Firewall Management

Falcon Firewall Management provides centralized control over host-based firewall policies across Windows and Linux systems. Configure firewall rules, manage rule groups, define network locations, and monitor firewall events.

Policy Settings

Get-FalconFirewallSetting

Retrieve general settings for a Falcon Firewall Management policy.

Get-FalconFirewallSetting -Id <policy_id>

Parameters

string[]

required

Policy identifier(s)

Edit-FalconFirewallSetting

Modify Falcon Firewall Management policy settings.

Edit-FalconFirewallSetting -Id <policy_id> -Enforce $true -DefaultInbound DENY -DefaultOutbound ALLOW

Parameters

string

required

Policy identifier

string

Operating System platform: 0 (Windows), 1 (Linux)

boolean

Policy enforcement status

string[]

Rule group identifier(s) in precedence order

string

Default action for inbound traffic: ALLOW, DENY

string

Default action for outbound traffic: ALLOW, DENY

boolean

Override all block rules and enable monitoring

boolean

Enable local logging of firewall events

All fields are required. PSFalcon automatically adds missing values from your existing policy.

Rule Groups

Get-FalconFirewallGroup

Search for Falcon Firewall Management rule groups.

Get-FalconFirewallGroup -Filter "platform_id:'0'" -Detailed

Parameters

string[]

Rule group identifier(s)

string

Falcon Query Language expression to limit results

string

Perform a generic substring search across available fields

string

Property and direction to sort results

int32

Maximum number of results per request (1-5000)

int32

Position to begin retrieving results

string

Pagination token to retrieve the next set of results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

New-FalconFirewallGroup

Create Falcon Firewall Management rule groups.

New-FalconFirewallGroup -Name "Web Server Rules" -Enabled $true -Platform windows -Description "Allow HTTP/HTTPS"

Parameters

string

required

Rule group name

boolean

required

Rule group enablement status

string

required

Operating system platform: windows, linux

string

Rule group description

object[]

Firewall rules array

string

Audit log comment

string

Clone default Firewall rules

string

Clone an existing rule group

switch

Perform validation instead of creating rule group

Edit-FalconFirewallGroup

Modify Falcon Firewall Management rule groups.

# Add a rule to a rule group
$DiffOps = @(
    @{
        op = 'add'
        path = '/rules/0'
        value = @{
            name = 'Allow HTTPS'
            action = 'ALLOW'
            direction = 'IN'
            protocol = '6'
            local_port = @{ start = '443'; end = '443' }
        }
    }
)

Edit-FalconFirewallGroup -Id <rulegroup_id> -DiffOperation $DiffOps -Comment "Added HTTPS rule"

Parameters

object[]

required

Array of hashtables containing rule or rule group changes with properties: from, op, path, valueAccepted op values: add, remove, replace

string

Audit log comment

string[]

Firewall rule family values or temp_id for new rules

string[]

Firewall rule version values or ‘null’ for new rules

string

required

Rule group identifier

switch

Perform validation instead of modifying rule group

Remove-FalconFirewallGroup

Remove Falcon Firewall Management rule groups.

Remove-FalconFirewallGroup -Id <rulegroup_id> -Comment "No longer needed"

Firewall Rules

Get-FalconFirewallRule

Search for Falcon Firewall Management rules.

# Get rules for a specific policy in precedence order
Get-FalconFirewallRule -PolicyId <policy_id>

# Search for rules by filter
Get-FalconFirewallRule -Filter "name:'*Web*'" -Detailed

Parameters

string[]

Rule identifier(s)

string

Return rules in precedence order for a specific policy

string

Falcon Query Language expression to limit results

string

Perform a generic substring search

string

Property and direction to sort results

int32

Maximum number of results per request (1-5000)

int32

Position to begin retrieving results

string

Pagination token

switch

Retrieve detailed information

switch

Repeat requests until all results retrieved

Network Locations

Get-FalconFirewallLocation

Search for Falcon Firewall Management locations.

Get-FalconFirewallLocation -Filter "enabled:true" -Detailed

Parameters

string[]

Location identifier(s)

string

Falcon Query Language expression to limit results

string

Perform a generic substring search

string

Property and direction to sort results

int

Maximum number of results per request

New-FalconFirewallLocation

Create Falcon Firewall Management locations.

