_chain.monetization ecrime_kill_chain.services_offered ecrime_kill_chain.services_used ecrime_kill_chain.technical_tradecraft ecrime_kill_chain.victims first_activity_date group group.value id kill_chain.actions_and_objectives kill_chain.actions_on_objectives kill_chain.command_and_control kill_chain.delivery kill_chain.exploitation kill_chain.installation kill_chain.objectives kill_chain.reconnaissance kill_chain.weaponization known_as last_activity_date last_modified_date motivations motivations.value name origins origins.value region region.value short_description target_countries target_countries.value target_industries target_industries.value
Query	String	Perform a generic substring search across available fields
Sort	String	Property and direction to sort results			name|asc name|desc target_countries|asc target_countries|desc target_industries|asc target_industries|desc type|asc type|desc created_date|asc created_date|desc last_activity_date|asc last_activity_date|desc last_modified_date|asc last_modified_date|desc
Limit	Int32	Maximum number of results per request	1	5000
Field	String[]	Specific fields, or a predefined collection name surrounded by two underscores [default: basic]
Include	String	Include additional information			tactic_and_technique
Offset	Int32	Position to begin retrieving results
Detailed	Switch	Retrieve detailed information
All	Switch	Repeat requests until all available results are retrieved
Total	Switch	Display total result count instead of results

SYNTAX

Get-FalconActor [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Include] <String>] [-Offset <Int32>] [-All] [-Total] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconActor -Id <String[]> [[-Field] <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-FalconActor [[-Filter] <String>] [[-Query] <String>] [[-Sort] <String>] [[-Limit] <Int32>] [[-Field] <String[]>] [[-Include] <String>] [-Offset <Int32>] -Detailed [-All] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

GET /intel/combined/actors/v1
GET /intel/entities/actors/v1
GET /intel/queries/actors/v1

falconpy

QueryIntelActorIds
GetIntelActorEntities
QueryIntelActorEntities

USAGE

Search for a list of actor IDs

Get-FalconActor -Filter "target_countries:'united states'+target_countries:'canada'+target_industries:'government'" [-All]

Search for actors using a specific ID

Get-FalconActor -Id <id>, <id>

Search for detailed actor information

Get-FalconActor -Filter "target_countries:'united states'+target_countries:'canada'+target_industries:'government'" -Limit 1 -Detailed

2023-04-25: PSFalcon v2.2.5