Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. CrowdStrike
  3. API Docs
  4. DefaultPreventionPolicyLinux
CrowdStrike v0.0.12 published on Thursday, Apr 3, 2025 by CrowdStrike
crowdstrike/pulumi-crowdstrike

crowdstrike.DefaultPreventionPolicyLinux

Explore with Pulumi AI

CrowdStrike v0.0.12 published on Thursday, Apr 3, 2025 by CrowdStrike
crowdstrike/pulumi-crowdstrike

This resource allows you to manage the default prevention policy for Linux hosts. Prevention policies allow you to manage what activity will trigger detections and preventions on your hosts.

API Scopes

The following API scopes are required:

  • Prevention policies | Read & Write

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as crowdstrike from "@crowdstrike/pulumi";

const _default = new crowdstrike.DefaultPreventionPolicyLinux("default", {
    description: "managed by terraform",
    ioaRuleGroups: [],
    cloudAntiMalware: {
        detection: "MODERATE",
        prevention: "CAUTIOUS",
    },
    sensorAntiMalware: {
        detection: "MODERATE",
        prevention: "CAUTIOUS",
    },
    quarantine: true,
    customBlocking: true,
    preventSuspiciousProcesses: true,
    scriptBasedExecutionMonitoring: true,
    uploadUnknownExecutables: true,
    uploadUnknownDetectionRelatedExecutables: true,
    driftPrevention: true,
    emailProtocolVisibility: true,
    filesystemVisibility: true,
    ftpVisibility: true,
    httpVisibility: true,
    networkVisibility: true,
    tlsVisibility: true,
    sensorTamperingProtection: true,
    onWriteScriptFileVisibility: true,
    memoryVisibility: true,
    extendedCommandLineVisibility: true,
});
export const defaultPreventionPolicyLinux = _default;
Copy
import pulumi
import crowdstrike_pulumi as crowdstrike

default = crowdstrike.DefaultPreventionPolicyLinux("default",
    description="managed by terraform",
    ioa_rule_groups=[],
    cloud_anti_malware={
        "detection": "MODERATE",
        "prevention": "CAUTIOUS",
    },
    sensor_anti_malware={
        "detection": "MODERATE",
        "prevention": "CAUTIOUS",
    },
    quarantine=True,
    custom_blocking=True,
    prevent_suspicious_processes=True,
    script_based_execution_monitoring=True,
    upload_unknown_executables=True,
    upload_unknown_detection_related_executables=True,
    drift_prevention=True,
    email_protocol_visibility=True,
    filesystem_visibility=True,
    ftp_visibility=True,
    http_visibility=True,
    network_visibility=True,
    tls_visibility=True,
    sensor_tampering_protection=True,
    on_write_script_file_visibility=True,
    memory_visibility=True,
    extended_command_line_visibility=True)
pulumi.export("defaultPreventionPolicyLinux", default)
Copy
package main

import (
	"github.com/crowdstrike/pulumi-crowdstrike/sdk/go/crowdstrike"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := crowdstrike.NewDefaultPreventionPolicyLinux(ctx, "default", &crowdstrike.DefaultPreventionPolicyLinuxArgs{
			Description:   pulumi.String("managed by terraform"),
			IoaRuleGroups: pulumi.StringArray{},
			CloudAntiMalware: &crowdstrike.DefaultPreventionPolicyLinuxCloudAntiMalwareArgs{
				Detection:  pulumi.String("MODERATE"),
				Prevention: pulumi.String("CAUTIOUS"),
			},
			SensorAntiMalware: &crowdstrike.DefaultPreventionPolicyLinuxSensorAntiMalwareArgs{
				Detection:  pulumi.String("MODERATE"),
				Prevention: pulumi.String("CAUTIOUS"),
			},
			Quarantine:                               pulumi.Bool(true),
			CustomBlocking:                           pulumi.Bool(true),
			PreventSuspiciousProcesses:               pulumi.Bool(true),
			ScriptBasedExecutionMonitoring:           pulumi.Bool(true),
			UploadUnknownExecutables:                 pulumi.Bool(true),
			UploadUnknownDetectionRelatedExecutables: pulumi.Bool(true),
			DriftPrevention:                          pulumi.Bool(true),
			EmailProtocolVisibility:                  pulumi.Bool(true),
			FilesystemVisibility:                     pulumi.Bool(true),
			FtpVisibility:                            pulumi.Bool(true),
			HttpVisibility:                           pulumi.Bool(true),
			NetworkVisibility:                        pulumi.Bool(true),
			TlsVisibility:                            pulumi.Bool(true),
			SensorTamperingProtection:                pulumi.Bool(true),
			OnWriteScriptFileVisibility:              pulumi.Bool(true),
			MemoryVisibility:                         pulumi.Bool(true),
			ExtendedCommandLineVisibility:            pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		ctx.Export("defaultPreventionPolicyLinux", _default)
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Crowdstrike = CrowdStrike.Crowdstrike;

