data_protection_policy

Manages a Falcon Data Protection policy for a single platform, including its settings, assigned host groups, and assigned classifications.

API Scopes

The following API scopes are required:

Data Protection: READ
Data Protection: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

resource "crowdstrike_data_protection_policy" "example" {
  platform_name = "Windows" # Valid values: "Windows", "Mac"
  name          = "engineering-endpoints"
  description   = "Data protection for engineering workstations"
  enabled       = true

  host_groups     = [crowdstrike_host_group.engineering.id]
  classifications = ["3a1b5c7d9e0f42a8b6c4d2e0f8a6b4c2"]

  content_inspection    = true
  context_inspection    = true
  clipboard_inspection  = true
  inspection_depth      = "balanced"
  inspection_confidence = "medium"
}

Schema

Required

name (String) Name of the policy.
platform_name (String) Platform the policy applies to. Accepts Windows or Mac. Changing this causes a replace.

Optional

be_custom_splash_message (String) Custom text for the browser extension splash dialog. Omit the attribute to use the Falcon default text, Processing. Please wait..
be_exclude_domains (Set of String) Domain patterns excluded from visibility and enforcement by the Falcon browser extension, for example *://*.example.com/*. No events are generated from excluded domains. These are the tags in the console’s Exclude domains control.

The patterns are stored as a single comma-separated value that must be at most 2048 characters. Omit the attribute to exclude no domains; an explicitly empty set is rejected.

be_paste_clipboard_block_over_max_size (Boolean) When true, pastes exceeding be_paste_clipboard_max_size are blocked regardless of content. Defaults to false.
be_paste_clipboard_max_size (Number) Maximum clipboard payload size evaluated on paste, expressed in be_paste_clipboard_max_size_unit. Must be greater than 0 and at most 65536 regardless of the unit. Defaults to 0.0625, which with the default unit of KiB is 64 bytes.
be_paste_clipboard_max_size_unit (String) Unit for be_paste_clipboard_max_size. Accepts Bytes or KiB. Defaults to KiB.
be_paste_clipboard_min_size (Number) Minimum clipboard payload size evaluated on paste, expressed in be_paste_clipboard_min_size_unit. Must be greater than 0 and at most 65536 regardless of the unit. Defaults to 32, which with the default unit of Bytes is 32 bytes.
be_paste_clipboard_min_size_unit (String) Unit for be_paste_clipboard_min_size. Accepts Bytes or KiB. Defaults to Bytes.
be_paste_timeout_milliseconds (Number) How long the browser extension waits for a response when pasting data before timing out, in milliseconds. Must be between 1 and 10000. Defaults to 800.
be_paste_timeout_response (String) Extension behavior when a paste evaluation times out. allow fails open, block fails closed. Defaults to allow.
be_splash_screen (Boolean) Whether the browser extension shows a splash screen while a file is being evaluated. Defaults to true.
be_upload_timeout_response (String) Extension behavior when an upload evaluation times out. allow fails open, block fails closed. Defaults to allow.
be_upload_timeout_seconds (Number) How long the browser extension waits for a response when uploading data before timing out, in seconds. Must be between 1 and 300. Defaults to 40.
block_all_data_access (Boolean) Windows only. Blocks all data access via Firefox and Internet Explorer. Requires browsers_without_active_extension to be block_policy. Defaults to false.
browsers_without_active_extension (String) Windows only. How browsers without an active Falcon extension handle data uploads, including Firefox, Internet Explorer, and incognito sessions. allow permits all uploads; block_policy blocks uploads matching a classification. Defaults to allow.

~> Note On Mac, uploads from browsers without the extension active are neither monitored nor blocked, so Mac policies have no equivalent setting.

classifications (Set of String) Classification IDs assigned to this policy. Omit the attribute to assign no classifications; an explicitly empty set is rejected.
clipboard_inspection (Boolean) Detects egress when classified data is pasted from the clipboard in supported browsers. Defaults to false.
clipboard_web_origin (Boolean) Tracks and attributes web sources for clipboard content copied from web applications. Requires context_inspection to be true. Defaults to false.
content_inspection (Boolean) Inspects egressing data against the content patterns used by this policy’s classifications. Defaults to true.
context_inspection (Boolean) Gives insight into data sources, assigned sensitivity labels, and file types, for data in motion and at rest. Defaults to true.
custom_allowed_action_notification (String) Custom text shown to end users when a rule allows an action. Omit the attribute to use the Falcon default text, An action has been allowed and logged by your organization's data protection policy..
custom_blocked_action_notification (String) Custom text shown to end users when a rule blocks an action. Omit the attribute to use the Falcon default text, An action has been blocked by your organization's data protection policy..
description (String) Description of the policy.
enable_ocr (Boolean) Mac only. Extracts and classifies sensitive text from image files such as screenshots and photos during data egress. Requires content_inspection to be true. Defaults to true.
enabled (Boolean) Whether the policy is enabled. Defaults to false.
end_user_encryption_activity (Boolean) Windows only. When data encryption occurs, stores a copy of the original data in a protected folder on the host so it remains retrievable for 30 days. Requires evidence_storage to be true. Defaults to false.
euj_business_purposes_enabled (Boolean) Whether the built-in Business purposes option is offered in the end user justification dialog. Its text is fixed by Falcon. At least two options in total must be enabled. Defaults to true.
euj_company_logo (String) Company logo shown in the end user justification dialog, as a base64 PNG data URI. The image must be 100px by 100px with a transparent background.
euj_custom_dropdown_options (List of String) Custom justification options offered in the end user justification dialog, shown after the two built-in options in the order defined here. At most two may be defined. In the Falcon console these are the rows added with Add custom justification under EUJ dialog box > Dropdown options.

