Firewall Management - List of Operations and syntax examples for changing values

[lichtd04]

Hi Everyone, working to move our FW rules in our cs environment to infrastructure as code and need to get a list of the options available for us to create, update and remove rules with syntax examples. I'm not able to find what I am looking for at the moment.

[jshcodes]

Hi @lichtd04 -

Start here and let us know what questions you have?

[lichtd04]

Thanks @jshcodes for the info that helped to understand the issue. This still brings me to a stopper as there is no documentation on the json operations for changing rules. There are no examples available for someone to "figure" out how to change/delete rules... Unless I am missing it...

diff_rule = {
    "action": "BLOCK",
}

versions = [2]

rules = ["RULE_ID_HERE"]

response = falcon.update_rule_group(

                                    diff_operations=diff_rule,
                                    id="REDACTED",
                                    rule_ids=rules,
                                    rule_versions=versions,
                                    tracking="Testing Updates 01"
                                    )

Error:
'errors': [{'code': 400, 'message': 'invalid JSON Patch operation'}]

[jshcodes]

Hi @lichtd04 -

We're working on a sample for you and will post it here once it's finished. 🧑‍💻

[lichtd04]

@jshcodes I'm still looking for an example on the format of the update_rule_group function.

I've gotten further with other items but the update_rule_group function is different than the create_rule_group function formatting.

import sys
import time
from falconpy import OAuth2
from falconpy import FirewallManagement

sys.path.append('C:/Users/lichtd04')
import apicred

clid = apicred.apiclient
clsec = apicred.apikey

class Crowdstrike_FirewallManagement:
    def __init__(self, client_id, client_secret):
        self.client_id = clid
        self.client_secret = clsec
        self.base_url = "https://api.crowdstrike.com"
        self.creds = {"client_id": self.client_id, "client_secret": self.client_secret}
        self.API_FirewallManagement = None
        self.API_Token_Expire = 0
        self.API_Token = self.Generate_Falcon_Token()

    def Generate_Falcon_Token(self):
        """ Authenticate to API and generate OAuth2 Token
        Params:
            None (Self)
        Returns:
            OAth2 Token (str)
        """
        falcon = OAuth2(client_id=self.client_id, client_secret=self.client_secret)
        response = falcon.token()
        API_token = response['body']['access_token']
        self.API_Token_Expire = (time.time()+response['body']['expires_in'])
        self.API_FirewallManagement = FirewallManagement(client_id=self.client_id, client_secret=self.client_secret)
        return

    def Refresh_Falcon_Token(self):
        """ Refresh OAth2 Token when lifespan is near expiry"""
        if (time.time() >= (self.API_Token_Expire - 500)):
            self.API_Token = self.Generate_Falcon_Token()
        return self.API_Token

    def Retrieve_All_Firewall_Rule_Group(self):
        self.Refresh_Falcon_Token()
        PARAMS = {'filter':"enabled:true"}
        response = self.API_FirewallManagement.query_rule_groups(filter=f"enabled:'true'")
        print(response)

    def Create_New_Firewall_Rule_Existing_Group(self,groupId):
        self.Refresh_Falcon_Token()
        # get tracking value
        response = self.API_FirewallManagement.get_rule_groups(ids=groupId)
        tracking_value = response["body"]["resources"][0]["tracking"]

        # need rule ids
        rule_ids = response["body"]["resources"][0]["rule_ids"]

        # print to check values are there.
        print("Tracking Value:" + tracking_value)
        print(rule_ids)

        # try to find version
        response = self.API_FirewallManagement.get_rules(ids=rule_ids)
        x = 0
        version_list = []
        while (x < len(rule_ids)):
            print(response["body"]["resources"][x]["version"])
            version_list.append(response["body"]["resources"][x]["version"])
            x += 1
        print("Version List Next:")
        print(version_list)
        null=""
        #try updating rule group
        response = self.API_FirewallManagement.update_rule_group(id=groupId,
                                        diff_type="application/json-patch+json",
                                        diff_operations=[{"op":"add",
                                            "path":"/rules/2",
                                            "value": {
                                                "name": "Test Rule 03",
                                                "description": "This is a test rule",
                                                "address_family": "IP4",
                                                "enabled": True,
                                                "action": "ALLOW",
                                                "direction": "IN",
                                                "monitor": null,
                                                "protocol": "6",

                                                "platform_ids": [
                                                    "0"
                                                ],
                                                "icmp": null,
                                                "fields": [
                                                    {
                                                        "name": "network_location",
                                                        "type": "set",
                                                        "values": [
                                                            "ANY"
                                                        ]
                                                    }
                                                ],
                                                "temp_id": "2"
                                            }}],
                                        rule_ids=rule_ids,
                                        rule_versions=version_list,
                                        tracking=tracking_value)
        print(response["body"]["resources"])
        print(response["body"]["errors"])



Main = Crowdstrike_FirewallManagement(clid,clsec)

#Main.Retrieve_All_Firewall_Rule_Group()
Main.Create_New_Firewall_Rule_Existing_Group(groupId="REDACTED")

Errors: [{'code': 400, 'message': 'Provided rule data unable to create rule.'}]

[jshcodes]

Hi @lichtd04 -

Thank you for your patience. We've posted a sample (Firedrill) that creates a rule group, adds rules, updates them, then deletes them to demonstrate these operations.

We've also reviewed the code above and believe we are receiving this message due to our passing the variable null for the monitor and icmp fields.

The posted Firedrill sample also shows examples of the expected format for the monitor and icmp keys.

Quick note: You can authenticate directly to the FirewallManagement Service Class without creating an instance of the OAuth2 Service Class in this scenario. You also should not need to specify your base_url or calculate the token expiration as these are done for you.