return await Deployment.RunAsync(() => 
{
    var @default = new Crowdstrike.DefaultPreventionPolicyLinux("default", new()
    {
        Description = "managed by terraform",
        IoaRuleGroups = new[] {},
        CloudAntiMalware = new Crowdstrike.Inputs.DefaultPreventionPolicyLinuxCloudAntiMalwareArgs
        {
            Detection = "MODERATE",
            Prevention = "CAUTIOUS",
        },
        SensorAntiMalware = new Crowdstrike.Inputs.DefaultPreventionPolicyLinuxSensorAntiMalwareArgs
        {
            Detection = "MODERATE",
            Prevention = "CAUTIOUS",
        },
        Quarantine = true,
        CustomBlocking = true,
        PreventSuspiciousProcesses = true,
        ScriptBasedExecutionMonitoring = true,
        UploadUnknownExecutables = true,
        UploadUnknownDetectionRelatedExecutables = true,
        DriftPrevention = true,
        EmailProtocolVisibility = true,
        FilesystemVisibility = true,
        FtpVisibility = true,
        HttpVisibility = true,
        NetworkVisibility = true,
        TlsVisibility = true,
        SensorTamperingProtection = true,
        OnWriteScriptFileVisibility = true,
        MemoryVisibility = true,
        ExtendedCommandLineVisibility = true,
    });

    return new Dictionary<string, object?>
    {
        ["defaultPreventionPolicyLinux"] = @default,
    };
});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.crowdstrike.DefaultPreventionPolicyLinux;
import com.pulumi.crowdstrike.DefaultPreventionPolicyLinuxArgs;
import com.pulumi.crowdstrike.inputs.DefaultPreventionPolicyLinuxCloudAntiMalwareArgs;
import com.pulumi.crowdstrike.inputs.DefaultPreventionPolicyLinuxSensorAntiMalwareArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new DefaultPreventionPolicyLinux("default", DefaultPreventionPolicyLinuxArgs.builder()
            .description("managed by terraform")
            .ioaRuleGroups()
            .cloudAntiMalware(DefaultPreventionPolicyLinuxCloudAntiMalwareArgs.builder()
%!v(PANIC=Format method: interface conversion: model.Expression is *model.TemplateExpression, not *model.LiteralValueExpression))
                .sensorAntiMalware(DefaultPreventionPolicyLinuxSensorAntiMalwareArgs.builder()
%!v(PANIC=Format method: interface conversion: model.Expression is *model.TemplateExpression, not *model.LiteralValueExpression))
                    .quarantine(true)
                    .customBlocking(true)
                    .preventSuspiciousProcesses(true)
                    .scriptBasedExecutionMonitoring(true)
                    .uploadUnknownExecutables(true)
                    .uploadUnknownDetectionRelatedExecutables(true)
                    .driftPrevention(true)
                    .emailProtocolVisibility(true)
                    .filesystemVisibility(true)
                    .ftpVisibility(true)
                    .httpVisibility(true)
                    .networkVisibility(true)
                    .tlsVisibility(true)
                    .sensorTamperingProtection(true)
                    .onWriteScriptFileVisibility(true)
                    .memoryVisibility(true)
                    .extendedCommandLineVisibility(true)
                    .build());

