Response Policies

Overview

Real-time Response (RTR) policies control the level of access administrators have when performing remote operations on endpoints. These policies determine which RTR commands are available for incident response and system management tasks.

Required API Scope: Response policies: Read (for read operations) or Response policies: Write (for write operations)

Get Response Policies

Search for and retrieve Real-time Response policies.

Get-FalconResponsePolicy

Get-FalconResponsePolicy [[-Filter] <string>] [[-Sort] <string>] [[-Limit] <int>] [[-Include] <string[]>] [[-Offset] <int>] [-Detailed] [-All] [-Total]

Parameters

string[]

Policy identifier(s). Pattern: ^[a-fA-F0-9]{32}$

string

Falcon Query Language (FQL) expression to limit resultsExample: platform_name:'Windows'+enabled:true

string

Property and direction to sort resultsValid values: created_by.asc, created_by.desc, created_timestamp.asc, created_timestamp.desc, enabled.asc, enabled.desc, modified_by.asc, modified_by.desc, modified_timestamp.asc, modified_timestamp.desc, name.asc, name.desc, platform_name.asc, platform_name.desc, precedence.asc, precedence.desc

int32

Maximum number of results per request (1-5000)

string[]

Include additional propertiesValid values: members

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Examples

Get-FalconResponsePolicy -All -Detailed

Get-FalconResponsePolicy -Filter "enabled:true" -Detailed

Get-FalconResponsePolicy -Id <policy_id> -Include members

Create Response Policy

Create new Real-time Response policies.

New-FalconResponsePolicy

New-FalconResponsePolicy -Name <string> -PlatformName <string> [[-Description] <string>] [[-Setting] <object[]>]

Parameters

string

required

Policy name

string

required

Operating system platformValid values: Windows, Mac, Linux

string

Policy description

object[]

Policy settings controlling RTR capabilities. Each setting should include id and value properties.

object[]

One or more policies to create in a single request (for batch operations, max 100 per request)

Examples

$Settings = @(
    @{ id = 'RESPONSE_GET_COMMAND'; value = 'ENABLED' },
    @{ id = 'RESPONSE_PUT_COMMAND'; value = 'ENABLED' },
    @{ id = 'RESPONSE_RUNSCRIPT_COMMAND'; value = 'ENABLED' }
)
New-FalconResponsePolicy -Name 'Admin RTR Access' -PlatformName 'Windows' -Description 'Full RTR access for administrators' -Setting $Settings

New-FalconResponsePolicy -Name 'Linux Standard Access' -PlatformName 'Linux' -Description 'Standard RTR for Linux systems'

Edit Response Policy

Modify existing Real-time Response policies.

Edit-FalconResponsePolicy

Edit-FalconResponsePolicy -Id <string> [[-Name] <string>] [[-Description] <string>] [[-Setting] <object[]>]

Parameters

string

required

Policy identifier. Pattern: ^[a-fA-F0-9]{32}$

string

Policy name

string

Policy description

object[]

Policy settings to update. Each setting should contain id and value.

object[]

One or more policies to modify in a single request (for batch operations, max 100 per request)

Examples

Edit-FalconResponsePolicy -Id <policy_id> -Description 'Updated RTR policy description'

$UpdatedSettings = @(
    @{ id = 'RESPONSE_RUNSCRIPT_COMMAND'; value = 'DISABLED' }
)
Edit-FalconResponsePolicy -Id <policy_id> -Setting $UpdatedSettings

Remove Response Policy

Remove Real-time Response policies.

Remove-FalconResponsePolicy

Remove-FalconResponsePolicy -Id <string[]>

Parameters

string[]

required

Policy identifier(s) to remove. Pattern: ^[a-fA-F0-9]{32}$

Example

Remove-FalconResponsePolicy -Id <policy_id>

Policy Actions

Perform actions on Real-time Response policies such as enabling/disabling or assigning to host groups.

Invoke-FalconResponsePolicyAction

Invoke-FalconResponsePolicyAction -Name <string> [[-GroupId] <string>] -Id <string>

Parameters

string

required

Action to performValid values: add-host-group, disable, enable, remove-host-group

string

Host group identifier. Pattern: ^[a-fA-F0-9]{32}$Required for: add-host-group, remove-host-group

string

required

Policy identifier. Pattern: ^[a-fA-F0-9]{32}$

Examples

Invoke-FalconResponsePolicyAction -Name enable -Id <policy_id>

Invoke-FalconResponsePolicyAction -Name add-host-group -GroupId <group_id> -Id <policy_id>

Invoke-FalconResponsePolicyAction -Name disable -Id <policy_id>

Get Policy Members

Search for members (hosts) assigned to Real-time Response policies.

Get-FalconResponsePolicyMember

Get-FalconResponsePolicyMember [[-Id] <string>] [[-Filter] <string>] [[-Sort] <string>] [[-Limit] <int>] [[-Offset] <int>] [-Detailed] [-All] [-Total]

Parameters

string

Policy identifier. Pattern: ^[a-fA-F0-9]{32}$

string

Falcon Query Language expression to limit results

string

Property and direction to sort results

int32

Maximum number of results per request (1-5000)

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

Get-FalconResponsePolicyMember -Id <policy_id> -Detailed -All

Set Policy Precedence

Set Real-time Response policy precedence order for a specific platform.

Set-FalconResponsePrecedence

Set-FalconResponsePrecedence -PlatformName <string> -Id <string[]>

Parameters

string

required

Operating system platformValid values: Windows, Mac, Linux

string[]

required

Policy identifiers in desired precedence order (highest to lowest priority). Pattern: ^[a-fA-F0-9]{32}$

All policy identifiers must be supplied in order, with the exception of the platform_default policy.

Example

$PolicyOrder = @('<policy_id_1>', '<policy_id_2>', '<policy_id_3>')
Set-FalconResponsePrecedence -PlatformName 'Windows' -Id $PolicyOrder

RTR Policy Settings

Real-time Response policies control which commands are available during RTR sessions. Common settings include:

Basic Commands: Always available (e.g., ls, cd, ps)
Get Commands: File retrieval from endpoints
Put Commands: File upload to endpoints
RunScript Commands: Execute scripts on endpoints
Admin Commands: Advanced system commands (e.g., registry modifications)

Grant RTR permissions carefully. Higher privilege levels allow significant system changes and should be restricted to authorized administrators.

Prevention Policies

Manage Prevention policies

Firewall Policies

Configure firewall rules and policies

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Response Policies

Overview

Get Response Policies

Parameters

Examples

Create Response Policy

Parameters

Examples

Edit Response Policy

Parameters

Examples

Remove Response Policy

Parameters

Example

Policy Actions

Parameters

Examples

Get Policy Members

Parameters

Example

Set Policy Precedence

Parameters

Example

RTR Policy Settings

Prevention Policies

Firewall Policies

​Overview

​Get Response Policies

​Parameters

​Examples

​Create Response Policy

​Parameters

​Examples

​Edit Response Policy

​Parameters

​Examples

​Remove Response Policy

​Parameters

​Example

​Policy Actions

​Parameters

​Examples

​Get Policy Members

​Parameters

​Example

​Set Policy Precedence

​Parameters

​Example

​RTR Policy Settings

​Related Resources

Prevention Policies

Firewall Policies

Overview

Get Response Policies

Parameters

Examples

Create Response Policy

Parameters

Examples

Edit Response Policy

Parameters

Examples

Remove Response Policy

Parameters

Example

Policy Actions

Parameters

Examples

Get Policy Members

Parameters

Example

Set Policy Precedence

Parameters

Example

RTR Policy Settings

Related Resources