Invoke-FalconIdentityGraph - example of variable substitution

[hkelley]

Description of your question
Could you please provide an example of how to use variable substitution in

Invoke-FalconIdentityGraph

https://github.com/CrowdStrike/psfalcon/wiki/Invoke-FalconIdentityGraph

The wiki mentions the capability but I don't see any example of how to format/mark the variables in the graph query.

I'm trying to use your variable substitution instead of entityIds:["{0}"] and -f $entityUuid in the snippet below:

$fql = "product:'idp'+name:['ExcessiveDailyUsage','ExcessiveTargetDailyUsage']"

foreach($alert in Get-FalconAlert -Filter $fql -Limit 10 -Detailed) {

  $alertId = ($alert.id -split ':')[2]
  $entityUuid = $alert.source_account_object_guid

  $query = @"
  query GetIncidentAlertsForUser {{
    incidents(
      first: 10,
      entityQuery:{{
        entityIds:["{0}"]
      }}
      types:[POTENTIAL_RISKY_ACTIVITY],     
      sortKey: END_TIME,
      sortOrder: DESCENDING
      ) {{
      nodes {{
        incidentId
        type      
        startTime
        endTime
        compromisedEntities {{
          primaryDisplayName
          type
        }}
        alertEvents {{
          alertId
          eventId
          patternId
          alertType
          eventLabel
          entities {{
            primaryDisplayName
          }}
          sourceEntity{{
            entityId
            primaryDisplayName
          }}        
          relatedEvents(first: 1000) {{
            nodes {{
              timestamp
              ... on TimelineUserOnEndpointActivityEvent {{
                userEntity {{
                  primaryDisplayName
                }}
                endpointEntity {{
                  primaryDisplayName
                  entityId 
                }}
                targetEntity {{
                  primaryDisplayName
                  entityId              
                }}
              }}
            }}
          }}
        }}
      }}
    }}
  }}
"@ -f $entityUuid

[bk-cs]

-f only works in single quote strings, but you can't use that because of the use of brackets in the GraphQL query. You can replace {0} instead:

$query = @'
  query GetIncidentAlertsForUser {
    incidents(
      first: 10,
      entityQuery:{
        entityIds:["{0}"]
      }
      types:[POTENTIAL_RISKY_ACTIVITY],     
      sortKey: END_TIME,
      sortOrder: DESCENDING
      ) {
      nodes {
        incidentId
        type      
        startTime
        endTime
        compromisedEntities {
          primaryDisplayName
          type
        }
        alertEvents {
          alertId
          eventId
          patternId
          alertType
          eventLabel
          entities {
            primaryDisplayName
          }
          sourceEntity{
            entityId
            primaryDisplayName
          }        
          relatedEvents(first: 1000) {
            nodes {
              timestamp
              ... on TimelineUserOnEndpointActivityEvent {
                userEntity {
                  primaryDisplayName
                }
                endpointEntity {
                  primaryDisplayName
                  entityId 
                }
                targetEntity {
                  primaryDisplayName
                  entityId              
                }
              }
            }
          }
        }
      }
    }
  }
'@
$query = $query -replace '\{0\}',$entityUuid

[hkelley]

The code I posted works fine. I'm asking how, instead of using Powershell's -f, I can use PSFalcon's -Variable

psfalcon/public/identity-protection.ps1

Line 30 in f0b3a68

function Assert-CursorVariable ($UserInput,$EndCursor) {

Invoke-FalconIdentityGraph -Variable <Hashtable> 

The documentation indicates that there is some sort of substitution feature in your cmdlet.

A hashtable containing variables used in your GraphQL statement

[hkelley]

I had to learn more about how GraphQL variables are HTTP POSTed to an endpoint. Now I understand. Example below.

#region Query stuff

$fql = "product:'idp'+name:['ExcessiveDailyUsage','ExcessiveTargetDailyUsage']"

$graphql = @"
query (`$entityIds: [UUID!], `$createdBefore: DateTimeInput!, `$alertIds: [UUID!], `$alertLimit: Int!) {
  incidents(
        first:1
      , types: [POTENTIAL_RISKY_ACTIVITY]
      , entityQuery: {entityIds: `$entityIds}
      , createdBefore: `$createdBefore
      , sortKey: START_TIME
      , sortOrder: DESCENDING) {
    nodes {
      incidentId
      type
      severity
      startTime
      endTime
      timeline(includeContextualEvents: true, excludedTypes: [NEW_INCIDENT], alertQuery: {alertIds:`$alertIds} , first: `$alertLimit) {
        nodes {
          timestamp
          startTime
          endTime
          eventType
          eventId
          eventSeverity
          ... on TimelineAlertEvent {
            alertType
            alertId
            patternId
          }  
        }
      }
    }
  }
}
"@
#endRegion

foreach($alert in Get-FalconAlert -Filter $fql -Limit 1 -Detailed) {

  $alertId = ($alert.id -split ':')[2]
  $entityUuid = $alert.source_account_object_guid
  
  $variables =  @{
    createdBefore = $alert.created_timestamp
    entityIds= ($entityUuid)
    alertIds = ($alertId)
    alertLimit = 10
  } 

    $ret = Invoke-FalconIdentityGraph -String $graphql -Variable $variables -ErrorAction Stop
}