public/mssp.ps1

function Add-FalconCidGroupMember {
<#
.SYNOPSIS
Add a CID member to a Falcon Flight Control CID group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
CID group identifier
.PARAMETER Cid
Customer identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Add-FalconCidGroupMember
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/cid-group-members/v1:post',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-group-members/v1:post',Mandatory,
      ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_id')]
    [string]$Id,
    [Parameter(ParameterSetName='/mssp/entities/cid-group-members/v1:post',Mandatory,
      ValueFromPipelineByPropertyName,Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{32}(-\w{2})?$')]
    [Alias('cids','child_cid')]
    [string[]]$Cid
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Cid) {
      @($Cid).foreach{
        $Value = Confirm-CidValue $_
        if ($Value) { $List.Add($Value) }
      }
    }
  }
  end {
    if ($List) {
      $PSBoundParameters['Cid'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Add-FalconGroupRole {
<#
.SYNOPSIS
Assign roles between Falcon Flight Control CID and user groups
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER CidGroupId
CID group identifier
.PARAMETER UserGroupId
User Group identifier
.PARAMETER RoleId
Role identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Add-FalconGroupRole
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/mssp-roles/v1:post',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:post',Mandatory,ValueFromPipelineByPropertyName,
      Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_id')]
    [string]$CidGroupId,
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:post',Mandatory,ValueFromPipelineByPropertyName,
      Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_id')]
    [string]$UserGroupId,
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:post',Mandatory,ValueFromPipelineByPropertyName,
      Position=3)]
    [Alias('role_ids','RoleIds')]
    [string[]]$RoleId
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process { if ($RoleId) { @($RoleId).foreach{ $List.Add($_) }}}
  end {
    if ($List) {
      $PSBoundParameters['RoleId'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Add-FalconUserGroupMember {
<#
.SYNOPSIS
Add a user to a Falcon Flight Control user group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
User group identifier
.PARAMETER UserId
User identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Add-FalconUserGroupMember
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/user-group-members/v1:post',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-group-members/v1:post',Mandatory,
      ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_id')]
    [string]$Id,
    [Parameter(ParameterSetName='/mssp/entities/user-group-members/v1:post',Mandatory,
      ValueFromPipelineByPropertyName,Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$')]
    [Alias('user_uuids','UserIds')]
    [string[]]$UserId
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process { if ($UserId) { @($UserId).foreach{ $List.Add($_) }}}
  end {
    if ($List) {
      $PSBoundParameters['UserId'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Edit-FalconCidGroup {
<#
.SYNOPSIS
Modify a Falcon Flight Control CID group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Name
CID group name
.PARAMETER Description
CID group description
.PARAMETER Id
CID group identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Edit-FalconCidGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/cid-groups/v1:patch',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v1:patch',ValueFromPipelineByPropertyName,
      Position=1)]
    [string]$Name,
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v1:patch',ValueFromPipelineByPropertyName,
      Position=2)]
    [string]$Description,
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v1:patch',Mandatory,ValueFromPipelineByPropertyName,
      Position=3)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_id')]
    [string]$Id
  )
  begin { $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }}
  process { Invoke-Falcon @Param -UserInput $PSBoundParameters }
}
function Edit-FalconUserGroup {
<#
.SYNOPSIS
Modify a Falcon Flight Control user group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
User group identifier
.PARAMETER Name
User group name
.PARAMETER Description
User group description
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Edit-FalconUserGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/user-groups/v1:patch',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v1:patch',ValueFromPipelineByPropertyName,
      Position=1)]
    [string]$Name,
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v1:patch',ValueFromPipelineByPropertyName,
      Position=2)]
    [string]$Description,
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v1:patch',Mandatory,
      ValueFromPipelineByPropertyName,Position=3)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_id')]
    [string]$Id
  )
  begin { $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }}
  process { Invoke-Falcon @Param -UserInput $PSBoundParameters }
}
function Get-FalconCidGroup {
<#
.SYNOPSIS
Search for Falcon Flight Control CID groups
.DESCRIPTION
Requires 'Flight Control: Read'.
