Skip to content

Firewall Management

Searching and managing firewall rules and rule groups

  • Firewall Management:read
  • Firewall Management:write

Required scopes: Firewall Management:write

Create a firewall rule group.

Provide a name, platform, and either rules or a clone_id. Returns a list containing the created rule group object.

Example prompts:

  • “Create a Windows firewall rule group named ‘Prod Outbound‘“

Required scopes: Firewall Management:write

Delete firewall rule groups by ID.

Permanently removes the specified rule groups and all rules within them. Returns an empty list on success.

Example prompts:

  • “Delete firewall rule group abc123”

Required scopes: Firewall Management:read

Search firewall rules within a specific policy container.

Use this when you need rules scoped to a particular policy. Consult falcon://firewall/rules/fql-guide before constructing filter expressions. Returns full rule details for the specified policy.

Example prompts:

  • “Show me all rules in firewall policy abc123”

Required scopes: Firewall Management:read

Search firewall rule groups and return full rule group details.

Use this to find rule groups by name, platform, or enabled state. Consult falcon://firewall/rules/fql-guide before constructing filter expressions. Returns rule group objects including their contained rules.

Example prompts:

  • “Find all enabled firewall rule groups for Windows”

Required scopes: Firewall Management:read

Search firewall rules and return full rule details.

Use this to find firewall rules by name, platform, or enabled state. Consult falcon://firewall/rules/fql-guide before constructing filter expressions. Returns complete rule objects including conditions and actions.

Example prompts:

  • “Show me all enabled Windows firewall rules”
  • “Find firewall rules matching ‘outbound‘“
  • falcon://firewall/rules/fql-guide: Contains the guide for the filter param of firewall search tools.