Commands

Browse query commands across all apps.

CrowdStrike Falcon
crowdstrike-falcon-ngsiem-query Runs a query on CrowdStrike Falcon NG SIEM and returns the resulting events.
CrowdStrike Falcon
crowdstrike-falcon-scheduled-report Reads the result content of a scheduled report execution by its id.
CrowdStrike Falcon
crowdstrike-falcon-scheduled-reports Lists the execution history of CrowdStrike Falcon scheduled reportes.
CrowdStrike Falcon
crowdstrike-falcon-scheduled-search Reads the result content of a scheduled search execution by its id.
YARA Scanner
yara-scan Scans a file or directory in the file store with enabled YARA rules and returns one row per file, including files without detections and files with errors.
YARA Scanner
yara-scan-batch Reads a file store URL from each input row, scans that file with enabled YARA rules, and adds the detection result to the row.
YARA Scanner
yara-scan-logs Lists recorded per-file YARA scan results for a period, one row per file. Only detected files and error results are recorded; files without detections or errors appear only in the report totals.
YARA Scanner
yara-scan-reports Lists YARA scan reports for a period, one row per scan, including scan status, target, and file counts.
Experimental
sonar-delete-stream-rule-command-batch Delete a command from stream rules from input records.
Experimental
sonar-update-stream-rule-command-batch Update an existing command of stream rules from input records.
Experimental
sonar-insert-stream-rule-command-batch Insert a command into existing stream rules from input records.
Experimental
sonar-stream-rule-command-templates Enumerate the command templates a stream rule's commands can be built from.
Experimental
sonar-update-stream-rule-batch Update stream rule properties from input records. Only the fields a record carries are changed, and an empty value clears the field.
Experimental
sonar-create-batch-rule-batch Create batch rules from input records. Rules are created disabled.
Experimental
sonar-update-batch-rule-batch Update batch rule properties from input records. Only the fields a record carries are changed, and an empty value clears the field.
Experimental
sonar-create-stream-rule-batch Create stream rules from input records. Rules are created disabled.
Experimental
sonar-update-batch-rule-query-batch Replace the query of batch rules from input records.
Experimental
sonar-update-rule-mitre-batch Update the MITRE ATT&CK mapping of existing rules from input records.
Experimental
sonar-batch-rules Enumerate batch rules in Logpresso Sonar.
Experimental
sonar-stream-rules Enumerate stream rules in Logpresso Sonar.