.PARAMETER Id
CID group identifier
.PARAMETER Name
CID group name
.PARAMETER Sort
Property and direction to sort results
.PARAMETER Limit
Maximum number of results per request
.PARAMETER Offset
Position to begin retrieving results
.PARAMETER Detailed
Retrieve detailed information
.PARAMETER All
Repeat requests until all available results are retrieved
.PARAMETER Total
Display total result count instead of results
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Get-FalconCidGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/queries/cid-groups/v1:get',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v2:get',Mandatory,ValueFromPipelineByPropertyName,
      ValueFromPipeline)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('ids','cid_group_id')]
    [string[]]$Id,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get',Position=1)]
    [string]$Name,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get',Position=2)]
    [ValidateSet('last_modified_timestamp.asc','last_modified_timestamp.desc','name.asc','name.desc',
      IgnoreCase=$false)]
    [string]$Sort,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get',Position=3)]
    [ValidateRange(1,5000)]
    [int32]$Limit,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get')]
    [int32]$Offset,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get')]
    [switch]$Detailed,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get')]
    [switch]$All,
    [Parameter(ParameterSetName='/mssp/queries/cid-groups/v1:get')]
    [switch]$Total
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Id) { @($Id).foreach{ $List.Add($_) }} else { Invoke-Falcon @Param -UserInput $PSBoundParameters }
  }
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Get-FalconCidGroupMember {
<#
.SYNOPSIS
Search for Falcon Flight Control CID group members
.DESCRIPTION
Requires 'Flight Control: Read'.
.PARAMETER Id
CID group identifier
.PARAMETER Cid
Customer identifier
.PARAMETER Sort
Property and direction to sort results
.PARAMETER Limit
Maximum number of results per request
.PARAMETER Offset
Position to begin retrieving results
.PARAMETER Detailed
Retrieve detailed information
.PARAMETER All
Repeat requests until all available results are retrieved
.PARAMETER Total
Display total result count instead of results
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Get-FalconCidGroupMember
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/queries/cid-group-members/v1:get',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-group-members/v2:get',Mandatory,
      ValueFromPipelineByPropertyName,ValueFromPipeline)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('ids','cid_group_id')]
    [string[]]$Id,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get',Mandatory,
      ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}(-\w{2})?$')]
    [Alias('child_cid')]
    [string]$Cid,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get',Position=2)]
    [ValidateSet('last_modified_timestamp.asc','last_modified_timestamp.desc',IgnoreCase=$false)]
    [string]$Sort,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get',Position=3)]
    [ValidateRange(1,5000)]
    [int32]$Limit,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get')]
    [int32]$Offset,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get')]
    [switch]$Detailed,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get')]
    [switch]$All,
    [Parameter(ParameterSetName='/mssp/queries/cid-group-members/v1:get')]
    [switch]$Total
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Id) {
      @($Id).foreach{ $List.Add($_) }
    } else {
      if ($PSBoundParameters.Cid) { $PSBoundParameters.Cid = Confirm-CidValue $PSBoundParameters.Cid }
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
  end {
    if ($List) {
      if ($PSBoundParameters.Cid) { $PSBoundParameters.Cid = Confirm-CidValue $PSBoundParameters.Cid }
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Get-FalconGroupRole {
<#
.SYNOPSIS
Search for Falcon Flight Control user group roles
.DESCRIPTION
Requires 'Flight Control: Read'.
