Category Blocking Foundry app

This Category Blocking Foundry app provides a comprehensive URL filtering solution that simplifies firewall rule management through custom categories and automated rule deployment. Built on CrowdStrike's Foundry platform, this application streamlines URL blocking workflows while providing valuable insights into blocking patterns.

Description

The Category Blocking app allows you to:

• Create and manage custom categories of domains for blocking
• Deploy firewall rules to block categories of domains across host groups
• Import URL categories from CSV files
• Generate analytics on domain blocking patterns

Prerequisites

• Python 3.14+ (needed if modifying the app's functions). See Python For Beginners for installation instructions.
• Node.js (needed for React JS development).
• npm 9+ or Yarn (needed for managing UI dependencies). See https://yarnpkg.com/getting-started for installation instructions.
• FalconPy SDK (for CrowdStrike API integration). Install with pip install crowdstrike-falconpy
• pre-commit for secret scanning

Getting Started

Clone this repository to your local system:

git clone https://github.com/CrowdStrike/foundry-sample-url-filtering
cd foundry-sample-url-filtering

Set up secret scanning

pip install pre-commit
pre-commit install

Deployment Process

After cloning the repository, follow these steps to deploy the application:

1. Login to Foundry CLI

   foundry login

   This will prompt you to enter your CrowdStrike API credentials.

2. Deploy the application

   foundry apps deploy

   This command packages and deploys your application to Foundry.

3. Install the application

   • Navigate to the Falcon console
   • Go to Foundry > App Library
   • Find the Category Blocking app
   • Click Install

4. Accept permissions

   • Review the requested permissions
   • Click Accept to grant the necessary permissions
   • The application requires access to firewall management, host groups, and devices

5. Access the application

   • Once installed, the application will be available in the Falcon console
   • Navigate to the app from the main menu

Required permissions

This app requires the following API scopes:

• firewall-management:read
• firewall-management:write
• host-group:read
• host-group:write
• devices:read
• devices:write

About this app

This application demonstrates advanced usage of Functions, Collections and UI Experience in Falcon Foundry, implementing several key capabilities for URL filtering and firewall management:

Key Components

1. Python functions with multiple handlers:

   • urlblock: Fetches host groups information
   • create-rule: Creates a firewall policy and rule group that block the selected categories
   • list-policies: Lists the policies created by the app
   • update-policy: Replaces a policy's categories and whitelist
   • delete-policy: Deletes a policy, its rule group and its stored relationships
   • simulate-policy: Checks whether a domain would be blocked by any category
   • check-enforcement / health-check: Verify that policies are enabled and enforcing
   • domain-analytics: Generates domain analytics information (optional ?days= look-back window, 1-90, default 15)
   • import-csv: Transforms category domain CSV into collections
   • list-categories: Lists available categories
   • search-categories: Searches for specific categories
   • manage-category: Creates or updates categories

2. Collections for data storage:

   • domain: Stores URLs and category mappings
   • relationship: Stores relationship information about host groups, rule groups, and categories

3. UI Pages with React components:

   • Category Blocking Policy: Main interface for creating firewall rules
   • Custom Categories: Management of domain categories
   • Domain Analytics: Visualization of domain data
   • Firewall Rules: Management of the policies created by the app

Directory structure

• collections: Schemas for domain and relationship collections
• ui/pages/urlblocking: React-based frontend application
• functions/urlblock: Python backend handlers

Using the App

Creating URL Categories

A fresh install has no categories.

1. Navigate to the Custom Categories page
2. Use "Import CSV" to import from a CSV file, or manually add categories. sample-categories.csv in this repository contains 54 ready-to-use categories in the expected category,url format
3. View and manage your categories from this interface

Creating Blocking Rules

1. Navigate to the Category Blocking Policy page
2. Enter a policy name and select a host group
3. Select the categories you want to block
4. Click "Preview Domains" to see what will be blocked
5. Click "Create blocking rule" to deploy the rule

Viewing Analytics

1. Navigate to the Domain Analytics page
2. View tables and statistics about blocked domains
3. Analyze patterns and effectiveness of your blocking rules

Managing Policies

1. Navigate to the Firewall Rules page
2. Edit a policy's categories and whitelist, or delete it
3. The replacement policy is created before the old one is removed, so hosts stay protected during an update

Foundry resources

• Foundry documentation: US-1 | US-2 | EU
• Foundry learning resources: US-1 | US-2 | EU

Secret Scanning

This repository enforces secret scanning on every commit via the pre-commit framework using betterleaks, a tool that detects secrets and credentials in source code before they are committed.

Setup

# Install pre-commit (run once)
brew install pre-commit

# Register the git hook (run once after cloning)
pre-commit install

How it works

On each git commit, betterleaks scans all staged files for secrets and credentials.

Scenario	Result
Secret detected in staged files	Commit blocked
No secrets found	Commit allowed
pre-commit not installed	No hook runs (secrets not scanned)

Bypass (false positives only):

git commit --no-verify

---

WE STOP BREACHES