                ctx.export("defaultPreventionPolicyLinux", default_);
            }
}
Copy
resources:
  default:
    type: crowdstrike:DefaultPreventionPolicyLinux
    properties:
      description: managed by terraform
      ioaRuleGroups: []
      cloudAntiMalware:
        detection: MODERATE
        prevention: CAUTIOUS
      sensorAntiMalware:
        detection: MODERATE
        prevention: CAUTIOUS
      quarantine: true
      customBlocking: true
      preventSuspiciousProcesses: true
      scriptBasedExecutionMonitoring: true
      uploadUnknownExecutables: true
      uploadUnknownDetectionRelatedExecutables: true
      driftPrevention: true
      emailProtocolVisibility: true
      filesystemVisibility: true
      ftpVisibility: true
      httpVisibility: true
      networkVisibility: true
      tlsVisibility: true
      sensorTamperingProtection: true
      onWriteScriptFileVisibility: true
      memoryVisibility: true
      extendedCommandLineVisibility: true
outputs:
  defaultPreventionPolicyLinux: ${default}
Copy

Create DefaultPreventionPolicyLinux Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new DefaultPreventionPolicyLinux(name: string, args: DefaultPreventionPolicyLinuxArgs, opts?: CustomResourceOptions);
@overload
def DefaultPreventionPolicyLinux(resource_name: str,
                                 args: DefaultPreventionPolicyLinuxArgs,
                                 opts: Optional[ResourceOptions] = None)

@overload
def DefaultPreventionPolicyLinux(resource_name: str,
                                 opts: Optional[ResourceOptions] = None,
                                 ioa_rule_groups: Optional[Sequence[str]] = None,
                                 memory_visibility: Optional[bool] = None,
                                 tls_visibility: Optional[bool] = None,
                                 drift_prevention: Optional[bool] = None,
                                 email_protocol_visibility: Optional[bool] = None,
                                 extended_command_line_visibility: Optional[bool] = None,
                                 filesystem_visibility: Optional[bool] = None,
                                 ftp_visibility: Optional[bool] = None,
                                 network_visibility: Optional[bool] = None,
                                 upload_unknown_executables: Optional[bool] = None,
                                 description: Optional[str] = None,
                                 http_visibility: Optional[bool] = None,
                                 on_write_script_file_visibility: Optional[bool] = None,
                                 prevent_suspicious_processes: Optional[bool] = None,
                                 quarantine: Optional[bool] = None,
                                 script_based_execution_monitoring: Optional[bool] = None,
                                 sensor_anti_malware: Optional[DefaultPreventionPolicyLinuxSensorAntiMalwareArgs] = None,
                                 sensor_tampering_protection: Optional[bool] = None,
                                 cloud_anti_malware: Optional[DefaultPreventionPolicyLinuxCloudAntiMalwareArgs] = None,
                                 upload_unknown_detection_related_executables: Optional[bool] = None,
                                 custom_blocking: Optional[bool] = None)
func NewDefaultPreventionPolicyLinux(ctx *Context, name string, args DefaultPreventionPolicyLinuxArgs, opts ...ResourceOption) (*DefaultPreventionPolicyLinux, error)
public DefaultPreventionPolicyLinux(string name, DefaultPreventionPolicyLinuxArgs args, CustomResourceOptions? opts = null)
public DefaultPreventionPolicyLinux(String name, DefaultPreventionPolicyLinuxArgs args)
public DefaultPreventionPolicyLinux(String name, DefaultPreventionPolicyLinuxArgs args, CustomResourceOptions options)

