firewall_rule_groups

This data source provides information about firewall rule groups in Falcon.

API Scopes

The following API scopes are required:

• Firewall management: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {}

# Get all firewall rule groups
data "crowdstrike_firewall_rule_groups" "all" {}

# Get firewall rule groups filtered by platform
data "crowdstrike_firewall_rule_groups" "windows" {
  platform = "Windows"
}

# Get firewall rule groups filtered by name (supports wildcards)
data "crowdstrike_firewall_rule_groups" "web_rules" {
  name = "Web*"
}

# Get specific firewall rule groups by ID
data "crowdstrike_firewall_rule_groups" "specific" {
  ids = ["rule_group_id_1", "rule_group_id_2"]
}

# Get enabled firewall rule groups
data "crowdstrike_firewall_rule_groups" "enabled" {
  enabled = true
}

# Use FQL filter for advanced queries
data "crowdstrike_firewall_rule_groups" "fql" {
  filter = "platform:'windows'+enabled:true"
}

output "all_rule_group_names" {
  value = [for rg in data.crowdstrike_firewall_rule_groups.all.rule_groups : rg.name]
}

output "windows_rule_group_ids" {
  value = [for rg in data.crowdstrike_firewall_rule_groups.windows.rule_groups : rg.id]
}

Schema

Optional

• enabled (Boolean) Filter rule groups by enabled status. Cannot be used together with ‘filter’ or ‘ids’.
• filter (String) FQL filter to apply to the firewall rule groups query. Cannot be used together with ‘ids’ or other filter attributes.
• ids (List of String) List of firewall rule group IDs to retrieve. Cannot be used together with ‘filter’ or other filter attributes.
• name (String) Filter rule groups by name. Supports wildcard matching with ’*’. Cannot be used together with ‘filter’ or ‘ids’.
• platform (String) Filter rule groups by platform (Windows, Linux, Mac). Cannot be used together with ‘filter’ or ‘ids’.

Read-Only

• rule_groups (Attributes List) The list of firewall rule groups (see below for nested schema)

Nested Schema for rule_groups

Read-Only:

• created_by (String) User who created the rule group
• created_on (String) Timestamp when the rule group was created
• description (String) The firewall rule group description
• enabled (Boolean) Whether the rule group is enabled
• id (String) The firewall rule group ID
• modified_by (String) User who last modified the rule group
• modified_on (String) Timestamp when the rule group was last modified
• name (String) The firewall rule group name
• platform (String) The platform (Windows, Linux, Mac)
• rule_count (Number) Number of rules in the rule group
• rules (Attributes List) The list of firewall rules in this rule group, in precedence order (see below for nested schema)

Nested Schema for rule_groups.rules

Read-Only:

• action (String) Action to take when the rule matches
• address_family (String) Address family for the rule
• description (String) Description of the firewall rule
• direction (String) Traffic direction for the rule
• enabled (Boolean) Whether the rule is enabled
• executable_path (String) Path to executable that this rule applies to
• fqdn (String) Fully qualified domain name for the rule
• icmp_code (String) ICMP code for ICMP protocol rules
• icmp_type (String) ICMP type for ICMP protocol rules
• id (String) Identifier for the firewall rule
• local_address (Attributes List) Local IP addresses for the rule (see below for nested schema)
• local_port (Attributes List) Local ports for the rule (see below for nested schema)
• name (String) Name of the firewall rule
• network_location (String) Network location restriction
• protocol (String) Protocol for the rule
• remote_address (Attributes List) Remote IP addresses for the rule (see below for nested schema)
• remote_port (Attributes List) Remote ports for the rule (see below for nested schema)
• service_name (String) Windows service name that this rule applies to
• watch_mode (Boolean) Whether watch mode (monitoring) is enabled for this rule

Nested Schema for rule_groups.rules.local_address

Read-Only:

• address (String) IP address or * for any
• netmask (Number) CIDR netmask

Nested Schema for rule_groups.rules.local_port

Read-Only:

• end (Number) End port for range, 0 for single port
• start (Number) Start port

Nested Schema for rule_groups.rules.remote_address

Read-Only:

• address (String) IP address or * for any
• netmask (Number) CIDR netmask

Nested Schema for rule_groups.rules.remote_port

Read-Only:

• end (Number) End port for range, 0 for single port
• start (Number) Start port