psfalcon VS gofalcon

Rather than using flight control, you could consider doing a import/export of your configuration, then mass uninstall and reinstall each individual existing CID into your new single CID. The parent would really only help with policy inheritence/detection rollup/rbac which you would no longer need after converting to a single instance.

Try using PSFalcon and Get-FalconDetection to see what's in a detection record.

Add-FalconSensorTag Get-FalconSensorTag Remove-FalconSensorTag

There's an example of required fields under the New-FalconIoaRule wiki page, along with the values for disposition_id.

https://github.com/CrowdStrike/falconpy/tree/main/samples https://github.com/CrowdStrike/psfalcon/tree/master/samples

Check out Get-FalconQueue. It goes through a few steps:

Could you open an issue and include a PowerShell transcript with $VerbosePreference = 'Continue'?

Yes, using the Falcon APIs. Try PSFalcon, falconpy or gofalcon. Using PSFalcon, you could do this with the Invoke-FalconRtr command.

I don't recommend using curl beyond testing. Why not try one of our API SDKs?

Go - GoFalcon

CrowdStrike has more than one hundred different API endpoints, and they generally work in a handful of different ways. If you're new to APIs, it's easiest to start with a kit like falconpy, gofalcon or PSFalcon. These kits are all designed to help you handle the basic things like authentication, request formatting, pagination and even combining multiple APIs together to achieve a certain goal.

PSFalcon makes these APIs easier to use with PowerShell, while falconpy and gofalcon make them easier to use with Python and Golang, respectively. If you're completely new to APIs but understand one of these languages, one of these tools will be the best place to start. If you'd like to pull this data directly with Excel, you're going to have to start from scratch, or figure out how you could use Excel to call one of these tools to get your data.