Skip to content
CrowdStrike Developer Center

Firewall Management

The Firewall Management service collection provides operations for managing firewall policies, rule groups, rules, network locations, and related entities. Aggregate event and rule data, manage policy containers, create and update rule groups, and query firewall configuration.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
aggregate-events
aggregate_events		Aggregate events for customer
aggregate-policy-rules
aggregate_policy_rules		Aggregate rules within a policy for customer
aggregate-rule-groups
aggregate_rule_groups		Aggregate rule groups for customer
aggregate-rules
aggregate_rules		Aggregate rules for customer
create-network-locations
create_network_locations		Create new network locations provided, and return the ID.
create-rule-group
create_rule_group		Create new rule group on a platform for a customer with a name and description, and return the ID
create-rule-group-validation
create_rule_group_validation		Validates the request of creating a new rule group on a platform for a customer with a name and description
delete-network-locations
delete_network_locations		Delete network location entities by ID.
delete-rule-groups
delete_rule_groups		Delete rule group entities by ID
get-events
get_events		Get events entities by ID and optionally version
get-firewall-fields
get_firewall_fields		Get the firewall field specifications by ID
get-network-locations
get_network_locations		Get a summary of network locations entities by ID
get-network-locations-details
get_network_locations_details		Get network locations entities by ID
get-platforms
get_platforms		Get platforms by ID, e.g., windows or mac or droid
get-policy-containers
get_policy_containers		Get policy container entities by policy ID
get-rule-groups
get_rule_groups		Get rule group entities by ID.
get-rules
get_rules		Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)
query-events
query_events		Find all event IDs matching the query with filter
query-firewall-fields
query_firewall_fields		Get the firewall field specification IDs for the provided platform
query-network-locations
query_network_locations		Get a list of network location IDs
query-platforms
query_platforms		Get the list of platform names
query-policy-rules
query_policy_rules		Find all firewall rule IDs matching the query with filter, and return them in precedence order
query-rule-groups
query_rule_groups		Find all rule group IDs matching the query with filter
query-rules
query_rules		Find all rule IDs matching the query with filter
update-network-locations
update_network_locations		Updates the network locations provided, and return the ID.
update-network-locations-metadata
update_network_locations_metadata		Updates the network locations metadata such as polling_intervals for the cid
update-network-locations-precedence
update_network_locations_precedence		Updates the network locations precedence according to the list of ids provided.
update-policy-container
update_policy_container		Update an identified policy container, including local logging functionality.
update-policy-container-v1
update_policy_container_v1		Update an identified policy container.
update-rule-group
update_rule_group		Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
update-rule-group-validation
update_rule_group_validation		Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
upsert-network-locations
upsert_network_locations		Updates the network locations provided, and return the ID.
validate-filepath-pattern
validate_filepath_pattern		Validates that the test pattern matches the executable filepath glob pattern.

aggregate-events

Section titled “aggregate-events”

Aggregate events for customer

Method POST
Route /fwmgr/aggregates/events/GET/v1
Scope Firewall management: WRITE
PEP 8 aggregate_events

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_events(date_ranges=date_ranges,
                                   exclude="string",
                                   field="string",
                                   filter="string",
                                   from=integer,
                                   include="string",
                                   interval="string",
                                   max_doc_count=integer,
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   sub_aggregates=["string"],
                                   time_zone="string",
                                   type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

aggregate-policy-rules

Section titled “aggregate-policy-rules”

Aggregate rules within a policy for customer

Method POST
Route /fwmgr/aggregates/policy-rules/GET/v1
Scope Firewall management: WRITE
PEP 8 aggregate_policy_rules

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_policy_rules(date_ranges=date_ranges,
                                         exclude="string",
                                         field="string",
                                         filter="string",
                                         from=integer,
                                         include="string",
                                         interval="string",
                                         max_doc_count=integer,
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         sub_aggregates=["string"],
                                         time_zone="string",
                                         type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

aggregate-rule-groups

Section titled “aggregate-rule-groups”

Aggregate rule groups for customer

Method POST
Route /fwmgr/aggregates/rule-groups/GET/v1
Scope Firewall management: WRITE
PEP 8 aggregate_rule_groups

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_rule_groups(date_ranges=date_ranges,
                                        exclude="string",
                                        field="string",
                                        filter="string",
                                        from=integer,
                                        include="string",
                                        interval="string",
                                        max_doc_count=integer,
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        sub_aggregates=["string"],
                                        time_zone="string",
                                        type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

aggregate-rules

Section titled “aggregate-rules”

