PSFalcon.psd1

#
# Module manifest for module 'PSFalcon'
#
# Generated by: brendan.kremian@crowdstrike.com
#
# Generated on: 1/15/2021
#

@{

# Script module or binary module file associated with this manifest.
RootModule = 'PSFalcon.psm1'

# Version number of this module.
ModuleVersion = '2.0.8'

# Supported PSEditions
CompatiblePSEditions = @('Desktop','Core')

# ID used to uniquely identify this module
GUID = 'd893eb9f-f6bb-4a40-9caf-aaff0e42acd1'

# Author of this module
Author = 'Brendan Kremian'

# Company or vendor of this module
CompanyName = 'CrowdStrike'

# Copyright statement for this module
Copyright = '(c) CrowdStrike. All rights reserved.'

# Description of the functionality provided by this module
Description = "PowerShell for CrowdStrike's OAuth2 APIs"

# Minimum version of the PowerShell engine required by this module
PowerShellVersion = '5.1'

# Name of the PowerShell host required by this module
# PowerShellHostName = ''

# Minimum version of the PowerShell host required by this module
# PowerShellHostVersion = ''

# Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the
# PowerShell Desktop edition only.
# DotNetFrameworkVersion = ''

# Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for
# the PowerShell Desktop edition only.
# CLRVersion = ''

# Processor architecture (None, X86, Amd64) required by this module
# ProcessorArchitecture = ''

# Modules that must be imported into the global environment prior to importing this module
# RequiredModules = @()

# Assemblies that must be loaded prior to importing this module
# RequiredAssemblies = @()

# Script files (.ps1) that are run in the caller's environment prior to importing this module
ScriptsToProcess = @('Class/Class.ps1')

# Type files (.ps1xml) to be loaded when importing this module
# TypesToProcess = @()

# Format files (.ps1xml) to be loaded when importing this module
# FormatsToProcess = @()

# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
# NestedModules = @()

# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry,
# use an empty array if there are no functions to export.
FunctionsToExport = @(
    # cloud-connect-aws
    'Confirm-DiscoverAwsAccess',
    'Edit-DiscoverAwsAccount',
    'Get-DiscoverAwsAccount',
    'Get-DiscoverAwsSettings',
    'New-DiscoverAwsAccount',
    'Remove-DiscoverAwsAccount',
    'Update-DiscoverAwsSettings',

    # cloud-connect-azure
    'Get-DiscoverAzureAccount',
    'Get-DiscoverAzureScript',
    'New-DiscoverAzureAccount',
    'Update-DiscoverAzureAccount',

    # cloud-connect-cspm-aws
    'Get-HorizonAwsAccount',
    'Get-HorizonAwsLink',
    'New-HorizonAwsAccount',
    'Receive-HorizonAwsScript',
    'Remove-HorizonAwsAccount',

    # cloud-connect-cspm-azure
    'Edit-HorizonAzureAccount',
    'Get-HorizonAzureAccount',
    'New-HorizonAzureAccount',
    'Receive-HorizonAzureScript',
    'Remove-HorizonAzureAccount',

    # cloud-connect-gcp
    'Get-DiscoverGcpAccount',
    'New-DiscoverGcpAccount',
    'Receive-DiscoverGcpScript',

    # config
    'Export-Config',
    'Import-Config',

    # detects
    'Edit-Detection',
    'Get-Detection',

    # devices
    'Add-HostTag',
    'Edit-HostGroup',
    'Get-Host',
    'Get-HostGroup',
    'Get-HostGroupMember',
    'Invoke-HostAction',
    'Invoke-HostGroupAction',
    'New-HostGroup',
    'Remove-HostGroup',
    'Remove-HostTag',

    # falcon-complete-dashboards
    'Get-CompleteAllowlist',
    'Get-CompleteBlocklist',
    'Get-CompleteCollection',
    'Get-CompleteDetection',
    'Get-CompleteEscalation',
    'Get-CompleteIncident',
    'Get-CompleteRemediation',

    # falconx
    'Get-Report',
    'Get-Submission',
    'Get-SubmissionQuota',
    'New-Submission',
    'Receive-Artifact',
    'Remove-Report',

    # fwmgr
    'Edit-FirewallGroup',
    'Edit-FirewallSetting',
    'Get-FirewallEvent',
    'Get-FirewallField',
    'Get-FirewallGroup',
    'Get-FirewallPlatform',
    'Get-FirewallRule',
    'Get-FirewallSetting',
    'New-FirewallGroup',
    'Remove-FirewallGroup',

    # incidents
    'Get-Behavior',
    'Get-Incident',
    'Get-Score',
    'Invoke-IncidentAction',

    # installation-tokens
    'Edit-InstallToken',
    'Get-InstallToken',
    'Get-InstallTokenEvent',
    'Get-InstallTokenSettings',
    'New-InstallToken',
    'Remove-InstallToken',