type: crowdstrike:DefaultPreventionPolicyLinux
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. DefaultPreventionPolicyLinuxArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. DefaultPreventionPolicyLinuxArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. DefaultPreventionPolicyLinuxArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. DefaultPreventionPolicyLinuxArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. DefaultPreventionPolicyLinuxArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var defaultPreventionPolicyLinuxResource = new Crowdstrike.DefaultPreventionPolicyLinux("defaultPreventionPolicyLinuxResource", new()
{
    IoaRuleGroups = new[]
    {
        "string",
    },
    MemoryVisibility = false,
    TlsVisibility = false,
    DriftPrevention = false,
    EmailProtocolVisibility = false,
    ExtendedCommandLineVisibility = false,
    FilesystemVisibility = false,
    FtpVisibility = false,
    NetworkVisibility = false,
    UploadUnknownExecutables = false,
    Description = "string",
    HttpVisibility = false,
    OnWriteScriptFileVisibility = false,
    PreventSuspiciousProcesses = false,
    Quarantine = false,
    ScriptBasedExecutionMonitoring = false,
    SensorAntiMalware = new Crowdstrike.Inputs.DefaultPreventionPolicyLinuxSensorAntiMalwareArgs
    {
        Detection = "string",
        Prevention = "string",
    },
    SensorTamperingProtection = false,
    CloudAntiMalware = new Crowdstrike.Inputs.DefaultPreventionPolicyLinuxCloudAntiMalwareArgs
    {
        Detection = "string",
        Prevention = "string",
    },
    UploadUnknownDetectionRelatedExecutables = false,
    CustomBlocking = false,
});
Copy
example, err := crowdstrike.NewDefaultPreventionPolicyLinux(ctx, "defaultPreventionPolicyLinuxResource", &crowdstrike.DefaultPreventionPolicyLinuxArgs{
	IoaRuleGroups: pulumi.StringArray{
		pulumi.String("string"),
	},
	MemoryVisibility:               pulumi.Bool(false),
	TlsVisibility:                  pulumi.Bool(false),
	DriftPrevention:                pulumi.Bool(false),
	EmailProtocolVisibility:        pulumi.Bool(false),
	ExtendedCommandLineVisibility:  pulumi.Bool(false),
	FilesystemVisibility:           pulumi.Bool(false),
	FtpVisibility:                  pulumi.Bool(false),
	NetworkVisibility:              pulumi.Bool(false),
	UploadUnknownExecutables:       pulumi.Bool(false),
	Description:                    pulumi.String("string"),
	HttpVisibility:                 pulumi.Bool(false),
	OnWriteScriptFileVisibility:    pulumi.Bool(false),
	PreventSuspiciousProcesses:     pulumi.Bool(false),
	Quarantine:                     pulumi.Bool(false),
	ScriptBasedExecutionMonitoring: pulumi.Bool(false),
	SensorAntiMalware: &crowdstrike.DefaultPreventionPolicyLinuxSensorAntiMalwareArgs{
		Detection:  pulumi.String("string"),
		Prevention: pulumi.String("string"),
	},
	SensorTamperingProtection: pulumi.Bool(false),
	CloudAntiMalware: &crowdstrike.DefaultPreventionPolicyLinuxCloudAntiMalwareArgs{
		Detection:  pulumi.String("string"),
		Prevention: pulumi.String("string"),
	},
	UploadUnknownDetectionRelatedExecutables: pulumi.Bool(false),
	CustomBlocking:                           pulumi.Bool(false),
})
Copy
var defaultPreventionPolicyLinuxResource = new DefaultPreventionPolicyLinux("defaultPreventionPolicyLinuxResource", DefaultPreventionPolicyLinuxArgs.builder()
    .ioaRuleGroups("string")
    .memoryVisibility(false)
    .tlsVisibility(false)
    .driftPrevention(false)
    .emailProtocolVisibility(false)
    .extendedCommandLineVisibility(false)