Aggregate rules for customer

Method POST
Route /fwmgr/aggregates/rules/GET/v1
Scope Firewall management: WRITE
PEP 8 aggregate_rules

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
String. This method does not support body payload validation.
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_rules(date_ranges=date_ranges,
                                  exclude="string",
                                  field="string",
                                  filter="string",
                                  from=integer,
                                  include="string",
                                  interval="string",
                                  max_doc_count=integer,
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=ranges,
                                  size=integer,
                                  sort="string",
                                  sub_aggregates=["string"],
                                  time_zone="string",
                                  type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

create-network-locations

Section titled “create-network-locations”

Create new network locations provided, and return the ID.

Method POST
Route /fwmgr/entities/network-locations/v1
Scope Firewall management: WRITE
PEP 8 create_network_locations

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
connection_types body · object
Connections available at the location.
default_gateways body · array
List of available default gateways.
description body · string
Description of the location.
dhcp_servers body · array
List of available DHCP servers.
dns_resolution_targets body · object
Dictionary containing a list of DNS resolution targets.
dns_servers body · array
List of available DNS servers.
enabled body · boolean
Flag indicating if this location is enabled.
host_addresses body · array
List of available host addresses.
https_reachable_hosts body · object
Dictionary of hosts reachable via HTTPS at this location.
icmp_request_targets body · object
Dictionary of targets for ICMP monitoring requests.
name body · string
Name for this rule.
clone_id query · string
A network location ID from which to copy location. If this is provided then the body of the request is ignored.
add_fw_rules query · boolean
A boolean to determine whether the cloned location needs to be added to the same firewall rules that original location is added to.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


connection_types = {
    "wired": True,
    "wireless": {
        "enabled": True,
        "require_encryption": True,
        "ssids": [
            "string"
        ]
    }
}


dns_resolution_targets = {
    "targets": [
        {
            "hostname": "string",
            "ip_match": [
                "string"
            ]
        }
    ]
}


https_reachable_hosts = {
    "hostnames": [
        "string"
    ]
}


icmp_request_targets = {
    "targets": [
        "string"
    ]
}


response = falcon.create_network_locations(add_fw_rules=boolean,
                                           clone_id="string",
                                           comment="string",
                                           connection_types=connection_types,
                                           default_gateways=id_list,
                                           description="string",
                                           dhcp_servers=id_list,
                                           dns_resolution_targets=dns_resolution_targets,
                                           dns_servers=id_list,
                                           enabled=boolean,
                                           host_addresses=id_list,
                                           https_reachable_hosts=https_reachable_hosts,
                                           icmp_request_targets=icmp_request_targets,
                                           name="string")
print(response)
Responses
[
  {
    "cid": "string",
    "connection_types": {},
    "created_by": "string",
    "created_on": "string",
    "default_gateways": [],
    "description": "string",
    "dhcp_servers": [],
    "dns_resolution_targets": {},
    "dns_servers": [],
    "enabled": false,
    "host_addresses": [],
    "https_reachable_hosts": {},
    "icmp_request_targets": {},
    "id": "string",
    "metadata": {},
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "rule_count": 0
  }
]

create-rule-group

Section titled “create-rule-group”

Create new rule group on a platform for a customer with a name and description, and return the ID

Method POST
Route /fwmgr/entities/rule-groups/v1
Scope Firewall management: WRITE
PEP 8 create_rule_group