At least two options in total, built-in or custom, must be enabled.

euj_custom_header_text (String) Custom header text for the end user justification dialog. Omit the attribute to use the built-in Falcon message.
euj_dialog_timeout (Number) Timeout for the end user justification dialog, in seconds. Must be between 60 and 420. If the user provides no justification the egress is blocked. Defaults to 120.
euj_personal_use_enabled (Boolean) Whether the built-in Personal use option is offered in the end user justification dialog. Its text is fixed by Falcon. At least two options in total must be enabled. Defaults to true.
euj_require_additional_details (Boolean) When true, the end user must fill in the additional details box to proceed with a justification. Defaults to true.
evidence_storage (Boolean) Windows only. Allows users with the Data Protection Forensics Manager role to request and download files for egress events. Files larger than max_file_size cannot be retrieved. Defaults to false.
evidence_storage_max_free_space_percent (Number) Windows only. Maximum percentage of free disk space evidence storage may consume. Must be between 1 and 90. The smaller of this and evidence_storage_max_size_gib takes priority. Requires evidence_storage to be true. Defaults to 2.
evidence_storage_max_size_gib (Number) Windows only. Maximum disk space in GiB that evidence storage may use on a host. Must be between 1 and 100. When full, files are deleted first-in first-out. Requires evidence_storage to be true. Defaults to 1.
host_groups (Set of String) Host group IDs assigned to this policy. Omit the attribute to assign no host groups; an explicitly empty set is rejected.
inspection_confidence (String) Minimum confidence level for reporting content matches. low reports more matches, high reports only high-confidence matches. Requires content_inspection to be true. Defaults to medium.
inspection_depth (String) Inspection depth for data in motion. Requires content_inspection to be true. Defaults to balanced.
max_file_size (Number) Largest file the sensor inspects for classified content, expressed in max_file_size_unit. Files above this size are not assessed against classification definitions. Defaults to 104857600 bytes (100 MiB).

The accepted range depends on the unit, because the value must be between 512 and 524288000 as written and at most 524288000 bytes (500 MiB) once converted: 512 to 524288000 for Bytes, 512 to 524288 for KB, and 512 to 524.288 for MB. Bytes is the only unit that can express the whole range.

The console shows this control in MiB, so a console value of 100 MiB is 104857600 here.

max_file_size_unit (String) Unit for max_file_size. Accepts Bytes, KB, or MB, where KB and MB are decimal multiples of 1000 and 1000000. Defaults to Bytes.
minimum_similarity_threshold (String) Minimum percentage of similar content required for an egress event to be monitored. Requires similarity_detection to be true. Defaults to 80.
network_inspection (Boolean) Windows only. Detects egress of classified data via network traffic. Network inspection only supports the web destinations listed in the Falcon documentation. Defaults to false.
network_inspection_files_exceeding_size_limit (String) Windows only. How network inspection handles file uploads larger than its 1 MiB ceiling. allow permits them, block blocks them. Requires network_inspection to be true. Defaults to allow.
screen_capture (Boolean) Windows only. Captures the screen before and after an egress event. Requires evidence_storage to be true. Defaults to false.

~> Important Enabling screen capture may carry legal obligations to notify or obtain consent from end users. Review the notice in the Falcon console before use.

screen_capture_post_event_seconds (String) Windows only. Seconds of screen recording retained after a trigger event. Requires screen_capture to be true. Defaults to 3.
screen_capture_pre_event_seconds (String) Windows only. Seconds of screen recording retained before a trigger event. Requires screen_capture to be true. Defaults to 3.
similarity_detection (Boolean) Detects egress of files containing content copied from other classified files on the same endpoint. Requires context_inspection to be true. Defaults to false.

Read-Only

cid (String) Customer ID that owns the policy.
created_at (String) Timestamp when the policy was created.
created_by (String) Identity that created the policy.
id (String) Unique identifier of the policy.

Import

Import is supported using the following syntax:

# Data protection policy can be imported by specifying the id.
terraform import crowdstrike_data_protection_policy.example 7fb858a949034a0cbca175f660f1e769