Edit FalconFirewallGroup

Edit-FalconFirewallGroup

SYNOPSIS

Modify Falcon Firewall Management rule groups

DESCRIPTION

All fields (plus 'rulegroup_version' and 'tracking') are required when making a rule group change. PSFalcon adds missing values automatically using data from your existing rule group.

'DiffOperation' array objects must contain 'from', 'op', 'path' and 'value' properties. Accepted 'op' values are 'add', 'remove' and 'replace'.

When adding a rule to a rule group,the required rule fields must be included along with a 'temp_id' (in both the rule properties and in precedence order within 'rule_ids') to establish proper placement of the rule within the rule group. Simlarly, the value 'null' must be placed within 'rule_versions' in precedence order.

Requires 'Firewall management: Write'.

PARAMETERS

Name	Type	Description	Min	Max	Allowed	Pipeline	PipelineByName
DiffOperation	Object[]	An array of hashtables containing rule or rule group changes
Comment	String	Audit log comment
RuleId	String[]	Firewall rule 'family' value(s) from the existing rule group [or 'temp_id' for each new rule]
RuleVersion	String[]	Firewall rule version value(s) from the existing rule group [or 'null' for each new rule]
Id	String	Rule group identifier				X	X
Validate	Switch	Toggle to perform validation, instead of modifying rule group

SYNTAX

Edit-FalconFirewallGroup [-DiffOperation] <Object[]> [[-Comment] <String>] [[-RuleId] <String[]>] [[-RuleVersion] <String[]>] [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

Edit-FalconFirewallGroup [-DiffOperation] <Object[]> [[-Comment] <String>] [[-RuleId] <String[]>] [[-RuleVersion] <String[]>] [-Id] <String> -Validate [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /fwmgr/entities/rule-groups/v1
PATCH /fwmgr/entities/rule-groups/validation/v1

falconpy

update_rule_group
update_rule_group_validation

USAGE

Enable a firewall rule group

Edit-FalconFirewallGroup -Id <id> -DiffOperation @{ op = 'replace'; path = '/enabled'; value = $true }

Add a rule at the beginning of a firewall rule group

$DiffOperation = @(
    @{
        op = 'add'
        path = '/rules/0'
        value = @{
            temp_id = '1'
            name = 'First rule in a group'
            description = 'Example'
            platform_ids = @('0')
            enabled = $false
            action = 'ALLOW'
            direction = 'IN'
            address_family = 'NONE'
            protocol = '6'
            fields = @(
                @{
                    name = 'network_location'
                    type = 'set'
                    values = @( 'ANY' )
                }
            )
            local_address = @(@{ address = '*'; netmask = 0 })
            remote_address = @(@{ address = '*'; netmask = 0 })
        }
    }
)
$Group = Get-FalconFirewallGroup -Id <id>
$Rule = Get-FalconFirewallRule -Id $Group.rule_ids
$RuleId = @('1') + $Group.rule_ids
$RuleVersion = @('null') + $Rule.version
Edit-FalconFirewallGroup -Id $Group.id -DiffOperation $DiffOperation -RuleId $RuleId -RuleVersion $RuleVersion

Rename a firewall group

Edit-FalconFirewallGroup -Id <id> -DiffOperation @{ op = 'replace'; path = '/name'; value = 'my new name' }

Rename a firewall rule inside of a group

$Group = Get-FalconFirewallGroup -Filter "name:'my_group'" -Detailed
$Rule = Get-FalconFirewallRule -Id $Group.rule_ids
$Family = ($Rule | Where-Object { $_.name -eq 'my target rule' }).family
$Index = $Group.rule_ids.IndexOf($Family)
Edit-FalconFirewallGroup -Id $Group.id -DiffOperation @{ op = 'replace'; path = "/rules/$Index/name"; value = 'my new rule name' }

2024-09-03: PSFalcon v2.2.7