.PARAMETER Id
Combined group identifier [<cid_group_id>:<user_group_id>]
.PARAMETER CidGroupId
CID group identifier
.PARAMETER UserGroupId
User group identifier
.PARAMETER RoleId
Role group identifier
.PARAMETER Sort
Property and direction to sort results
.PARAMETER Limit
Maximum number of results per request
.PARAMETER Offset
Position to begin retrieving results
.PARAMETER Detailed
Retrieve detailed information
.PARAMETER All
Repeat requests until all available results are retrieved
.PARAMETER Total
Display total result count instead of results
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Get-FalconGroupRole
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/queries/mssp-roles/v1:get',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:get',Mandatory,ValueFromPipeline)]
    [ValidatePattern('^[a-fA-F0-9]{32}:[a-fA-F0-9]{32}$')]
    [Alias('ids')]
    [string[]]$Id,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get',ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_id')]
    [string]$CidGroupId,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get',ValueFromPipelineByPropertyName,Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_id')]
    [string]$UserGroupId,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get',ValueFromPipelineByPropertyName,Position=3)]
    [Alias('role_id')]
    [string]$RoleId,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get',Position=4)]
    [ValidateSet('last_modified_timestamp.asc','last_modified_timestamp.desc',IgnoreCase=$false)]
    [string]$Sort,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get',Position=5)]
    [ValidateRange(1,5000)]
    [int32]$Limit,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get')]
    [int32]$Offset,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get')]
    [switch]$Detailed,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get')]
    [switch]$All,
    [Parameter(ParameterSetName='/mssp/queries/mssp-roles/v1:get')]
    [switch]$Total
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Id) {
      @($Id).foreach{ $List.Add($_) }
    } elseif (!$Id -and !$CidGroupId -and !$UserGroupId) {
      throw "'CidGroupId' or 'UserGroupId' must be provided."
    } else {
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Get-FalconMemberCid {
<#
.SYNOPSIS
Search for Falcon Flight Control member CIDs
.DESCRIPTION
Requires 'Flight Control: Read'.
.PARAMETER Id
Member CID identifier
.PARAMETER Filter
Falcon Query Language expression to limit results
.PARAMETER Sort
Property and direction to sort results
.PARAMETER Limit
Maximum number of results per request
.PARAMETER Offset
Position to begin retrieving results
.PARAMETER Detailed
Retrieve detailed information
.PARAMETER All
Repeat requests until all available results are retrieved
.PARAMETER Total
Display total result count instead of results
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Get-FalconMemberCid
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/queries/children/v1:get',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/children/GET/v2:post',Mandatory,
      ValueFromPipelineByPropertyName,ValueFromPipeline)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('ids','child_cid')]
    [string[]]$Id,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get',Position=1)]
    [ValidateScript({ Test-FqlStatement $_ })]
    [string]$Filter,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get',Position=2)]
    [ValidateSet('last_modified_timestamp.asc','last_modified_timestamp.desc',IgnoreCase=$false)]
    [string]$Sort,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get',Position=3)]
    [ValidateRange(1,5000)]
    [int32]$Limit,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get')]
    [int32]$Offset,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get')]
    [switch]$Detailed,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get')]
    [switch]$All,
    [Parameter(ParameterSetName='/mssp/queries/children/v1:get')]
    [switch]$Total
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Id) { @($Id).foreach{ $List.Add($_) }} else { Invoke-Falcon @Param -UserInput $PSBoundParameters }
  }
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Get-FalconUserGroup {
<#
.SYNOPSIS
Search for Falcon Flight Control user groups
.DESCRIPTION
Requires 'Flight Control: Read'.
