CrowdStrike Custom IoM Rules Deployment Guide

Overview

This guide explains how to deploy Custom IoM Rules to CrowdStrike Falcon using the automated bulk deployment script.

Prerequisites

1. System Requirements

• Python 3.7 or higher
• Network access to CrowdStrike Falcon API
• Valid CrowdStrike API credentials with appropriate permissions

2. Required Permissions

Your CrowdStrike API credentials must have:

• Cloud Policies: Read
• Cloud Policies: Write
• Access to Custom IoM Rules functionality

3. Required Files

Ensure you have these files in your working directory:

• bulk_create_custom_iom_rules_json.py - Main deployment script
• your_custom_rules.json - Rules to deploy
• config.json - Configuration file
• falconpy/ - FalconPy SDK directory

Step-by-Step Deployment Process

Step 1: Install Dependencies

pip install falconpy

Step 2: Configure API Credentials

Edit the config.json file with your CrowdStrike API credentials:

{
  "client_id": "YOUR_CLIENT_ID_HERE",
  "client_secret": "YOUR_CLIENT_SECRET_HERE",
  "cloud": "us-1"
}

Important Notes:

• Replace YOUR_CLIENT_ID_HERE and YOUR_CLIENT_SECRET_HERE with your actual credentials
• Update the cloud parameter if you're not using US-1:
  • us-1 - US Commercial 1
  • us-2 - US Commercial 2
  • eu-1 - EU Commercial
  • us-gov-1 - US GovCloud

Step 3: Verify Your Environment

Run a quick test to ensure your credentials work:

python3 -c "from falconpy import CloudPolicies; import json; config=json.load(open('config.json')); falcon=CloudPolicies(**config); print('✅ Connection successful' if falcon.auth_object.authenticated else '❌ Connection failed')"

Step 4: Deploy the Rules

Execute the deployment script:

python3 bulk_create_custom_iom_rules_json.py your_custom_rules.json

Step 5: Monitor the Deployment

The script will display real-time progress:

🚀 CrowdStrike Custom IoM Rules Bulk Creator (JSON)
============================================================
🔧 Using Falcon Cloud: us-1
✅ Successfully initialized FalconPy CloudPolicies
📋 Loaded X rules from your_custom_rules.json
🔍 Checking for existing rules...
📊 Found XXX existing custom rules

🎯 CREATING RULES
============================================================

[1/119] Processing: Key Vault secret should have an expiration date
   ✅ SUCCESS: Rule created (ID: ac96af47-e92d-408f-b887-69f9a634f7c4)

[2/119] Processing: Storage accounts must have a SAS Key Expiration within 30 days
   ✅ SUCCESS: Rule created (ID: 8484428e-6255-4346-82cb-18276c8ac0ec)
...

Step 6: Review Results

At the end, you'll see a summary:

📊 SUMMARY
============================================================
✅ Created: X
⏭️ Skipped: 0
❌ Failed: 0
📋 Total: X

Status Indicators:

• ✅ SUCCESS - Rule created successfully
• ⏭️ SKIPPED - Rule already exists (duplicate detection)
• ❌ FAILED - Rule creation failed (error will be shown)

Expected Results

First Time Deployment

• Expected: X rules created successfully
• Duration: Approximately 2-3 minutes
• Result: All Custom IoM Rules active in CrowdStrike

Subsequent Deployments

• Expected: X rules skipped (already exist)
• Duration: 30-60 seconds
• Result: No duplicates created

Verification

In CrowdStrike Console

1. Navigate to Cloud Security > Posture Management > Policies
2. Filter by Custom policies
3. You should see your new custom rules with names like:
   • "Key Vault secret should have an expiration date"
   • "Storage accounts must have a SAS Key Expiration within 30 days"
   • "App Service HTTPS Only should be enabled"
   • etc.

Via API Check

Run this command to count your custom rules:

python3 -c "from falconpy import CloudPolicies; import json; config=json.load(open('config.json')); falcon=CloudPolicies(**config); result=falcon.query_rule(limit=500); print(f'Total custom rules: {len(result[\"body\"][\"resources\"])}')"

Troubleshooting

Common Issues

1. Authentication Failed

Error: 401 Unauthorized or authentication errors Solution:

• Verify your client_id and client_secret in config.json
• Ensure your API credentials have the correct permissions
• Check that you're using the correct cloud region

2. Permission Denied

Error: 403 Forbidden Solution:

• Your API key needs Cloud Policies: Write permissions
• Contact your CrowdStrike admin to grant appropriate permissions

3. Network/Connectivity Issues

Error: Connection timeouts or network errors Solution:

• Verify network connectivity to CrowdStrike API endpoints
• Check firewall/proxy settings
• Ensure outbound HTTPS (443) access is allowed

4. Rule Creation Failures

Error: Individual rules fail with "Bad Request" Solution:

• The provided rule file has been tested and validated
• If you see failures, check that you're using the correct rule file format
• Contact support if failures persist

5. Python/Dependency Issues

Error: ModuleNotFoundError or import errors Solution:

pip install --upgrade falconpy
python3 -m pip install falconpy

File Descriptions

Core Files

• bulk_create_custom_iom_rules_json.py - Main deployment script
• your_custom_rules.json - Your rule set to deploy
• config.json - API configuration file

Archive Files

• conversion_archive/ - Historical files and development work (can be ignored for deployment)

Security Notes

API Key Protection

• Never commit config.json with real credentials to version control
• Store API credentials securely (consider using environment variables)
• Rotate API keys according to your security policies

Example Environment Variable Approach

Instead of editing config.json, you can use environment variables:

export CROWDSTRIKE_CLIENT_ID="your_client_id"
export CROWDSTRIKE_CLIENT_SECRET="your_client_secret"
export CROWDSTRIKE_CLOUD="us-1"

# Then modify config.json to reference these:
{
  "client_id": "${CROWDSTRIKE_CLIENT_ID}",
  "client_secret": "${CROWDSTRIKE_CLIENT_SECRET}",
  "cloud": "${CROWDSTRIKE_CLOUD}"
}

Support

Rule Content Questions

• Custom IoM Rules for your specific Azure security policies
• Rules cover various Azure services like Key Vault, Storage Accounts, App Services, SQL Server, networking, and more
• Each rule includes description, remediation guidance, and technical details

Technical Issues

• Verify all prerequisites are met
• Check the troubleshooting section above
• Ensure you're using the validated rule file
• Test API connectivity independently

Success Criteria

✅ Deployment is successful when:

• Script completes without errors
• Summary shows "Created: X" (where X is your rule count)
• CrowdStrike console shows your new custom rules
• All rules are in "Active" status

Quick Reference

Deployment Command

python3 bulk_create_custom_iom_rules_json.py your_custom_rules.json

Expected Output

• First run: X rules created
• Subsequent runs: X rules skipped
• Duration: 2-3 minutes for creation, 30-60 seconds for duplicate detection

File Requirements

• Your rules JSON file should follow the structure defined in RULE_STRUCTURE.json
• Each rule must have validated Rego logic and proper Azure resource types