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
description body · string
Rule group description.
enabled body · boolean
Flag indicating if the rule group is enabled.
name body · string
Rule group name.
platform body · string
OS platform covered by rule.
rules body · array
Rule(s) in JSON format. Single dictionary or List of dictionaries.
clone_id query · string
A rule group ID from which to copy rules. If this is provided then the ‘rules’ property of the body is ignored.
library query · string
If this flag is set to true then the rules will be cloned from the clone_id from the CrowdStrike Firewal Rule Groups Library.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
action body · string
Rule action to perform. Overridden if ‘rules’ keyword is provided.
address_family body · string
Address type, String. Either ‘IP4’, ‘IP6’ or ‘NONE’. Overridden if ‘rules’ keyword is provided.
direction body · string
Traffic direction for created rule. Either ‘IN’, ‘OUT’ or ‘BOTH’. Overridden if ‘rules’ keyword is provided.
fields body · string
Fields to impact. Dictionary or list of dictionaries. Overridden if ‘rules’ keyword is provided.
icmp body · string
ICMP protocol options. Overridden if ‘rules’ keyword is provided.
local_address body · string
Local address and netmask detail. Dictionary or list of dictionaries. Overridden if ‘rules’ keyword is provided.
local_port body · string
Local port range. Dictionary or list of dictionaries. Overridden if ‘rules’ keyword is provided.
log body · string
Log rule matches. Overridden if ‘rules’ keyword is provided.
monitor body · string
Monitor count / period. Overridden if ‘rules’ keyword is provided.
protocol body · string
Integer protocol specified. Overridden if ‘rules’ keyword is provided. (TCP = 6, UDP = 17)
remote_address body · string
Remote address and netmask detail. Dictionary or list of dictionaries. Overridden if ‘rules’ keyword is provided.
remote_port body · string
Remote port range. Dictionary or list of dictionaries. Overridden if ‘rules’ keyword is provided.
rule_description body · string
Description for created rule. Overridden if ‘rules’ keyword is provided.
rule_enabled body · string
Enablement status for new rule. Overridden if ‘rules’ keyword is provided.
rule_name body · string
Name for the new rule. Overridden if ‘rules’ keyword is provided.
temp_id body · string
String to use for rule temporary ID. Overridden if ‘rules’ keyword is provided.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


rules = [
    {
        "action": "string",
        "address_family": "string",
        "description": "string",
        "direction": "string",
        "enabled": True,
        "fields": [
            {
                "final_value": "string",
                "label": "string",
                "name": "string",
                "type": "string",
                "value": "string",
                "values": [
                    "string"
                ]
            }
        ],
        "icmp": {
            "icmp_code": "string",
            "icmp_type": "string"
        },
        "local_address": [
            {
                "address": "string",
                "netmask": 0
            }
        ],
        "local_port": [
            {
                "end": 0,
                "start": 0
            }
        ],
        "log": True,
        "monitor": {
            "count": "string",
            "period_ms": "string"
        },
        "name": "string",
        "protocol": "string",
        "remote_address": [
            {
                "address": "string",
                "netmask": 0
            }
        ],
        "remote_port": [
            {
                "end": 0,
                "start": 0
            }
        ],
        "temp_id": "string"
    }
]


response = falcon.create_rule_group(action="string",
                                    address_family="string",
                                    clone_id="string",
                                    comment="string",
                                    description="string",
                                    direction="string",
                                    enabled=boolean,
                                    fields="string",
                                    icmp="string",
                                    library="string",
                                    local_address="string",
                                    local_port="string",
                                    log="string",
                                    name="string",
                                    monitor="string",
                                    platform="string",
                                    protocol="string",
                                    remote_address="string",
                                    remote_port="string",
                                    rule_description="string",
                                    rule_enabled="string",
                                    rule_name="string",
                                    rules=rules,
                                    temp_id="string")
print(response)
Responses
[
  "string"
]

create-rule-group-validation

Section titled “create-rule-group-validation”

Validates the request of creating a new rule group on a platform for a customer with a name and description

Method POST
Route /fwmgr/entities/rule-groups/validation/v1
Scope Firewall management: WRITE
PEP 8 create_rule_group_validation

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
description body · string
Description of the rule.
enabled body · boolean
Flag indicating if this rule is enabled.
name body · string
Name for this rule.
platform body · string
Platform name this rule applies to.
rules body · array
JSON formatted list of rules to validate.
clone_id query · string
A rule group ID from which to copy rules. If this is provided then the ‘rules’ property of the body is ignored.
library query · string
If this flag is set to true then the rules will be cloned from the clone_id from the CrowdStrike Firewall Rule Groups Library.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


rules = [
    {
        "action": "string",
        "address_family": "string",
        "description": "string",
        "direction": "string",
        "enabled": True,
        "fields": [
            {
                "final_value": "string",
                "label": "string",
                "name": "string",
                "type": "string",
                "value": "string",
                "values": [
                    "string"
                ]
            }
        ],
        "fqdn": "string",
        "fqdn_enabled": True,
        "icmp": {
            "icmp_code": "string",
            "icmp_type": "string"
        },
        "local_address": [
            {
                "address": "string",
                "netmask": 0
            }
        ],
        "local_port": [
            {
                "end": 0,
                "start": 0
            }
        ],
        "log": True,
        "monitor": {
            "count": "string",
            "period_ms": "string"
        },
        "name": "string",
        "protocol": "string",
        "remote_address": [
            {
                "address": "string",
                "netmask": 0
            }
        ],
        "remote_port": [
            {
                "end": 0,
                "start": 0
            }
        ],
        "temp_id": "string"
    }
]


response = falcon.create_rule_group_validation(clone_id="string",
                                               comment="string",
                                               description="string",
                                               enabled=boolean,
                                               library="string",
                                               name="string",
                                               platform="string",
                                               rules=rules)
print(response)
Responses
[
  "string"
]

delete-network-locations

Section titled “delete-network-locations”

Delete network location entities by ID.