.PARAMETER Id
User group identifier
.PARAMETER Name
User group name
.PARAMETER Sort
Property and direction to sort results
.PARAMETER Limit
Maximum number of results per request
.PARAMETER Offset
Position to begin retrieving results
.PARAMETER Detailed
Retrieve detailed information
.PARAMETER All
Repeat requests until all available results are retrieved
.PARAMETER Total
Display total result count instead of results
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Get-FalconUserGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/queries/user-groups/v1:get',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v2:get',Mandatory,ValueFromPipelineByPropertyName,
      ValueFromPipeline)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('ids','user_group_id')]
    [string[]]$Id,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get',Position=1)]
    [string]$Name,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get',Position=2)]
    [ValidateSet('last_modified_timestamp.asc','last_modified_timestamp.desc','name.asc','name.desc',
      IgnoreCase=$false)]
    [string]$Sort,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get',Position=3)]
    [ValidateRange(1,5000)]
    [int32]$Limit,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get')]
    [int32]$Offset,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get')]
    [switch]$Detailed,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get')]
    [switch]$All,
    [Parameter(ParameterSetName='/mssp/queries/user-groups/v1:get')]
    [switch]$Total
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Id) { @($Id).foreach{ $List.Add($_) }} else { Invoke-Falcon @Param -UserInput $PSBoundParameters }
  }
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Get-FalconUserGroupMember {
<#
.SYNOPSIS
Search for members of a Falcon Flight Control user group,or groups assigned to a user
.DESCRIPTION
Requires 'Flight Control: Read'.
.PARAMETER Id
User group identifier, to find group members
.PARAMETER UserId
A user identifier, to find group membership
.PARAMETER Sort
Property and direction to sort results
.PARAMETER Limit
Maximum number of results per request
.PARAMETER Offset
Position to begin retrieving results
.PARAMETER Detailed
Retrieve detailed information
.PARAMETER All
Repeat requests until all available results are retrieved
.PARAMETER Total
Display total result count instead of results
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Get-FalconUserGroupMember
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/queries/user-group-members/v1:get',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-group-members/v2:get',Mandatory,
      ValueFromPipelineByPropertyName,ValueFromPipeline)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('ids','user_group_id')]
    [string[]]$Id,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get',Mandatory,
      ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$')]
    [Alias('user_uuid','uuid')]
    [string]$UserId,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get',Position=2)]
    [ValidateSet('last_modified_timestamp.asc','last_modified_timestamp.desc',IgnoreCase=$false)]
    [string]$Sort,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get',Position=3)]
    [ValidateRange(1,5000)]
    [int32]$Limit,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get')]
    [int32]$Offset,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get')]
    [switch]$Detailed,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get')]
    [switch]$All,
    [Parameter(ParameterSetName='/mssp/queries/user-group-members/v1:get')]
    [switch]$Total
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Id) { @($Id).foreach{ $List.Add($_) }} else { Invoke-Falcon @Param -UserInput $PSBoundParameters }
  }
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function New-FalconCidGroup {
<#
.SYNOPSIS
Create a Falcon Flight Control CID group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Name
CID group name
.PARAMETER Description
CID group description
.LINK
https://github.com/crowdstrike/psfalcon/wiki/New-FalconCidGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/cid-groups/v1:post',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v1:post',Mandatory,Position=1)]
    [string]$Name,
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v1:post',Mandatory,Position=2)]
    [string]$Description
  )
  begin { $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }}
  process { Invoke-Falcon @Param -UserInput $PSBoundParameters }
}
function New-FalconUserGroup {
<#
.SYNOPSIS
Create a Falcon Flight Control user group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Name
User group name
.PARAMETER Description
User group description
.LINK
https://github.com/crowdstrike/psfalcon/wiki/New-FalconUserGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/user-groups/v1:post',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v1:post',Mandatory,Position=1)]
    [string]$Name,
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v1:post',Mandatory,Position=2)]
    [string]$Description
  )
  begin { $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }}
  process { Invoke-Falcon @Param -UserInput $PSBoundParameters }
