Host firewall for Windows - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Create a group.

From Endpoints → Host Firewall → Host Firewall Rules Groups, click +New Group on the upper bar.

Fill in general information.

Enter the rule name and optional description. To enforce the rules within the group in all policies they are associated with, Enable the group. When Disabled, the group exists but is not enforced.

Create rules within the rules group.

Create rules within rules groups to allow or block traffic on the endpoint. Use a variety of parameters to fine tune your policy such as specific protocols, applications, services, and more. For every group, you need to create its own list of rules. Each rule is assigned a unique ID and can be associated with a single group only.

1. Configure rule settings.

   A host firewall rule allows or blocks the communication to and/or from an endpoint. Enter the rule Name, optional Description, and select the Platforms you want to associate the rule with.

   Fine-tune the rule by applying the action to the following parameters:

   • Protocol: Select any of the 256 internet protocols:

     • Any

     • Custom

     • TCP

     • UDP

     • ICMPv4

     • ICMPv6

     Once you select one of the available protocols or enter the protocol number, you will be able to specify additional parameters per protocol as needed. For example, for TCP(6) you can set local and remote ports, whereas for ICMPv4(1) you can add the ICMP type and code.

     Note

     When selecting ICMP protocol, you must enter a the ICMP Type and Code. Without these values the ICMP protocol is ignored by the Windows and macOS Cortex XDR agents.

   • Direction: Select the direction of the communication this rule applies to: Inbound communication to the endpoint, Outbound communication from the endpoint, or Both.

   • Action: Select whether the rule action is to Allow or Block the communication on the endpoint.

   • Local/Remote IP Address: Configure the rule for specific local or remote IP addresses s and/or Ports. You can set a single IP address, multiple IP addresses separated by a comma, range of IP addresses separated by a hyphen, or a combination of these options.

   • Depending on the type of platform you selected, define the Application, Service, and Bundle IDs of the Windows Settings and/or macOS Settings—Configure the rule for all applications/services or specific ones only by entering the full path and name. If you use system variables in the path definition, you must re-enforce the policy on the endpoint every time the directories and/or system variables on the endpoint change.

   • Report Matched Traffic: When Enabled, enforcement events captured by this rule are reported periodically to Cortex XSIAM and displayed in the Host Firewall Events table, whether the rule is set to Allow or Block the traffic. When Disabled, the rule is applied but enforcement events are not reported periodically.

2. Save rule.

   After you fill in all the details, you need to save the rule. If you know you need to create a similar rule, click Create another to save this rule and leave the specified parameters available for edit for the next rule. Otherwise, to save the rule and exit, click Create.

Prioritize rules.

The rules within the group are enforced by priority from top to bottom. By default, every new rule is added to the top of the already existing rules in the group, meaning it is assigned the highest priority and will be enforced first. To change the rules priority and order of enforcement within the group, click the rule priority number and drag the rule up or down the table to the proper row. Repeat this process to prioritize all the rules.

Save.

When you are done, click Create. The new rules group is created and can be associated with a host firewall profile.

Create a profile.

From Endpoints → Policy Management → Extensions and select + Add Profile or Import from File.

Select the platform and click Host Firewall → Next.

Fill in General Information.

Enter the profile name and optional description.

Configure Report Settings.

When the profile operates in report mode, Cortex XSIAM overrides all rules set to Block traffic. Instead, the traffic is allowed to go through, and the enforcement event is reported as Override Block. You can configure a profile in report mode if you need for example to test new block rules before you actually apply them.

Configure Internal and External Rule Groups.

To apply location-based host firewall rules, you must first enable network location configuration in your Agent Settings Profile. When enabled, Cortex XSIAM enforces the host firewall rules based on the current location of the device within the internal organization network (Internal Rules), enabling you for example to enforce more strict rules when the device is outside the office and in a public place (External Rules). If you disable the Location Based option, your policy will apply the internal set of rules only, and that will be applied to the device regardless of its location.

Create a new rule or add a rules group to the Internal/External Groups:

1. Click +Add Group.

2. Select one or more groups, and click Add.

   To quickly apply the exact same rules in both cases, select Add as external/internal rules groups as well.

3. Review the rule group field details.

   The groups are listed according to the order of enforcement from top to bottom. To change this order, click on the group priority number and drag the group to the desired row.

   Field	Description
   Applicable Rules Count	Displays the number of rules in the specific group that are associated with the platform profile
   Created by	Displays the email address of the user that created the rule
   Creation Time	Date and time of when the rule was created
   Description	Description of the rule, if available
   Group ID	Unique rules group ID
   Group Name	Name of the group rules group
   Mode	Displays whether the rules group is enabled
   Modified by	Displays the email address of the last user that made changes to the group
   Modification Time	Date and time of when the group was modified

4. (Optional) Select View Rules to view a list of all the rule details within the rules group. The table is filtered according to the rules associated with the platform profile you are creating.

5. Allow or Block the Default Action for Inbound/Outbound Traffic in the profile if you want to allow all network connections that have not been matched to any other rule in the profile.

Save the profile.

When you are done, click Create. You can now configure a host firewall policy.

Create a policy.

From Endpoints → Policy Management → Extensions → Policy Rules, click +New Policy or Import from File.

Fill in general information.

Enter the policy name, description, and platform. Click Next.

Select profile.

Select the desired profile for host firewall from the drop-down list, and any other profiles you want to include in this policy. Click Next.

Select endpoints.

Select the target endpoints on which to enforce the policy. Use filters or manual endpoint selection to define the exact target endpoints of the policy. Click Done.

Configure policy hierarchy.

Drag and drop the policies in the desired order of execution, from top to bottom.

Save the policy.

After the policy is saved and applied to the agents, Cortex XSIAM enforces the host firewall policies in your environment.