Method DELETE
Route /fwmgr/entities/network-locations/v1
Scope Firewall management: WRITE
PEP 8 delete_network_locations

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the network locations to be deleted
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_network_locations(ids=id_list)
print(response)
Responses
[
  "string"
]

delete-rule-groups

Section titled “delete-rule-groups”

Delete rule group entities by ID

Method DELETE
Route /fwmgr/entities/rule-groups/v1
Scope Firewall management: WRITE
PEP 8 delete_rule_groups

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the rule groups to be deleted
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_rule_groups(ids=id_list)
print(response)
Responses
[
  "string"
]

get-events

Section titled “get-events”

Get events entities by ID and optionally version

Method GET
Route /fwmgr/entities/events/v1
Scope Firewall management: READ
PEP 8 get_events

Parameters

Section titled “Parameters”
ids query · string or list of strings
The events to retrieve, identified by ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_events(ids=id_list)
print(response)
Responses
[
  {
    "aid": "string",
    "cid": "string",
    "command_line": "string",
    "connection_direction": "string",
    "domain_name_list": "string",
    "event_type": "string",
    "flags": {},
    "hidden": false,
    "host_name": "string",
    "icmp_code": "string",
    "icmp_type": "string",
    "id": "string",
    "image_file_name": "string",
    "ipv": "string",
    "local_address": "string",
    "local_port": "string",
    "match_count": "string",
    "match_count_since_last_event": "string",
    "network_profile": "string",
    "pid": "string",
    "platform": "string",
    "policy_id": "string",
    "policy_name": "string",
    "protocol": "string",
    "remote_address": "string",
    "remote_port": "string",
    "rule_action": "string",
    "rule_description": "string",
    "rule_family_id": "string",
    "rule_group_name": "string",
    "rule_id": "string",
    "rule_name": "string",
    "status": "string",
    "timestamp": "string",
    "tree_id": "string"
  }
]

get-firewall-fields

Section titled “get-firewall-fields”

Get the firewall field specifications by ID

Method GET
Route /fwmgr/entities/firewall-fields/v1
Scope Firewall management: READ
PEP 8 get_firewall_fields

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the rule types to retrieve
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_firewall_fields(ids=id_list)
print(response)
Responses
[
  {
    "default_monitor": {},
    "id": "string",
    "platform": "string",
    "platform_fields": []
  }
]

get-network-locations

Section titled “get-network-locations”

Get a summary of network locations entities by ID

Method GET
Route /fwmgr/entities/network-locations/v1
Scope Firewall management: READ
PEP 8 get_network_locations

Parameters

Section titled “Parameters”
ids query · string or list of strings
The events to retrieve, identified by ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_network_locations(ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "enabled": false,
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "rule_count": 0
  }
]

get-network-locations-details

Section titled “get-network-locations-details”

Get network locations entities by ID

Method GET
Route /fwmgr/entities/network-locations-details/v1
Scope Firewall management: READ
PEP 8 get_network_locations_details

Parameters

Section titled “Parameters”
ids query · string or list of strings
The events to retrieve, identified by ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_network_locations_details(ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "connection_types": {},
    "created_by": "string",
    "created_on": "string",
    "default_gateways": [],
    "description": "string",
    "dhcp_servers": [],
    "dns_resolution_targets": {},
    "dns_servers": [],
    "enabled": false,
    "host_addresses": [],
    "https_reachable_hosts": {},
    "icmp_request_targets": {},
    "id": "string",
    "metadata": {},
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "rule_count": 0
  }
]

get-platforms

Section titled “get-platforms”

Get platforms by ID, e.g., windows or mac or droid

Method GET
Route /fwmgr/entities/platforms/v1
Scope Firewall management: READ
PEP 8 get_platforms

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the platforms to retrieve
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_platforms(ids=id_list)
print(response)
Responses
[
  {
    "id": "string",
    "label": "string"
  }
]

get-policy-containers

Section titled “get-policy-containers”

