CrowdStrike Falcon® Firewall Management FAQ

Falcon Firewall Management delivers simple, centralized firewall management making it easy to manage and enforce firewall policies. Falcon Firewall Management enhances protection from network threats by eliminating the visibility gaps and complexity often associated with host firewalls. Delivered via the same lightweight Falcon agent and cloud-delivered architecture — Falcon Firewall Management deploys and is operational in minutes with little impact on the host.

Organizations that have relied on legacy AV suites for host firewall functionality can now transition to next-gen protection with the Falcon platform and get simple firewall management without added complexity or overhead.

• Simple Firewall Management: Falcon Firewall Management makes it easy to manage host firewalls that are native to the operating system, simplifying creation, enforcement and maintenance of firewall policies.
• Reduced Complexity: Delivered via the same lightweight Falcon agent, single management console and cloud-delivered architecture, Falcon Firewall Management deploys and is operational in minutes with minimal impact on the host— from initial enablement to ongoing day-to-day use.
• Better Protection: Defend against network threats. Use role-based access control to ensure that only the appropriate administrators view and manage firewall rules. Application and location-aware firewall policies enhance security and provide granular control.

As part of the Falcon platform and enabled via the Falcon agent, no additional agent is required.

With Falcon Firewall Management, you can create firewall rules, rule groups, and polices to precisely define what network traffic is allowed and blocked. When enforced, Falcon’s firewall policies override the firewall settings on each assigned host.

• Rules: Individual firewall rules define precise network traffic that is allowed or blocked and whether you want to see associated events in the console.
• Rule Groups: Firewall rules are created and organized within firewall rule groups. You may choose to start with an empty group and build it out, or start with a CrowdStrike preset rule group, a collection of core rules that you can edit for your needs. You may also start a new rule group by copying one of your own groups to edit as needed. Rules are enforced in the precedence order you define in their rule group.
• Policies: Firewall rule groups organize your firewall rules so that they can be easily assigned to firewall policies. A firewall policy is then configured to allow or block any remaining incoming and outgoing network traffic that is not defined by its assigned rules.

Existing customers can contact sales to add Falcon Firewall Management to their subscriptions. Falcon Firewall Management can be used with both Falcon Prevent and Falcon Insight.

If you are not currently a CrowdStrike customer and are interested in this solution, please contact CrowdStrike Sales: sales@crowdstrike.com.

Falcon Firewall Management is licensed on a subscription basis per endpoint. For more information please contact CrowdStrike Sales: sales@crowdstrike.com.