New FalconIoaExclusion
Create an Indicator of Attack exclusion
'ConvertTo-FalconIoaExclusion' can be used to generate the required Indicator of Attack exclusion properties using an existing detection.
Requires 'IOA Exclusions: Write'.
| Name | Type | Min | Max | Allowed | Pipeline | PipelineByName | Description |
|---|---|---|---|---|---|---|---|
| Name | String | X | Exclusion name | ||||
| PatternId | String | X | Indicator of Attack pattern identifier | ||||
| PatternName | String | X | Indicator of Attack pattern name | ||||
| ClRegex | String | X | Command line RegEx | ||||
| IfnRegex | String | X | Image Filename RegEx | ||||
| GroupId | Object[] | X | Host group identifier, or leave undefined to apply to all hosts | ||||
| Description | String | X | Exclusion description | ||||
| Comment | String | X | Audit log comment |
New-FalconIoaExclusion [-Name] <String> [-PatternId] <String> [-PatternName] <String> [-ClRegex] <String> [-IfnRegex] <String> [[-GroupId] <Object[]>] [[-Description] <String>] [[-Comment] <String>] [-WhatIf] [-Confirm] [<CommonParameters>]2022-10-21: PSFalcon v2.2.3