Get policy container entities by policy ID

Method GET
Route /fwmgr/entities/policies/v1
Scope Firewall management: READ
PEP 8 get_policy_containers

Parameters

Section titled “Parameters”
ids query · string or list of strings
The policy container(s) to retrieve, identified by policy ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_policy_containers(ids=id_list)
print(response)
Responses
[
  {
    "created_by": "string",
    "created_on": "string",
    "default_inbound": "string",
    "default_outbound": "string",
    "deleted": false,
    "enforce": false,
    "is_default_policy": false,
    "local_logging": false,
    "modified_by": "string",
    "modified_on": "string",
    "platform_id": "string",
    "policy_id": "string",
    "rule_group_ids": [],
    "test_mode": false,
    "tracking": "string"
  }
]

get-rule-groups

Section titled “get-rule-groups”

Get rule group entities by ID.

Method GET
Route /fwmgr/entities/rule-groups/v1
Scope Firewall management: READ
PEP 8 get_rule_groups

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the rule groups to retrieve
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_rule_groups(ids=id_list)
print(response)
Responses
[
  {
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "enabled": false,
    "id": "string",
    "modified_by": "string",
    "modified_on": "string",
    "name": "string",
    "platform": "string",
    "policy_ids": [],
    "rule_ids": [],
    "tracking": "string"
  }
]

get-rules

Section titled “get-rules”

Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)

Method GET
Route /fwmgr/entities/rules/v1
Scope Firewall management: READ
PEP 8 get_rules

Parameters

Section titled “Parameters”
ids query · string or list of strings
The rules to retrieve, identified by ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_rules(ids=id_list)
print(response)
Responses
[
  {
    "action": "string",
    "address_family": "string",
    "created_by": "string",
    "created_on": "string",
    "customer_id": "string",
    "deleted": false,
    "description": "string",
    "direction": "string",
    "enabled": false,
    "family": "string",
    "fields": [],
    "fqdn": "string",
    "fqdn_enabled": false,
    "icmp": {},
    "id": "string",
    "local_address": [],
    "local_port": [],
    "modified_by": "string",
    "modified_on": "string",
    "monitor": {},
    "name": "string",
    "platform_ids": [],
    "protocol": "string",
    "remote_address": [],
    "remote_port": [],
    "rule_group": {},
    "version": 0
  }
]

query-events

Section titled “query-events”

Find all event IDs matching the query with filter

Method GET
Route /fwmgr/queries/events/v1
Scope Firewall management: READ
PEP 8 query_events

Parameters

Section titled “Parameters”
sort query · string
FQL Syntax formatted sort filter.
filter query · string
FQL Syntax formatted filter that should be used to limit the results.
q query · string
Match query criteria, which includes all the filter string fields, plus TODO
offset query · string
Starting index of overall result set from which to return ids.
after query · string
A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_events(after="string",
                               filter="string",
                               limit=integer,
                               offset="string",
                               q="string",
                               sort="string")
print(response)
Responses
[
  "string"
]

query-firewall-fields

Section titled “query-firewall-fields”

Get the firewall field specification IDs for the provided platform

Method GET
Route /fwmgr/queries/firewall-fields/v1
Scope Firewall management: READ
PEP 8 query_firewall_fields

Parameters

Section titled “Parameters”
platform_id query · string
Get fields configuration for this platform
offset query · string
Starting index of overall result set from which to return ids.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_firewall_fields(platform_id="string",
                                        limit=integer,
                                        offset="string")
print(response)
Responses
[
  "string"
]

query-network-locations

Section titled “query-network-locations”

Get a list of network location IDs

Method GET
Route /fwmgr/queries/network-locations/v1
Scope Firewall management: READ
PEP 8 query_network_locations

Parameters

Section titled “Parameters”
sort query · string
FQL Syntax formatted sort filter.
filter query · string
FQL Syntax formatted filter that should be used to limit the results.
q query · string
Match query criteria, which includes all the filter string fields
offset query · string
Starting index of overall result set from which to return ids.
after query · string
A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_network_locations(after="string",
                                          filter="string",
                                          limit=integer,
                                          offset="string",
                                          q="string",
                                          sort="string")
print(response)
Responses
[
  "string"
]

query-platforms

Section titled “query-platforms”

Get the list of platform names

Method GET
Route /fwmgr/queries/platforms/v1
Scope Firewall management: READ
PEP 8 query_platforms

Parameters

Section titled “Parameters”
offset query · string
Starting index of overall result set from which to return ids.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_platforms(limit=integer, offset="string")
print(response)
Responses
[
  "string"
]

query-policy-rules

Section titled “query-policy-rules”

