Host Firewall

Provides endpoint-level network protection, such as defining inbound and outbound firewall rules and creating application-based rules in the Host Firewall page (**Inventory** → **Endpoints** → **Host Firewall)**. Users can also **Collect Detailed Host Firewall Logs** from **Inventory** → **Endpoints** → **Endpoint Control**.

### Caution

Misconfigured firewall rules can block legitimate traffic or allow malicious connections. Implement change management processes and test rules before deployment.

| Permissions | Description | Roles Example |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Cannot view the Host Firewall page, which includes firewall pages, firewall rules, and events, or Collect Detailed Host Firewall Logs. | |
| View | View the Host Firewall menu, which includes read-only access for Rule Groups and Host Firewall Events. | <ul><li>SOC Tier-1 Analyst: Firewall rules may provide context for network-related alerts. Helpful when triaging blocked connection issues.</li><li>SOC Tier-2 Analyst: Understanding firewall rules is important for investigating network-based threats. Critical for lateral movement investigations</li><li>Threat Hunter: Firewall rules help understand network protection posture for hunting. Hunters need to know what network traffic is allowed/blocked.</li></ul> |
| View/Edit | All view capabilities, plus creating, editing, deleting, and enabling Host Firewall Rules Groups, and managing Host Firewall Events. Also can **Collect Detailed Host Firewall Logs**. | <ul><li>SOC Tier-3 Analyst: May need for emergency containment (blocking malicious IPs), but should require approval and documentation.</li><li>Security Engineer: Responsible for firewall rule development and maintenance. Creates and optimizes firewall policies.</li></ul> |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission | Permission Level | Reason |
| ------------------------ | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Groups | View | Required. Must understand group structure to target firewall rules correctly. Incorrect targeting can block legitimate traffic or allow malicious connections. |
| Agent Extension Policies | View | Required. Host Firewall profiles are managed through extension policies. Without extension policy visibility, firewall rule changes may conflict with profile settings. |
| Agent Administrations | View | Strongly Recommended. View endpoints to understand firewall rule deployment and correlate firewall events with endpoint data. |
| Network Configuration | View | Strongly Recommended. Network topology context is essential for designing effective firewall rules. Understanding network zones prevents blocking legitimate traffic. |
| Cases & Issues | View | Strongly Recommended. Review security events to inform firewall rule decisions. Understanding attack patterns helps create effective rules. |