Edit FalconDeviceControlPolicy - CrowdStrike/psfalcon GitHub Wiki

Edit-FalconDeviceControlPolicy

SYNOPSIS

Modify Falcon Device Control policies

DESCRIPTION

Requires 'Device control policies: Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
InputObject Object[] One or more policies to modify in a single request X
Name String Policy name
Description String Policy description
UsbSetting Object USB settings
BluetoothSetting Object Bluetooth settings
Propagated Boolean Propagate policy to child environments
Id String Policy identifier

SYNTAX

Edit-FalconDeviceControlPolicy [[-Name] <String>] [[-Description] <String>] [[-UsbSetting] <Object>] [[-BluetoothSetting] <Object>] [[-Propagated] <Boolean>] -Id <String> [-WhatIf] [-Confirm] [<CommonParameters>]
Edit-FalconDeviceControlPolicy -InputObject <Object[]> [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

PATCH /policy/entities/device-control/v2

falconpy

patchDeviceControlPoliciesV2

USAGE

Enable policy settings

$Setting = @{
    enforcement_mode = 'MONITOR_ENFORCE'
    end_user_notifications = 'NOTIFY_USER'
    classes = @(
        @{
            id = 'AUDIO_VIDEO'
            action = 'BLOCK_ALL'
            exceptions = @(
                @{
                    combined_id = '1133_2092_7A4F8BD0'
                    action = 'FULL_ACCESS'
                    expiration_time = '2023-01-01T00:00:00Z'
                }
            )
        },
        @{
            id = 'MASS_STORAGE'
            action = 'BLOCK_ALL'
            exceptions = @(
                @{
                    vendor_id = '59f'
                    vendor_name = 'LaCie'
                    product_id = '10c4'
                    product_name = 'HDD'
                    action = 'BLOCK_EXECUTE'
                },
                @{
                    vendor_id_decimal = '3010'
                    vendor_name = 'Seagate'
                    action = 'FULL_ACCESS'
                }
            )
        }
    )
}
Edit-FalconDeviceControlPolicy -Id <id> -Setting $Setting

Create or add exceptions

$Setting = @{
    classes = @(
        @{
            id = 'ANY'
            exceptions = @(
                @{
                    action = 'BLOCK_ALL'
                    combined_id = '1_2_345'
                },
                @{
                    action = 'BLOCK_ALL'
                    vendor_id_decimal = '6'
                    vendor_name = 'Example Vendor'
                    product_id_decimal = '7'
                    product_name = 'Example Product'
                    serial_number = '891'
                }
            )
        },
        @{
            id = 'IMAGING'
            action = 'BLOCK_ALL'
            exceptions = @(
                @{
                    action = 'FULL_ACCESS'
                    combined_id = '5_4_321'
                },
                @{
                    action = 'FULL_ACCESS'
                    vendor_id_decimal = '20'
                    vendor_name = 'Example Vendor 2'
                    product_id_decimal = '30'
                    product_name = 'Example Product 2'
                },
            )
        },
        @{
            id = 'MASS_STORAGE'
            action = 'BLOCK_ALL'
            exceptions = @(
                @{
                    action = 'FULL_ACCESS'
                    combined_id = '5_4_321'
                },
                @{
                    action = 'FULL_ACCESS'
                    vendor_id_decimal = '30'
                    vendor_name = 'Example Vendor 3'
                },
            )
        }
    )
}
Edit-FalconDeviceControlPolicy -Id <id> -Setting $Setting

See Add a list of combined_id exceptions to a Device Control policy.

Remove exceptions from a policy

$Setting = @{ delete_exceptions = @('id', 'id') }
Edit-FalconDeviceControlPolicy -Id <id> -Setting $Setting

NOTE: The required id values can be found under the settings.classes.exceptions sub-object. Classes can be filtered by their relevant id values to find the specific exceptions for that class type.

$Policy = Get-FalconDeviceControlPolicy -Id <id>
$Policy.settings.classes.Where({ $_.id -eq 'MASS_STORAGE' }).exceptions

See Create CSVs containing Device Control policy details and exceptions.

2025-09-19: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️