Find all firewall rule IDs matching the query with filter, and return them in precedence order

Method GET
Route /fwmgr/queries/policy-rules/v1
Scope Firewall management: READ
PEP 8 query_policy_rules

Parameters

Section titled “Parameters”
id query · string
The ID of the policy container within which to query
sort query · string
FQL Syntax formatted sort filter.
filter query · string
FQL Syntax formatted filter that should be used to limit the results.
q query · string
Match query criteria, which includes all the filter string fields, plus TODO
offset query · string
Starting index of overall result set from which to return ids.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
after body · string
A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_policy_rules(after="string",
                                     filter="string",
                                     limit=integer,
                                     offset="string",
                                     q="string",
                                     sort="string")
print(response)
Responses
[
  "string"
]

query-rule-groups

Section titled “query-rule-groups”

Find all rule group IDs matching the query with filter

Method GET
Route /fwmgr/queries/rule-groups/v1
Scope Firewall management: READ
PEP 8 query_rule_groups

Parameters

Section titled “Parameters”
sort query · string
FQL Syntax formatted sort filter.
filter query · string
FQL Syntax formatted filter that should be used to limit the results.
q query · string
Match query criteria, which includes all the filter string fields, plus TODO
offset query · string
Starting index of overall result set from which to return ids.
after query · string
A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_rule_groups(after="string",
                                    filter="string",
                                    limit=integer,
                                    offset="string",
                                    q="string",
                                    sort="string")
print(response)
Responses
[
  "string"
]

query-rules

Section titled “query-rules”

Find all rule IDs matching the query with filter

Method GET
Route /fwmgr/queries/rules/v1
Scope Firewall management: READ
PEP 8 query_rules

Parameters

Section titled “Parameters”
sort query · string
FQL Syntax formatted sort filter.
filter query · string
FQL Syntax formatted filter that should be used to limit the results.
q query · string
Match query criteria, which includes all the filter string fields, plus TODO
offset query · string
Starting index of overall result set from which to return ids.
after query · string
A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit query · integer
Number of ids to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.query_rules(after="string",
                              filter="string",
                              limit=integer,
                              offset="string",
                              q="string",
                              sort="string")
print(response)
Responses
[
  "string"
]

update-network-locations

Section titled “update-network-locations”

Updates the network locations provided, and return the ID.

Method PATCH
Route /fwmgr/entities/network-locations/v1
Scope Firewall management: WRITE
PEP 8 update_network_locations

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
connection_types body · object
Connections available at the location.
created_by body · string
created_on body · string
Timestamp.
default_gateways body · array
List of available default gateways.
description body · string
Description of the location.
dhcp_servers body · array
List of available DHCP servers.
dns_resolution_targets body · object
Dictionary containing a list of DNS resolution targets.
dns_servers body · array
List of available DNS servers.
enabled body · boolean
Flag indicating if this location is enabled.
host_addresses body · array
List of available host addresses.
https_reachable_hosts body · object
Dictionary of hosts reachable via HTTPS at this location.
icmp_request_targets body · object
Dictionary of targets for ICMP monitoring requests.
id body · string
Network location ID to be updated.
modified_by body · string
User UUID that modified this location.
modified_on body · string
UTC formatted date string of the update.
name body · string
Name for this rule.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


connection_types = {
    "wired": True,
    "wireless": {
        "enabled": True,
        "require_encryption": True,
        "ssids": [
            "string"
        ]
    }
}


dns_resolution_targets = {
    "targets": [
        {
            "hostname": "string",
            "ip_match": [
                "string"
            ]
        }
    ]
}


https_reachable_hosts = {
    "hostnames": [
        "string"
    ]
}


icmp_request_targets = {
    "targets": [
        "string"
    ]
}


response = falcon.update_network_locations(comment="string",
                                           connection_types=connection_types,
                                           created_on="string",
                                           created_by="string",
                                           default_gateways=id_list,
                                           description="string",
                                           dhcp_servers=id_list,
                                           dns_resolution_targets=dns_resolution_targets,
                                           dns_servers=id_list,
                                           enabled=boolean,
                                           host_addresses=id_list,
                                           https_reachable_hosts=https_reachable_hosts,
                                           icmp_request_targets=icmp_request_targets,
                                           id="string",
                                           modified_by="string",
                                           modified_on="string",
                                           name="string")
print(response)
Responses
[
  "string"
]

update-network-locations-metadata

Section titled “update-network-locations-metadata”