    # intel
    'Get-Actor',
    'Get-Indicator',
    'Get-Intel',
    'Get-Rule',
    'Receive-Intel',
    'Receive-Rule',

    # ioarules
    'Edit-IOAGroup',
    'Edit-IOARule',
    'Get-IOAGroup',
    'Get-IOAPlatform',
    'Get-IOARule',
    'Get-IOASeverity',
    'Get-IOAType',
    'New-IOAGroup',
    'New-IOARule',
    'Remove-IOAGroup',
    'Remove-IOARule',
    'Test-IOARule',

    # iocs
    'Edit-IOC',
    'Get-IOC',
    'New-IOC',
    'Remove-IOC',

    # malquery
    'Get-MalQuery',
    'Get-MalQueryQuota',
    'Get-MalQuerySample',
    'Group-MalQuerySample',
    'Invoke-MalQuery',
    'Receive-MalQuerySample',

    # mssp
    "Add-CIDGroupMember",
    "Add-GroupRole",
    "Add-UserGroupMember",
    "Edit-CIDGroup",
    "Edit-UserGroup",
    "Get-CIDGroup",
    "Get-CIDGroupMember",
    "Get-GroupRole",
    "Get-MemberCID",
    "Get-UserGroup",
    "Get-UserGroupMember",
    "New-CIDGroup",
    "New-UserGroup",
    "Remove-CIDGroup",
    "Remove-CIDGroupMember",
    "Remove-GroupRole",
    "Remove-UserGroup",
    "Remove-UserGroupMember",

    # oauth2
    'Request-Token',
    'Revoke-Token',

    # overwatch-dashboards
    'Get-OverWatchEvent',
    'Get-OverWatchDetection',
    'Get-OverWatchIncident',

    # policy
    'Edit-DeviceControlPolicy',
    'Edit-FirewallPolicy',
    'Edit-IOAExclusion',
    'Edit-MLExclusion',
    'Edit-PreventionPolicy',
    'Edit-ResponsePolicy',
    'Edit-SensorUpdatePolicy',
    'Edit-SVExclusion',
    'Get-Build',
    'Get-DeviceControlPolicy',
    'Get-DeviceControlPolicyMember',
    'Get-FirewallPolicy',
    'Get-FirewallPolicyMember',
    'Get-IOAExclusion',
    'Get-MLExclusion',
    'Get-PreventionPolicy',
    'Get-PreventionPolicyMember',
    'Get-ResponsePolicy',
    'Get-ResponsePolicyMember'
    'Get-SensorUpdatePolicy',
    'Get-SensorUpdatePolicyMember',
    'Get-SVExclusion',
    'Get-UninstallToken',
    'Invoke-DeviceControlPolicyAction',
    'Invoke-FirewallPolicyAction',
    'Invoke-PreventionPolicyAction',
    'Invoke-ResponsePolicyAction',
    'Invoke-SensorUpdatePolicyAction',
    'New-DeviceControlPolicy',
    'New-FirewallPolicy',
    'New-MLExclusion',
    'New-PreventionPolicy',
    'New-ResponsePolicy',
    'New-SensorUpdatePolicy',
    'New-SVExclusion',
    'Remove-DeviceControlPolicy',
    'Remove-FirewallPolicy',
    'Remove-IOAExclusion',
    'Remove-MLExclusion',
    'Remove-PreventionPolicy',
    'Remove-ResponsePolicy',
    'Remove-SensorUpdatePolicy',
    'Remove-SVExclusion',
    'Set-DeviceControlPrecedence',
    'Set-FirewallPrecedence',
    'Set-PreventionPrecedence',
    'Set-ResponsePrecedence',
    'Set-SensorUpdatePrecedence',

    # processes
    'Get-Process',

    # real-time-response
    'Confirm-AdminCommand',
    'Confirm-Command',
    'Confirm-GetFile',
    'Confirm-ResponderCommand',
    'Edit-Script',
    'Get-PutFile',
    'Get-Script',
    'Get-Session',
    'Invoke-AdminCommand',
    'Invoke-BatchGet',
    'Invoke-Command',
    'Invoke-ResponderCommand',
    'Receive-GetFile',
    'Remove-Command',
    'Remove-GetFile',
    'Remove-PutFile',
    'Remove-Script',
    'Remove-Session',
    'Send-PutFile',
    'Send-Script',
    'Start-Session',
    'Update-Session',

    # recon
    'Edit-ReconAction',
    'Edit-ReconRule',
    'Get-ReconAction',
    'Get-ReconNotification',
    'Get-ReconRule',
    'New-ReconAction',
    'New-ReconRule',
    'Remove-ReconAction',
    'Remove-ReconRule',

    # samples
    'Get-Sample',
    'Receive-Sample',
    'Remove-Sample',
    'Send-Sample',

    # scanner
    'Get-QuickScan',
    'Get-QuickScanQuota',
    'New-QuickScan',

    # scripts
    'Export-Report',
    'Find-Duplicate',
    'Get-Queue',
    'Invoke-Deploy',
    'Invoke-RTR',
    'Open-Stream',
    'Search-MalQueryHash',
    'Show-Map',
    'Show-Module',
    'Test-Token',

