Overview
Firewall Management policies control network traffic on endpoints through the Falcon platform. These policies work in conjunction with firewall rules to define allowed and blocked network connections across your environment.Required API Scope:
Firewall management: Read (for read operations) or Firewall management: Write (for write operations)Get Firewall Policies
Search for and retrieve Falcon Firewall Management policies.Get-FalconFirewallPolicy
Parameters
Policy identifier(s). Pattern:
^[a-fA-F0-9]{32}$Falcon Query Language (FQL) expression to limit resultsExample:
platform_name:'Windows'+enabled:trueProperty and direction to sort resultsValid values:
created_by.asc, created_by.desc, created_timestamp.asc, created_timestamp.desc, enabled.asc, enabled.desc, modified_by.asc, modified_by.desc, modified_timestamp.asc, modified_timestamp.desc, name.asc, name.desc, platform_name.asc, platform_name.desc, precedence.asc, precedence.descMaximum number of results per request (1-5000)
Include additional propertiesValid values:
members, settingsPosition to begin retrieving results
Retrieve detailed information
Repeat requests until all available results are retrieved
Display total result count instead of results
Examples
Create Firewall Policy
Create new Falcon Firewall Management policies.New-FalconFirewallPolicy
Parameters
Policy name
Operating system platformValid values:
Windows, Mac, LinuxPolicy description
One or more policies to create in a single request (for batch operations, max 100 per request)
Examples
After creating a firewall policy, you must assign firewall rule groups to it using policy actions and create/configure the actual firewall rules separately.
Edit Firewall Policy
Modify existing Falcon Firewall Management policies.Edit-FalconFirewallPolicy
Parameters
Policy identifier. Pattern:
^[a-fA-F0-9]{32}$Policy name
Policy description
One or more policies to modify in a single request (for batch operations, max 100 per request)
Examples
Remove Firewall Policy
Remove Falcon Firewall Management policies.Remove-FalconFirewallPolicy
Parameters
Policy identifier(s) to remove. Pattern:
^[a-fA-F0-9]{32}$Example
Policy Actions
Perform actions on Falcon Firewall Management policies such as enabling/disabling or assigning to host groups.Invoke-FalconFirewallPolicyAction
Parameters
Action to performValid values:
add-host-group, disable, enable, remove-host-groupHost group identifier. Pattern:
^[a-fA-F0-9]{32}$Required for: add-host-group, remove-host-groupPolicy identifier. Pattern:
^[a-fA-F0-9]{32}$Examples
Get Policy Members
Search for members (hosts) assigned to Falcon Firewall Management policies.Get-FalconFirewallPolicyMember
Parameters
Policy identifier. Pattern:
^[a-fA-F0-9]{32}$Falcon Query Language expression to limit results
Property and direction to sort results
Maximum number of results per request (1-5000)
Position to begin retrieving results
Retrieve detailed information
Repeat requests until all available results are retrieved
Display total result count instead of results
Example
Set Policy Precedence
Set Falcon Firewall Management policy precedence order for a specific platform.Set-FalconFirewallPrecedence
Parameters
Operating system platformValid values:
Windows, Mac, LinuxPolicy identifiers in desired precedence order (highest to lowest priority). Pattern:
^[a-fA-F0-9]{32}$All policy identifiers must be supplied in order, with the exception of the
platform_default policy.Example
Firewall Policy Architecture
Firewall Management policies in Falcon work with several related components:- Firewall Policies: Container for firewall configuration and rule assignments
- Firewall Rule Groups: Collections of firewall rules
- Firewall Rules: Individual rules defining network traffic permissions
Use Cases
Segment Network Traffic
Segment Network Traffic
Create firewall policies with different rule sets for workstations, servers, and specialized systems to implement network segmentation.
Compliance Requirements
Compliance Requirements
Define firewall policies that meet compliance standards (PCI-DSS, HIPAA, etc.) and assign them to relevant host groups.
Zero Trust Architecture
Zero Trust Architecture
Implement default-deny policies with explicit allow rules for authorized connections, supporting zero trust network principles.
DMZ Protection
DMZ Protection
Create restrictive firewall policies for DMZ hosts that allow only necessary inbound and outbound connections.
Related Resources
Prevention Policies
Manage Prevention policies
Device Control Policies
Control USB and Bluetooth device usage