}
function Remove-FalconCidGroup {
<#
.SYNOPSIS
Remove Falcon Flight Control CID groups
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
CID group
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconCidGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/cid-groups/v1:delete',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-groups/v1:delete',Mandatory,
      ValueFromPipelineByPropertyName,ValueFromPipeline,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_ids','cid_group_id','ids')]
    [string[]]$Id
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process { if ($Id) { @($Id).foreach{ $List.Add($_) }}}
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Remove-FalconCidGroupMember {
<#
.SYNOPSIS
Remove members from a Falcon Flight Control CID group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
CID group identifier
.PARAMETER Cid
Customer identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconCidGroupMember
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/cid-group-members/v2:delete',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/cid-group-members/v2:delete',Mandatory,
      ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_id')]
    [string]$Id,
    [Parameter(ParameterSetName='/mssp/entities/cid-group-members/v2:delete',Mandatory,
      ValueFromPipelineByPropertyName,Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{32}(-\w{2})?$')]
    [Alias('cids','child_cid')]
    [string[]]$Cid
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($Cid) {
      @($Cid).foreach{
        $Value = Confirm-CidValue $_
        if ($Value) { $List.Add($Value) }
      }
    }
  }
  end {
    if ($List) {
      $PSBoundParameters['Cid'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Remove-FalconGroupRole {
<#
.SYNOPSIS
Remove roles between a Falcon Flight Control user group and CID group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER CidGroupId
CID group identifier
.PARAMETER UserGroupId
User group identifier
.PARAMETER RoleId
Role identifier, or leave blank to remove user group/CID group association
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconGroupRole
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/mssp-roles/v1:delete',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:delete',Mandatory,
      ValueFromPipelineByPropertyName,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('cid_group_id')]
    [string]$CidGroupId,
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:delete',Mandatory,
      ValueFromPipelineByPropertyName,Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_id')]
    [string]$UserGroupId,
    [Parameter(ParameterSetName='/mssp/entities/mssp-roles/v1:delete',ValueFromPipelineByPropertyName,
      Position=3)]
    [Alias('role_ids','RoleIds')]
    [string[]]$RoleId
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process {
    if ($RoleId) {
      @($RoleId).foreach{ $List.Add($_) }
    } else {
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
  end {
    if ($List) {
      $PSBoundParameters['RoleId'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Remove-FalconUserGroup {
<#
.SYNOPSIS
Remove Falcon Flight Control user groups
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
User group identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconUserGroup
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/user-groups/v1:delete',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-groups/v1:delete',Mandatory,
      ValueFromPipelineByPropertyName,ValueFromPipeline,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_ids','user_group_id','ids')]
    [string[]]$Id
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process { if ($Id) { @($Id).foreach{ $List.Add($_) }}}
  end {
    if ($List) {
      $PSBoundParameters['Id'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}
function Remove-FalconUserGroupMember {
<#
.SYNOPSIS
Remove members from a Falcon Flight Control user group
.DESCRIPTION
Requires 'Flight Control: Write'.
.PARAMETER Id
User group identifier
.PARAMETER UserId
User identifier
.LINK
https://github.com/crowdstrike/psfalcon/wiki/Remove-FalconUserGroupMember
#>

  [CmdletBinding(DefaultParameterSetName='/mssp/entities/user-group-members/v1:delete',SupportsShouldProcess)]
  param(
    [Parameter(ParameterSetName='/mssp/entities/user-group-members/v1:delete',Mandatory,Position=1)]
    [ValidatePattern('^[a-fA-F0-9]{32}$')]
    [Alias('user_group_id')]
    [string]$Id,
    [Parameter(ParameterSetName='/mssp/entities/user-group-members/v1:delete',Mandatory,
      ValueFromPipelineByPropertyName,ValueFromPipeline,Position=2)]
    [ValidatePattern('^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$')]
    [Alias('user_uuids','uuid','UserIds')]
    [string[]]$UserId
  )
  begin {
    $Param = @{ Command = $MyInvocation.MyCommand.Name; Endpoint = $PSCmdlet.ParameterSetName }
    [System.Collections.Generic.List[string]]$List = @()
  }
  process { if ($UserId) { @($UserId).foreach{ $List.Add($_) }}}
  end {
    if ($List) {
      $PSBoundParameters['UserId'] = @($List)
      Invoke-Falcon @Param -UserInput $PSBoundParameters
    }
  }
}