Overview
Firewall Management policies control network traffic on endpoints through the Falcon platform. These policies work in conjunction with firewall rules to define allowed and blocked network connections across your environment.Required API Scope:
Firewall management: Read (for read operations) or Firewall management: Write (for write operations)Get Firewall Policies
Search for and retrieve Falcon Firewall Management policies.Get-FalconFirewallPolicy
Parameters
string[]
Policy identifier(s). Pattern:
^[a-fA-F0-9]{32}$string
Falcon Query Language (FQL) expression to limit resultsExample:
platform_name:'Windows'+enabled:truestring
Property and direction to sort resultsValid values:
created_by.asc, created_by.desc, created_timestamp.asc, created_timestamp.desc, enabled.asc, enabled.desc, modified_by.asc, modified_by.desc, modified_timestamp.asc, modified_timestamp.desc, name.asc, name.desc, platform_name.asc, platform_name.desc, precedence.asc, precedence.descint32
Maximum number of results per request (1-5000)
string[]
Include additional propertiesValid values:
members, settingsint32
Position to begin retrieving results
switch
Retrieve detailed information
switch
Repeat requests until all available results are retrieved
switch
Display total result count instead of results
Examples
Create Firewall Policy
Create new Falcon Firewall Management policies.New-FalconFirewallPolicy
Parameters
string
required
Policy name
string
required
Operating system platformValid values:
Windows, Mac, Linuxstring
Policy description
object[]
One or more policies to create in a single request (for batch operations, max 100 per request)
Examples
After creating a firewall policy, you must assign firewall rule groups to it using policy actions and create/configure the actual firewall rules separately.
Edit Firewall Policy
Modify existing Falcon Firewall Management policies.Edit-FalconFirewallPolicy
Parameters
string
required
Policy identifier. Pattern:
^[a-fA-F0-9]{32}$string
Policy name
string
Policy description
object[]
One or more policies to modify in a single request (for batch operations, max 100 per request)
Examples
Remove Firewall Policy
Remove Falcon Firewall Management policies.Remove-FalconFirewallPolicy
Parameters
string[]
required
Policy identifier(s) to remove. Pattern:
^[a-fA-F0-9]{32}$Example
Policy Actions
Perform actions on Falcon Firewall Management policies such as enabling/disabling or assigning to host groups.Invoke-FalconFirewallPolicyAction
Parameters
string
required
Action to performValid values:
add-host-group, disable, enable, remove-host-groupstring
Host group identifier. Pattern:
^[a-fA-F0-9]{32}$Required for: add-host-group, remove-host-groupstring
required
Policy identifier. Pattern:
^[a-fA-F0-9]{32}$Examples
Get Policy Members
Search for members (hosts) assigned to Falcon Firewall Management policies.Get-FalconFirewallPolicyMember
Parameters
string
Policy identifier. Pattern:
^[a-fA-F0-9]{32}$string
Falcon Query Language expression to limit results
string
Property and direction to sort results
int32
Maximum number of results per request (1-5000)
int32
Position to begin retrieving results
switch
Retrieve detailed information
switch
Repeat requests until all available results are retrieved
switch
Display total result count instead of results
Example
Set Policy Precedence
Set Falcon Firewall Management policy precedence order for a specific platform.Set-FalconFirewallPrecedence
Parameters
string
required
Operating system platformValid values:
Windows, Mac, Linuxstring[]
required
Policy identifiers in desired precedence order (highest to lowest priority). Pattern:
^[a-fA-F0-9]{32}$All policy identifiers must be supplied in order, with the exception of the
platform_default policy.Example
Firewall Policy Architecture
Firewall Management policies in Falcon work with several related components:- Firewall Policies: Container for firewall configuration and rule assignments
- Firewall Rule Groups: Collections of firewall rules
- Firewall Rules: Individual rules defining network traffic permissions
1
Create Policy
Create a firewall policy using
New-FalconFirewallPolicy2
Configure Rules
Create and configure firewall rules using firewall rule management cmdlets
3
Assign to Hosts
Assign the policy to host groups using
Invoke-FalconFirewallPolicyAction4
Enable Policy
Enable the policy to enforce firewall rules on assigned hosts
Use Cases
Segment Network Traffic
Segment Network Traffic
Create firewall policies with different rule sets for workstations, servers, and specialized systems to implement network segmentation.
Compliance Requirements
Compliance Requirements
Define firewall policies that meet compliance standards (PCI-DSS, HIPAA, etc.) and assign them to relevant host groups.
Zero Trust Architecture
Zero Trust Architecture
Implement default-deny policies with explicit allow rules for authorized connections, supporting zero trust network principles.
DMZ Protection
DMZ Protection
Create restrictive firewall policies for DMZ hosts that allow only necessary inbound and outbound connections.
Related Resources
Prevention Policies
Manage Prevention policies
Device Control Policies
Control USB and Bluetooth device usage