Filtering detections for tactic and technique

[Sl1m007]

Does anyone know how to add behavior with the following to get tactic and technique, please?

Get-FalconDetection -Filter "status:'true_postive'+first_behavior:>'YYY-MM-DD'" -Sort 'first_behavior.desc'

Thank you in advance

[Sl1m007]

@bk-cs Could you help me, please? thanks in advance.

[bk-cs]

You need to add behaviors.tactic and/or behaviors.technique to the query.

Get-FalconDetection -Filter "status:'true_postive'+first_behavior:>'YYYY-MM-DD'+behaviors.tactic:'tactic'+behaviors.technique:'technique'" -Sort first_behavior.desc

See "Incident and Detection Monitoring APIs" for more examples. [ US-1 | US-2 | EU-1 | US-GOV-1 ]

[Sl1m007]

Thank you @bk-cs for the update.
Do you know if it will accept a wildcard on the behaviors.tactic:'**tactic**'+behaviors.technique:'**technique**'

Thank you in advance.

[bk-cs]

Based on quick testing, it seems like it does. The format should look like this:

behaviors.tactic:*'*tactic*'+behaviors.technique:*'*technique*'

[Sl1m007]

I really appreciate you coming back to me and thank you.

However, I copied and paste this:
behaviors.tactic:*'*tactic*'+behaviors.technique:*'*technique*'

to

Get-FalconDetection -Filter "status:'true_postive'+first_behavior:>'YYYY-MM-DD'+behaviors.tactic:*'*tactic*'+behaviors.technique:*'*technique*'" -Sort first_behavior.desc

It didn't work for me.

[bk-cs]

Are you using matching capitalization?

In my environment, this works to find detections with the tactic Custom Intelligence and technique Indicator of Attack:

Get-FalconDetection -Filter "first_behavior:>'2022-03-20'+status:'new'+behaviors.tactic:*'*Custom*'+behaviors.technique:*'*Indicator*'" -Detailed

But this doesn't:

Get-FalconDetection -Filter "first_behavior:>'2022-03-20'+status:'new'+behaviors.tactic:*'*custom*'+behaviors.technique:*'*indicator*'" -Detailed