filevantage_policy

This resource allows management of a FileVantage policy. A FileVantage policy is a collection of file integrity rules and rule groups that you can apply to host groups.

API Scopes

The following API scopes are required:

Falcon FileVantage: READ
Falcon FileVantage: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

resource "crowdstrike_filevantage_rule_group" "example" {
  name        = "example_filevantage_rule_group"
  description = "made with terraform"
  type        = "MacFiles"
  rules = [
    {
      description = "first rule"
      path        = "/path/to/example/"
      severity    = "High"
      depth       = "ANY"
    },
  ]
}

resource "crowdstrike_filevantage_rule_group" "example2" {
  name        = "example_filevantage_rule_group"
  description = "made with terraform"
  type        = "MacFiles"
  rules = [
    {
      description              = "first rule"
      path                     = "/path/to/example/"
      severity                 = "High"
      depth                    = "ANY"
      enable_content_capture   = true
      watch_file_write_changes = true
      file_names               = ["example.exe"]
    },
  ]
}

resource "crowdstrike_filevantage_policy" "example" {
  name          = "example_filevantage_policy"
  enabled       = true
  description   = "made with terraform"
  platform_name = "Mac"
  # host_groups   = ["1232313"]
  rule_groups = [crowdstrike_filevantage_rule_group.example.id, crowdstrike_filevantage_rule_group.example2.id]
  scheduled_exclusions = [
    {
      name        = "policy1"
      description = "Run the first 3 days of the month. All day."
      start_date  = "2024-05-21"
      start_time  = "11:09"
      timezone    = "US/Central"
      processes   = "**/example.exe,/path/to/example2.exe"
      repeated = {
        all_day            = true
        frequency          = "monthly"
        monthly_occurrence = "Days"
        days_of_month      = [1, 2, 3]
      }
    },
    {
      name        = "policy2"
      description = "Run monday, tuesday, wednesday. 11:09 - 12:10."
      start_date  = "2024-05-21"
      start_time  = "11:09"
      users       = "admin*,example"
      timezone    = "US/Central"
      repeated = {
        all_day      = false
        start_time   = "11:09"
        end_time     = "12:10"
        frequency    = "weekly"
        days_of_week = ["Monday", "Tuesday", "Wednesday"]
      }
    },
  ]
}

output "filevantage_policy" {
  value = crowdstrike_filevantage_policy.example
}

Schema

Required

name (String) Name of the filevantage policy.
platform_name (String) Platform for the filevantage policy to manage. (Windows, Mac, Linux)

Optional

description (String) Description of the filevantage policy.
enabled (Boolean) Enable the filevantage policy.
host_groups (Set of String) Host Group ids to attach to the filevantage policy.
rule_groups (List of String) Rule Group ids to attach to the filevantage policy. Precedence is based on the order of the list. Rule groups must be the same type as the policy.
scheduled_exclusions (Attributes List) Scheduled exclusions for the filevantage policy. (see below for nested schema)

Read-Only

id (String) Identifier for the filevantage policy.
last_updated (String) Timestamp of the last Terraform update of the resource.

Nested Schema for `scheduled_exclusions`

Required:

name (String) Name of the scheduled exclusion.
start_date (String) The start date of the scheduled exclusion. Format: YYYY-MM-DD
start_time (String) The start time of the scheduled exclusion in 24 hour format. Format: HH:MM
timezone (String) The timezone to use for the time fields. See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.

Optional:

description (String) Description of the scheduled exclusion.
end_date (String) The end date of the scheduled exclusion. Format: YYYY-MM-DD
end_time (String) The end time of the scheduled exclusion in 24 hour format. Format: HH:MM
processes (String) A comma separated list of processes to exclude changes from. Example: **/run_me.sh excludes changes made by run_me.sh in any location
repeated (Attributes) Repeated scheduled exclusion (see below for nested schema)
users (String) A comma separated list of users to exclude changes from. Example: user1,user2,admin* excludes changes made by user1, user2, and any user starting with admin

Read-Only:

id (String) Identifier for the scheduled exclusion.

Nested Schema for `scheduled_exclusions.repeated`