    .filesystemVisibility(false)
    .ftpVisibility(false)
    .networkVisibility(false)
    .uploadUnknownExecutables(false)
    .description("string")
    .httpVisibility(false)
    .onWriteScriptFileVisibility(false)
    .preventSuspiciousProcesses(false)
    .quarantine(false)
    .scriptBasedExecutionMonitoring(false)
    .sensorAntiMalware(DefaultPreventionPolicyLinuxSensorAntiMalwareArgs.builder()
        .detection("string")
        .prevention("string")
        .build())
    .sensorTamperingProtection(false)
    .cloudAntiMalware(DefaultPreventionPolicyLinuxCloudAntiMalwareArgs.builder()
        .detection("string")
        .prevention("string")
        .build())
    .uploadUnknownDetectionRelatedExecutables(false)
    .customBlocking(false)
    .build());
Copy
default_prevention_policy_linux_resource = crowdstrike.DefaultPreventionPolicyLinux("defaultPreventionPolicyLinuxResource",
    ioa_rule_groups=["string"],
    memory_visibility=False,
    tls_visibility=False,
    drift_prevention=False,
    email_protocol_visibility=False,
    extended_command_line_visibility=False,
    filesystem_visibility=False,
    ftp_visibility=False,
    network_visibility=False,
    upload_unknown_executables=False,
    description="string",
    http_visibility=False,
    on_write_script_file_visibility=False,
    prevent_suspicious_processes=False,
    quarantine=False,
    script_based_execution_monitoring=False,
    sensor_anti_malware={
        "detection": "string",
        "prevention": "string",
    },
    sensor_tampering_protection=False,
    cloud_anti_malware={
        "detection": "string",
        "prevention": "string",
    },
    upload_unknown_detection_related_executables=False,
    custom_blocking=False)
Copy
const defaultPreventionPolicyLinuxResource = new crowdstrike.DefaultPreventionPolicyLinux("defaultPreventionPolicyLinuxResource", {
    ioaRuleGroups: ["string"],
    memoryVisibility: false,
    tlsVisibility: false,
    driftPrevention: false,
    emailProtocolVisibility: false,
    extendedCommandLineVisibility: false,
    filesystemVisibility: false,
    ftpVisibility: false,
    networkVisibility: false,
    uploadUnknownExecutables: false,
    description: "string",
    httpVisibility: false,
    onWriteScriptFileVisibility: false,
    preventSuspiciousProcesses: false,
    quarantine: false,
    scriptBasedExecutionMonitoring: false,
    sensorAntiMalware: {
        detection: "string",
        prevention: "string",
    },
    sensorTamperingProtection: false,
    cloudAntiMalware: {
        detection: "string",
        prevention: "string",
    },
    uploadUnknownDetectionRelatedExecutables: false,
    customBlocking: false,
});
Copy
type: crowdstrike:DefaultPreventionPolicyLinux
properties:
    cloudAntiMalware:
        detection: string
        prevention: string
    customBlocking: false
    description: string
    driftPrevention: false
    emailProtocolVisibility: false
    extendedCommandLineVisibility: false
    filesystemVisibility: false
    ftpVisibility: false
    httpVisibility: false
    ioaRuleGroups:
        - string
    memoryVisibility: false
    networkVisibility: false
    onWriteScriptFileVisibility: false
    preventSuspiciousProcesses: false
    quarantine: false
    scriptBasedExecutionMonitoring: false
    sensorAntiMalware:
        detection: string
        prevention: string
    sensorTamperingProtection: false
    tlsVisibility: false
    uploadUnknownDetectionRelatedExecutables: false
    uploadUnknownExecutables: false
Copy

