Firewall Management

Command	Permission
Edit-FalconFirewallGroup
Edit-FalconFirewallPolicy
Edit-FalconFirewallSetting
Get-FalconFirewallEvent
Get-FalconFirewallField
Get-FalconFirewallGroup
Get-FalconFirewallPlatform
Get-FalconFirewallPolicy
Get-FalconFirewallPolicyMember
Get-FalconFirewallRule
Get-FalconFirewallSetting
Invoke-FalconFirewallPolicyAction
New-FalconFirewallGroup
New-FalconFirewallPolicy
Remove-FalconFirewallGroup
Remove-FalconFirewallPolicy
Set-FalconFirewallPrecedence

Finding details about firewall policy properties

List available firewall platforms

Get-FalconFirewallPlatform -Detailed

List available firewall fields

Get-FalconFirewallField -Detailed

Managing firewall rule groups

Creating firewall rule groups

The -Rules parameter accepts a PowerShell array of rule objects which are converted to Json before submission.

$Rules = @(
    @{
        name = 'Block IP'
        description = 'Block outbound to example.com IP address'
        platform_ids = @( '0' )
        enabled = $true
        action = 'DENY'
        direction = 'OUT'
        address_family = 'IP4'
        protocol = '*'
        fields = @(
            @{
                name = 'network_location'
                type = 'set'
                values = @( 'ANY' )
            }
        )
        local_address = @(@{ address = '*'; netmask = 0 })
        remote_address = @(@{ address = '93.184.216.34'; netmask = 32 })
    }
)
New-FalconFirewallGroup -Name 'test rule group' -Enabled $true -Description 'describing a rule group' -Rules $Rules

Finding rule IDs in a firewall rule group

Get-FalconFirewallGroup -Ids <id>, <id>

Finding information about firewall rules

Get-FalconFirewallRule -Ids <id>, <id>

Enable a firewall rule group

$DiffOperations = @(@{ op = 'replace'; path = '/enabled'; value = $true })
Edit-FalconFirewallGroup -Id <id> -DiffOperations $DiffOperations

Add a rule at the beginning of a firewall rule group

$DiffOperations = @(
    @{
        op = 'add'
        path = '/rules/0'
        value = @{
            temp_id = '1'
            name = 'First rule in a group'
            description = 'Example'
            platform_ids = @('0')
            enabled = $false
            action = 'ALLOW'
            direction = 'IN'
            address_family = 'NONE'
            protocol = '6'
            fields = @(
                @{
                    name = 'network_location'
                    type = 'set'
                    values = @( 'ANY' )
                }
            )
            local_address = @(@{ address = '*'; netmask = 0 })
            remote_address = @(@{ address = '*'; netmask = 0 })
        }
    }
)
$Group = Get-FalconFirewallGroup -Ids <id>
$Rules = Get-FalconFirewallRule -Ids $Group.rule_ids
$RuleIds = @('1') + $Group.rule_ids
$RuleVersions = @('null') + $Rules.version
Edit-FalconFirewallGroup -Id $Group.id -DiffOperations $DiffOperations -RuleIds $RuleIds -RuleVersions $RuleVersions

Deleting firewall rule groups

Remove-FalconFirewallGroup -Ids <id>, <id>

Managing firewall policies

Find information about a policy

Get-FalconFirewallPolicy -Ids <id>, <id>

View policy settings

Get-FalconFirewallSetting -Ids <id>, <id>

List IDs of firewall policy members

Get-FalconFirewallPolicyMember -Id <id> [-All]

Creating firewall policies

New-FalconFirewallPolicy -PlatformName Windows -Name 'Test Policy' -Description 'Firewall test policy'

Updating firewall policies

Edit-FalconFirewallPolicy -Id <id> -Name 'Test Policy 1 Name Changed'

Modify firewall policy settings

Edit-FalconFirewallSetting -PolicyId <id> -Enforce $true -DefaultInbound DENY -DefaultOutbound ALLOW

Copying firewall policies

New-FalconFirewallPolicy -PlatformName Windows -Name 'Cloned Test Policy' -Description 'Firewall test cloned policy' -CloneId <id>

Enabling firewall policies

Invoke-FalconFirewallPolicyAction -Name enable -Id <id>

Assigning host groups to a policy

Invoke-FalconFirewallPolicyAction -Name add-host-group -Id <id> -GroupId <id>

Disabling firewall policies

Invoke-FalconFirewallPolicyAction -Name disable -Id <id>

Deleting firewall policies

Remove-FalconFirewallPolicy -Ids <id>, <id>

Managing firewall policy precedence

NOTE: All policy ids (with the exception of platform_default) must be supplied in desired precedence order.

Set-FalconFirewallPrecedence -PlatformName Windows -Ids <id1>, <id2>, <id3>, <id4>

Finding firewall rule events

List firewall rule events

Get-FalconFirewallEvent [-Detailed] [-All]

Find information about an event

Get-FalconFirewallEvent -Ids <id>, <id>