    # sensors
    'Get-CCID',
    'Get-Installer',
    'Get-Stream',
    'Receive-Installer',
    'Update-Stream',

    # settings
    'Edit-HorizonPolicy',
    'Edit-HorizonSchedule',
    'Get-HorizonPolicy',
    'Get-HorizonSchedule',

    # spotlight
    'Get-Remediation',
    'Get-Vulnerability',

    # user-roles
    'Add-Role',
    'Get-Role',
    'Remove-Role',

    # users
    'Edit-User',
    'Get-User',
    'New-User',
    'Remove-User',

    # zero-trust-assessment
    'Get-ZTA'
)

# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry,
# use an empty array if there are no cmdlets to export.
CmdletsToExport = @()

# Variables to export from this module
VariablesToExport = '*'

# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry,
# use an empty array if there are no aliases to export.
AliasesToExport = @()

# DSC resources to export from this module
# DscResourcesToExport = @()

# List of all modules packaged with this module
# ModuleList = @()

# List of all files packaged with this module
# FileList = @()

# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData
# hashtable with additional module metadata used by PowerShell.
PrivateData = @{

    PSData = @{

        # Tags applied to this module. These help with module discovery in online galleries.
        Tags = @('CrowdStrike', 'Falcon', 'OAuth2', 'REST', 'API', 'PSEdition_Desktop', 'PSEdition_Core',
          'Windows', 'Linux', 'MacOS')

        # A URL to the license for this module.
        LicenseUri = 'https://github.com/CrowdStrike/psfalcon/blob/master/LICENSE'

        # A URL to the main website for this project.
        ProjectUri = 'https://github.com/crowdstrike/psfalcon'

        # A URL to an icon representing this module.
        IconUri = 'https://avatars.githubusercontent.com/u/54042976?s=400&u=789014ae9e1ec2204090e90711fa34dd93e5c4d1'

        # ReleaseNotes of this module.
        ReleaseNotes = "v2.0.8

        New Commands
        * Added 'Get-FalconQuickScanQuota' to display QuickScan quota information
        * Added commands for global 'overwatch-dashboards' APIs:
            'Get-FalconOverWatchEvent'
            'Get-FalconOverWatchDetection'
            'Get-FalconOverWatchIncident'
        * Added commands for 'falcon-complete-dashboards' APIs:
            'Get-FalconCompleteAllowlist'
            'Get-FalconCompleteBlocklist'
            'Get-FalconCompleteCollection'
            'Get-FalconCompleteDetection'
            'Get-FalconCompleteEscalation'
            'Get-FalconCompleteIncident'
            'Get-FalconCompleteRemediation'
        * Added commands for 'recon' APIs:
            'Edit-FalconReconAction'
            'Edit-FalconReconRule'
            'Get-FalconReconAction'
            'Get-FalconReconNotification'
            'Get-FalconReconRule'
            'New-FalconReconAction'
            'New-FalconReconRule'
            'Remove-FalconReconAction'
            'Remove-FalconReconRule'
        * Added command for 'zero-trust-assessment' API:
            'Get-FalconZTA'

        New Parameters
        * Added 'Total' switch to each command that has 'offset' or 'after' values to provide the total result
          count rather than the actual results

        Changed Commands
        * Updated custom indicator commands to match new 'iocs' APIs
            'Edit-FalconIOC'
            'Get-FalconIOC'
            'New-FalconIOC'
            'Remove-FalconIOC'
        * Updated 'Invoke-FalconRTR' to fix various issues that would cause 'get' requests to fail with more
          than one host
        * Modified 'Confirm-FalconGetFile' to reduce the complexity of the output when checking the status
          of a batch 'get' request -- the command now returns each result with the 'aid' value appended to it
          rather than being sorted by 'aid' (which required additional object manipulation to access relevant
          properties)
        * Added a check before 'Receive' commands that will abort the command and output an error if the file
          already exists
        * Added custom indicators to 'Export-FalconConfig' and 'Import-FalconConfig'

        Removed Commands
        * Removed custom indicator commands that no longer have supported APIs
            'Get-IOCHost',
            'Get-IOCProcess'
            'Get-IOCTotal'

        Parameter Changes
        * Removed '.zip' pattern from 'Receive-FalconMalQuerySample' as single file downloads were not zipped

        GitHub Issues
        * Issue #45: Updated 'Edit-FalconScript' to correctly convert relative to absolute file path
        "
    } # End of PSData hashtable

} # End of PrivateData hashtable

# HelpInfo URI of this module
HelpInfoURI = 'https://github.com/crowdstrike/psfalcon/blob/master/README.md'

# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix
DefaultCommandPrefix = 'Falcon'

}