New FalconItTask

New-FalconItTask

SYNOPSIS

Create Falcon for IT tasks

DESCRIPTION

Requires 'IT Automation - Tasks: Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
Name	String	Task name					X
Description	String	Task description					X
TaskType	String	Task type			query remediation		X
AccessType	String	Task access type			Public Shared		X
Target	String	Falcon Query Language expression to define target hosts					X
Parameter	Object[]	Task					X
Query	Object	Query					X
CompositeQuery	Object	Composite query					X
Remediation	Object	Remediation					X
Trigger	Object[]	Trigger condition					X
Verification	Object[]	Verification condition					X
OsQuery	String	OsQuery statement					X
TaskGroupId	String	Task group identifier					X
UserGroupId	String[]	User group identifier (for 'Shared' AccessType)					X
UserId	String[]	User identifier (for 'Shared' AccessType)					X
OutputParser	Object	Column and delimiter values to parse result output					X

SYNTAX

New-FalconItTask [-Name] <String> [[-Description] <String>] [[-TaskType] <String>] [[-AccessType] <String>] [[-Target] <String>] [[-Parameter] <Object[]>] [[-Query] <Object>] [[-CompositeQuery] <Object>] [[-Remediation] <Object>] [[-Trigger] <Object[]>] [[-Verification] <Object[]>] [[-OsQuery] <String>] [[-TaskGroupId] <String>] [[-UserGroupId] <String[]>] [[-UserId] <String[]>] [[-OutputParser] <Object>] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /it-automation/entities/tasks/v1

falconpy

ITAutomationCreateTask

USAGE

Create a task

New-FalconItTask -Name 'it automation' -description 'test' -TaskType query -AccessType Public -Query @{ windows = @{ content = 'pwd'; language = 'powershell' }}

Create a task with parameters

New-FalconItTask -Name 'Test 870769' -Description 'query with parameters' -TaskType query -AccessType Public -TaskParameter @{ key = 'file_path';label = 'Enter the file path'; input_type = 'text' },@{ key = 'file_pattern'; label = 'Enter a file pattern (ex: *.log)'; input_type = 'text' } -Query @{ windows = @{ action_type = 'script'; content = 'Get-ChildItem -Path "{{.file_path}}" -Filter "{{.file_pattern}}" -Force | Select-Object Name, LastWriteTime, Length'; language = 'powershell' }}

Create an automated task

New-FalconItTask -Name 'Automated Task Example' -Description 'Automated task with trigger and verification criteria' -TaskType remediation -AccessType Public -Remediation @{ windows = @{ content = 'echo "This script executes only if below trigger condition evaluation is successful"'; language = 'powershell'; action_type = 'script' }} -Trigger @{ statements = @(@{ task_id = 'cf8...e63'; key = 'running'; data_comparator = 'Equals'; data_type = 'StringType'; value = 'false' };@{ task_id = 'ca0...1ae'; key = 'script_output'; data_comparator = 'LessThan'; data_type = 'SemverType'; value = '11.6.7' }); operator = 'AND' } -Verification @{ statements = @(@{ task_id  'cf8...e63'; key = 'running'; data_comparator = 'Equals'; data_type = 'StringType'; value = 'true' }); operator = 'AND' } -Target "platform_name:!'Linux'+platform_name:!'Mac'"

Create multi-column tasks

New-FalconItTask -Name 'Multi-column task example' -Description 'Script task with multi-column' -Target "platform_name:'Windows'" -TaskType query -AccessType Public -Query @{ windows = @{ action_type = 'script'; content = 'echo "a,b"'; language = 'powershell' }} -OutputParser @{ default_group_by = $false; delimiter = ","; columns = @(@{ name = 'c1' },@{ name = 'c2' })}

Create tasks with attached files

New-FalconItTask -Name 'test rem with file v2' -Description 'test rem with file' -Target "platform_name:'Windows'" -TaskType remediation -AccessType Public -Remediation @{ windows = @{ action_type = 'command'; content = 'cmd /c echo "Hello, World!"'; file_ids = @('5ff...647_eb4...b8f') }}

2025-09-02: PSFalcon v2.2.9