ioa_rule_group

Manages IOA (Indicator of Attack) rule groups in CrowdStrike Falcon. Rule groups contain custom IOA rules that define detection logic for suspicious activities based on process creation, file creation, network connections, and domain name patterns.

API Scopes

The following API scopes are required:

• Custom IOA Rules: READ
• Custom IOA Rules: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}
resource "crowdstrike_ioa_rule_group" "linux_monitoring" {
  name        = "Linux Security Monitoring"
  platform    = "Linux"
  description = "Custom IOA rules for monitoring suspicious Linux activity"
  comment     = "Managed by Terraform"
  enabled     = true

  rules = [
    {
      local_key        = "suspicious-network-connection"
      name             = "Suspicious Network Connection"
      description      = "Monitors for suspicious outbound network connections"
      comment          = "Managed by Terraform"
      pattern_severity = "critical"
      type             = "Network Connection"
      action           = "Monitor"
      enabled          = true

      image_filename = {
        include = ".*suspicious.*"
        exclude = ".*legitimate.*"
      }

      command_line = {
        include = ".*malicious.*"
        exclude = ".*safe.*"
      }

      remote_ip_address = {
        include = ".*"
      }

      connection_type = ["TCP", "UDP"]
    },
    {
      local_key        = "unauthorized-process-creation"
      name             = "Unauthorized Process Creation"
      description      = "Detects unauthorized process creation"
      comment          = "Kill unauthorized processes immediately"
      pattern_severity = "high"
      type             = "Process Creation"
      action           = "Kill Process"
      enabled          = true

      parent_image_filename = {
        include = ".*/bin/bash"
      }

      image_filename = {
        include = ".*/tmp/.*"
      }

      command_line = {
        include = ".*"
      }
    }
  ]
}

Schema

Required

• name (String) The name of the IOA rule group.
• platform (String) The platform for the IOA rule group. One of: Windows, Linux, Mac.

Optional

• comment (String) The comment stored in audit logs when making changes to the IOA rule group.
• description (String) The description of the IOA rule group.
• enabled (Boolean) Whether the IOA rule group is enabled.
• rules (Attributes List) IOA rules within this rule group. Rules are evaluated independently, so list order does not affect detection. Without local_key, rules are matched to the existing rules by list position, so inserting, removing, or reordering rules can move instance IDs between rules. To insert or reorder rules safely, set local_key on every rule. A rule’s type cannot be updated. Changing the type deletes the rule and creates a new one. (see below for nested schema)

Read-Only

• cid (String) The customer ID associated with the rule group.
• committed_on (String) The timestamp when the rule group was committed.
• created_by (String) The user who created the rule group.
• created_on (String) The timestamp when the rule group was created.
• deleted (Boolean) Whether the rule group has been marked as deleted.
• id (String) The ID of the IOA rule group.
• modified_by (String) The user who last modified the rule group.
• modified_on (String) The timestamp when the rule group was last modified.

Nested Schema for rules

Required:

• action (String) The action to take when the rule triggers.
• description (String) The description of the IOA rule.
• name (String) The name of the IOA rule.
• pattern_severity (String) The severity of the pattern.
• type (String) The rule type.

Optional:

• command_line (Attributes) Command line match criteria. (see below for nested schema)
• comment (String) The comment stored in audit logs when making changes to the IOA rule group rule. This attribute behaves as write-only: the configured value is sent to the API on every apply, but Terraform does not reconcile drift in this field.
• connection_type (Set of String) Connection types to match. Only valid for Network Connection rules.
• domain_name (Attributes) Domain name match criteria. Only valid for Domain Name rules. (see below for nested schema)
• enabled (Boolean) Whether the rule is enabled.
• file_path (Attributes) File path match criteria. Only valid for File Creation rules. (see below for nested schema)
• file_type (Set of String) File types to match. Only valid for File Creation rules.
• grandparent_command_line (Attributes) Grandparent command line match criteria. (see below for nested schema)
• grandparent_image_filename (Attributes) Grandparent image filename match criteria. (see below for nested schema)
• image_filename (Attributes) Image filename match criteria. (see below for nested schema)
• local_key (String) A stable identifier for the rule, unique within the rule group. Rules with a key are matched to the existing rules by key instead of list position. Keys are all or nothing: set local_key on every rule or on none. Keys are stored only in Terraform state and are not sent to Falcon, so imported rules have no keys. To start using keys on an existing or imported rule group, add keys to every rule in one apply, keeping the rules in the same order and with the same values as the current state. After that, rules can be added, removed, renamed, and reordered freely. Changing a rule’s key deletes the rule and creates a new one with a new instance_id. Removing every key returns to matching by list position.
• parent_command_line (Attributes) Parent command line match criteria. (see below for nested schema)
• parent_image_filename (Attributes) Parent image filename match criteria. (see below for nested schema)
• remote_ip_address (Attributes) Remote IP address match criteria. Only valid for Network Connection rules. (see below for nested schema)
• remote_port (Attributes) Remote port match criteria. Only valid for Network Connection rules. (see below for nested schema)

Read-Only:

• instance_id (String) The unique instance ID of the rule.

Nested Schema for rules.command_line

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.domain_name

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.file_path

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.grandparent_command_line

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.grandparent_image_filename

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.image_filename

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.parent_command_line

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.parent_image_filename

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.remote_ip_address

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Nested Schema for rules.remote_port

Optional:

• exclude (String) Regex pattern for exclusion.
• include (String) Regex pattern for inclusion.

Import

Import is supported using the following syntax:

terraform import crowdstrike_ioa_rule_group.example abc123