# Create location with network identifiers
$Location = @{
    Name = "Office Network"
    Description = "Corporate office location"
    Enabled = $true
    DefaultGateway = @('192.168.1.1')
    DnsServer = @('192.168.1.10', '192.168.1.11')
    DhcpServer = @('192.168.1.1')
}

New-FalconFirewallLocation @Location

Parameters

string

Clone an existing location

boolean

Include firewall rules from existing location (when using CloneId)

string

required

Location name

string

Location description

boolean

Location enablement status

object

Wired or wireless connection types with associated properties

string[]

Default gateway IP address(es) or CIDR block(s)

string[]

DHCP server IP address(es) or CIDR block(s)

string[]

DNS server IP address(es) or CIDR block(s)

string[]

Host IP address(es) or CIDR block(s)

object[]

Target IP/CIDR with optional domain name

object[]

Target domain name using trusted certificate

object[]

Pingable IP address(es) or CIDR block(s)

string

Audit log comment

Edit-FalconFirewallLocation

Modify Falcon Firewall Management locations.

Edit-FalconFirewallLocation -Id <location_id> -Name "Updated Office Network" -Enabled $true

Remove-FalconFirewallLocation

Remove Falcon Firewall Management locations.

Remove-FalconFirewallLocation -Id <location_id>

Firewall Events

Get-FalconFirewallEvent

Search for Falcon Firewall Management events.

Get-FalconFirewallEvent -Filter "status:'blocked'" -Detailed

Parameters

string[]

Event identifier(s)

string

Falcon Query Language expression to limit results

string

Generic substring search

string

Property and direction to sort results

int32

Maximum number of results per request (1-5000)

int32

Position to begin retrieving results

string

Pagination token

switch

Retrieve detailed information

switch

Repeat requests until all results retrieved

Use Cases

Configure Web Server Firewall

# Create rule group for web server
$Rules = @(
    @{
        name = 'Allow HTTP'
        action = 'ALLOW'
        direction = 'IN'
        protocol = '6'
        local_port = @{ start = '80'; end = '80' }
    },
    @{
        name = 'Allow HTTPS'
        action = 'ALLOW'
        direction = 'IN'
        protocol = '6'
        local_port = @{ start = '443'; end = '443' }
    }
)

$RuleGroup = New-FalconFirewallGroup -Name "Web Server" -Enabled $true `
    -Platform windows -Rule $Rules -Description "HTTP/HTTPS traffic"

# Apply to policy
$Policy = Get-FalconFirewallSetting -Id <policy_id>
Edit-FalconFirewallSetting -Id $Policy.id -RuleGroupId @($RuleGroup.id) -Enforce $true

Monitor Blocked Traffic

# Get blocked events from last hour
$OneHourAgo = (Get-Date).AddHours(-1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
$BlockedEvents = Get-FalconFirewallEvent -Filter "status:'blocked'+created_timestamp:>'$OneHourAgo'" -Detailed

# Analyze blocked connections
$BlockedEvents | Group-Object -Property local_port | Select-Object Name, Count | Sort-Object Count -Descending

Manage Network Locations

# Create location for remote office
$RemoteOffice = New-FalconFirewallLocation -Name "Remote Office" `
    -DefaultGateway @('10.20.1.1') `
    -DnsServer @('10.20.1.10') `
    -Enabled $true

# Set location precedence
Set-FalconFirewallLocationPrecedence -Id @($Location1.id, $Location2.id, $RemoteOffice.id)

Requires Firewall management: Read scope for read operations and Firewall management: Write scope for modifications.

​Policy Settings

​Get-FalconFirewallSetting

​Parameters

​Edit-FalconFirewallSetting

​Parameters

​Rule Groups

​Get-FalconFirewallGroup

​Parameters

​New-FalconFirewallGroup

​Parameters

​Edit-FalconFirewallGroup

​Parameters

​Remove-FalconFirewallGroup

​Firewall Rules

​Get-FalconFirewallRule

​Parameters

​Network Locations

​Get-FalconFirewallLocation

​Parameters

​New-FalconFirewallLocation

​Parameters

​Edit-FalconFirewallLocation

​Remove-FalconFirewallLocation

​Firewall Events

​Get-FalconFirewallEvent

​Parameters

​Use Cases

​Configure Web Server Firewall

​Monitor Blocked Traffic

​Manage Network Locations

​Related Resources

Policy Settings

Get-FalconFirewallSetting

Parameters

Edit-FalconFirewallSetting

Parameters

Rule Groups

Get-FalconFirewallGroup

Parameters

New-FalconFirewallGroup

Parameters

Edit-FalconFirewallGroup

Parameters

Remove-FalconFirewallGroup

Firewall Rules

Get-FalconFirewallRule

Parameters

Network Locations

Get-FalconFirewallLocation

Parameters

New-FalconFirewallLocation

Parameters

Edit-FalconFirewallLocation

Remove-FalconFirewallLocation

Firewall Events

Get-FalconFirewallEvent

Parameters

Use Cases

Configure Web Server Firewall

Monitor Blocked Traffic

Manage Network Locations

Related Resources