`Invoke-FalconIdentityGraph` - example of variable substitution

[hkelley]

Description of your question
Could you please provide an example of how to use variable substitution in

Invoke-FalconIdentityGraph

https://github.com/CrowdStrike/psfalcon/wiki/Invoke-FalconIdentityGraph

The wiki mentions the capability but I don't see any example of how to format/mark the variables in the graph query.

I'm trying to use your variable substitution instead of entityIds:["{0}"] and -f $entityUuid in the snippet below:

$fql = "product:'idp'+name:['ExcessiveDailyUsage','ExcessiveTargetDailyUsage']"

foreach($alert in Get-FalconAlert -Filter $fql -Limit 10 -Detailed) {

  $alertId = ($alert.id -split ':')[2]
  $entityUuid = $alert.source_account_object_guid

  $query = @"
  query GetIncidentAlertsForUser {{
    incidents(
      first: 10,
      entityQuery:{{
        entityIds:["{0}"]
      }}
      types:[POTENTIAL_RISKY_ACTIVITY],     
      sortKey: END_TIME,
      sortOrder: DESCENDING
      ) {{
      nodes {{
        incidentId
        type      
        startTime
        endTime
        compromisedEntities {{
          primaryDisplayName
          type
        }}
        alertEvents {{
          alertId
          eventId
          patternId
          alertType
          eventLabel
          entities {{
            primaryDisplayName
          }}
          sourceEntity{{
            entityId
            primaryDisplayName
          }}        
          relatedEvents(first: 1000) {{
            nodes {{
              timestamp
              ... on TimelineUserOnEndpointActivityEvent {{
                userEntity {{
                  primaryDisplayName
                }}
                endpointEntity {{
                  primaryDisplayName
                  entityId 
                }}
                targetEntity {{
                  primaryDisplayName
                  entityId              
                }}
              }}
            }}
          }}
        }}
      }}
    }}
  }}
"@ -f $entityUuid

[bk-cs]

-f only works in single quote strings, but you can't use that because of the use of brackets in the GraphQL query. You can replace {0} instead:

$query = @'
  query GetIncidentAlertsForUser {
    incidents(
      first: 10,
      entityQuery:{
        entityIds:["{0}"]
      }
      types:[POTENTIAL_RISKY_ACTIVITY],     
      sortKey: END_TIME,
      sortOrder: DESCENDING
      ) {
      nodes {
        incidentId
        type      
        startTime
        endTime
        compromisedEntities {
          primaryDisplayName
          type
        }
        alertEvents {
          alertId
          eventId
          patternId
          alertType
          eventLabel
          entities {
            primaryDisplayName
          }
          sourceEntity{
            entityId
            primaryDisplayName
          }        
          relatedEvents(first: 1000) {
            nodes {
              timestamp
              ... on TimelineUserOnEndpointActivityEvent {
                userEntity {
                  primaryDisplayName
                }
                endpointEntity {
                  primaryDisplayName
                  entityId 
                }
                targetEntity {
                  primaryDisplayName
                  entityId              
                }
              }
            }
          }
        }
      }
    }
  }
'@
$query = $query -replace '\{0\}',$entityUuid