Updates the network locations metadata such as polling_intervals for the cid

Method POST
Route /fwmgr/entities/network-locations-metadata/v1
Scope Firewall management: WRITE
PEP 8 update_network_locations_metadata

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
cid body · string
CID for the location.
dns_resolution_targets_polling_interval body · integer
https_reachable_hosts_polling_interval body · integer
icmp_request_targets_polling_interval body · integer
location_precedence body · array
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
https_reachable_hsots_polling_interval body · integer
location_precedencee body · list of strings
Reorder precedence of network locations.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.update_network_locations_metadata(cid="string",
                                                    comment="string",
                                                    dns_resolution_targets_polling_interval=integer,
                                                    https_reachable_hsots_polling_interval=integer,
                                                    icmp_request_targets_polling_interval=integer,
                                                    location_precedencee=["string"])
print(response)
Responses
[
  "string"
]

update-network-locations-precedence

Section titled “update-network-locations-precedence”

Updates the network locations precedence according to the list of ids provided.

Method POST
Route /fwmgr/entities/network-locations-precedence/v1
Scope Firewall management: WRITE
PEP 8 update_network_locations_precedence

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
cid body · string
CID for the location.
location_precedence body · array
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
location_precedencee body · list of strings
Reorder precedence of network locations.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.update_network_locations_precedence(cid="string",
                                                      comment="string",
                                                      location_precedencee=["string"])
print(response)
Responses
[
  "string"
]

update-policy-container

Section titled “update-policy-container”

Update an identified policy container, including local logging functionality.

Method PUT
Route /fwmgr/entities/policies/v2
Scope Firewall management: WRITE
PEP 8 update_policy_container

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
default_inbound body · string
Default inbound.
default_outbound body · string
Default outbound.
enforce body · boolean
Flag indicating if the policy is enforced.
is_default_policy body · boolean
Flag indicating if the policy is the default.
local_logging body · boolean
Flag indicating if local logging functionality is enabled.
platform_id body · string
Platform ID. (windows, mac, linux)
policy_id body · string
ID of the policy to be updated.
rule_group_ids body · array
Rule group IDs this policy applies to.
test_mode body · boolean
Flag indicating if this policy is in test mode.
tracking body · string
Tracking.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_policy_container(default_inbound="string",
                                          default_outbound="string",
                                          enforce=boolean,
                                          is_default_policy=boolean,
                                          local_logging=boolean,
                                          platform_id="string",
                                          policy_id="string",
                                          rule_group_ids=id_list,
                                          test_mode=boolean,
                                          tracking="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

update-policy-container-v1

Section titled “update-policy-container-v1”

Update an identified policy container.

Method PUT
Route /fwmgr/entities/policies/v1
Scope Firewall management: WRITE
PEP 8 update_policy_container_v1

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
default_inbound body · string
Default inbound.
default_outbound body · string
Default outbound.
enforce body · boolean
Flag indicating if the policy is enforced.
is_default_policy body · boolean
Flag indicating if the policy is the default.
local_logging body · boolean
Flag indicating if local logging should be enabled.
platform_id body · string
Platform ID. (windows, mac, linux)
policy_id body · string
ID of the policy to be updated.
rule_group_ids body · array
Rule group IDs this policy applies to.
test_mode body · boolean
Flag indicating if this policy is in test mode.
tracking body · string
Tracking.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_policy_container_v1(default_inbound="string",
                                             default_outbound="string",
                                             enforce=boolean,
                                             is_default_policy=boolean,
                                             local_logging=boolean,
                                             platform_id="string",
                                             policy_id="string",
                                             rule_group_ids=id_list,
                                             test_mode=boolean,
                                             tracking="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

update-rule-group

Section titled “update-rule-group”

Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules

Method PATCH
Route /fwmgr/entities/rule-groups/v1
Scope Firewall management: WRITE
PEP 8 update_rule_group

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
diff_operations body · array
Diff operations to perform against the rule group. Single.
diff_type body · string
Type of diff to apply.
id body · string
ID of the rule group to update.
rule_ids body · array
Rule ID(s)
rule_versions body · array
Rule version(s)
tracking body · string
Tracking.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
diff_from body · string
From value for diff. Overridden if ‘diff_operations’ is provided.
diff_op body · string
Operation for diff. Overridden if ‘diff_operations’ is provided.
diff_path body · string
Path for diff. Overridden if ‘diff_operations’ is provided.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_rule_group(comment="string",
                                    diff_from="string",
                                    diff_op="string",
                                    diff_operations=["string"],
                                    diff_path="string",
                                    diff_type="string",
                                    id="string",
                                    rule_ids=id_list,
                                    rule_versions=[integer],
                                    tracking="string")
print(response)
Responses
[
  "string"
]

update-rule-group-validation

Section titled “update-rule-group-validation”

Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules

Method PATCH
Route /fwmgr/entities/rule-groups/validation/v1
Scope Firewall management: WRITE
PEP 8 update_rule_group_validation

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
diff_operations body · array
Diff operations to perform against the rule group. Single.
diff_type body · string
Type of diff to apply.
id body · string
ID of the rule group to update.
rule_ids body · array
Rule ID(s)
rule_versions body · array
Rule version(s)
tracking body · string
Tracking.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
diff_from body · string
From value for diff. Overridden if ‘diff_operations’ is provided.
diff_op body · string
Operation for diff. Overridden if ‘diff_operations’ is provided.
diff_path body · string
Path for diff. Overridden if ‘diff_operations’ is provided.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.update_rule_group_validation(comment="string",
                                               diff_from="string",
                                               diff_op="string",
                                               diff_operations=["string"],
                                               diff_path="string",
                                               diff_type="string",
                                               id="string",
                                               rule_ids=id_list,
                                               rule_versions=[integer],
                                               tracking="string")
print(response)
Responses
[
  "string"
]

upsert-network-locations

Section titled “upsert-network-locations”

Updates the network locations provided, and return the ID.

Method PUT
Route /fwmgr/entities/network-locations/v1
Scope Firewall management: WRITE
PEP 8 upsert_network_locations

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
connection_types body · object
Connections available at the location.
created_by body · string
created_on body · string
Timestamp.
default_gateways body · array
List of available default gateways.
description body · string
Description of the location.
dhcp_servers body · array
List of available DHCP servers.
dns_resolution_targets body · object
Dictionary containing a list of DNS resolution targets.
dns_servers body · array
List of available DNS servers.
enabled body · boolean
Flag indicating if this location is enabled.
host_addresses body · array
List of available host addresses.
https_reachable_hosts body · object
Dictionary of hosts reachable via HTTPS at this location.
icmp_request_targets body · object
Dictionary of targets for ICMP monitoring requests.
id body · string
Network location ID to be updated.
modified_by body · string
User UUID that modified this location.
modified_on body · string
UTC formatted date string of the update.
name body · string
Name for this rule.
comment query · string
Audit log comment for this action
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


connection_types = {
    "wired": True,
    "wireless": {
        "enabled": True,
        "require_encryption": True,
        "ssids": [
            "string"
        ]
    }
}


dns_resolution_targets = {
    "targets": [
        {
            "hostname": "string",
            "ip_match": [
                "string"
            ]
        }
    ]
}


https_reachable_hosts = {
    "hostnames": [
        "string"
    ]
}


icmp_request_targets = {
    "targets": [
        "string"
    ]
}


response = falcon.upsert_network_locations(comment="string",
                                           connection_types=connection_types,
                                           created_on="string",
                                           created_by="string",
                                           default_gateways=id_list,
                                           description="string",
                                           dhcp_servers=id_list,
                                           dns_resolution_targets=dns_resolution_targets,
                                           dns_servers=id_list,
                                           enabled=boolean,
                                           host_addresses=id_list,
                                           https_reachable_hosts=https_reachable_hosts,
                                           icmp_request_targets=icmp_request_targets,
                                           id="string",
                                           modified_by="string",
                                           modified_on="string",
                                           name="string")
print(response)
Responses
[
  "string"
]

validate-filepath-pattern

Section titled “validate-filepath-pattern”

Validates that the test pattern matches the executable filepath glob pattern.

Method POST
Route /fwmgr/entities/rules/validate-filepath/v1
Scope Firewall management: WRITE
PEP 8 validate_filepath_pattern

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
filepath_pattern body · string
Pattern to test against.
filepath_test_string body · string
File path string to be tested.
Code Examples
from falconpy import FirewallManagement


falcon = FirewallManagement(client_id=CLIENT_ID,
                            client_secret=CLIENT_SECRET
                            )


response = falcon.validate_filepath_pattern(filepath_pattern="string",
                                            filepath_test_string="string")
print(response)
Responses
[
  {
    "filepath_pattern": "string",
    "filepath_test_string": "string",
    "is_match": false
  }
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use