DefaultPreventionPolicyLinux Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The DefaultPreventionPolicyLinux resource accepts the following input properties:

IoaRuleGroups This property is required. List<string>
IOA Rule Group to attach to the prevention policy.
CloudAntiMalware CrowdStrike.Crowdstrike.Inputs.DefaultPreventionPolicyLinuxCloudAntiMalware
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
CustomBlocking bool
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
Description string
Description of the prevention policy.
DriftPrevention bool
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
EmailProtocolVisibility bool
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
ExtendedCommandLineVisibility bool
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
FilesystemVisibility bool
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
FtpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
HttpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
MemoryVisibility bool
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
NetworkVisibility bool
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
OnWriteScriptFileVisibility bool
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
PreventSuspiciousProcesses bool
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
Quarantine bool
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
ScriptBasedExecutionMonitoring bool
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
SensorAntiMalware CrowdStrike.Crowdstrike.Inputs.DefaultPreventionPolicyLinuxSensorAntiMalware
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
SensorTamperingProtection bool
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
TlsVisibility bool
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
UploadUnknownDetectionRelatedExecutables bool
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
UploadUnknownExecutables bool
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
IoaRuleGroups This property is required. []string
IOA Rule Group to attach to the prevention policy.
CloudAntiMalware DefaultPreventionPolicyLinuxCloudAntiMalwareArgs
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
CustomBlocking bool
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
Description string
Description of the prevention policy.
DriftPrevention bool
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
EmailProtocolVisibility bool
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
ExtendedCommandLineVisibility bool
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
FilesystemVisibility bool
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
FtpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
HttpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
MemoryVisibility bool
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
NetworkVisibility bool
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
OnWriteScriptFileVisibility bool
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
PreventSuspiciousProcesses bool
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
Quarantine bool
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
ScriptBasedExecutionMonitoring bool
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
SensorAntiMalware DefaultPreventionPolicyLinuxSensorAntiMalwareArgs
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
SensorTamperingProtection bool
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
TlsVisibility bool
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
UploadUnknownDetectionRelatedExecutables bool
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
UploadUnknownExecutables bool
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
ioaRuleGroups This property is required. List<String>
IOA Rule Group to attach to the prevention policy.
cloudAntiMalware DefaultPreventionPolicyLinuxCloudAntiMalware
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
customBlocking Boolean
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description String
Description of the prevention policy.
driftPrevention Boolean
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
emailProtocolVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extendedCommandLineVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystemVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
httpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
memoryVisibility Boolean
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
networkVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
onWriteScriptFileVisibility Boolean
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
preventSuspiciousProcesses Boolean
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine Boolean
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
scriptBasedExecutionMonitoring Boolean
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensorAntiMalware DefaultPreventionPolicyLinuxSensorAntiMalware
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensorTamperingProtection Boolean
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tlsVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
uploadUnknownDetectionRelatedExecutables Boolean
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
uploadUnknownExecutables Boolean
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
ioaRuleGroups This property is required. string[]
IOA Rule Group to attach to the prevention policy.
cloudAntiMalware DefaultPreventionPolicyLinuxCloudAntiMalware
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
customBlocking boolean
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description string
Description of the prevention policy.
driftPrevention boolean
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
emailProtocolVisibility boolean
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extendedCommandLineVisibility boolean
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystemVisibility boolean
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftpVisibility boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
httpVisibility boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
memoryVisibility boolean
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
networkVisibility boolean
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
onWriteScriptFileVisibility boolean
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
preventSuspiciousProcesses boolean
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine boolean
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
scriptBasedExecutionMonitoring boolean
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensorAntiMalware DefaultPreventionPolicyLinuxSensorAntiMalware
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensorTamperingProtection boolean
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tlsVisibility boolean
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
uploadUnknownDetectionRelatedExecutables boolean
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
uploadUnknownExecutables boolean
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
ioa_rule_groups This property is required. Sequence[str]
IOA Rule Group to attach to the prevention policy.
cloud_anti_malware DefaultPreventionPolicyLinuxCloudAntiMalwareArgs
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
custom_blocking bool
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description str
Description of the prevention policy.
drift_prevention bool
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
email_protocol_visibility bool
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extended_command_line_visibility bool
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystem_visibility bool
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftp_visibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
http_visibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
memory_visibility bool
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
network_visibility bool
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
on_write_script_file_visibility bool
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
prevent_suspicious_processes bool
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine bool
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
script_based_execution_monitoring bool
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensor_anti_malware DefaultPreventionPolicyLinuxSensorAntiMalwareArgs
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensor_tampering_protection bool
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tls_visibility bool
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
upload_unknown_detection_related_executables bool
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
upload_unknown_executables bool
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
ioaRuleGroups This property is required. List<String>
IOA Rule Group to attach to the prevention policy.
cloudAntiMalware Property Map
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
customBlocking Boolean
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description String
Description of the prevention policy.
driftPrevention Boolean
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
emailProtocolVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extendedCommandLineVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystemVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
httpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
memoryVisibility Boolean
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
networkVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
onWriteScriptFileVisibility Boolean
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
preventSuspiciousProcesses Boolean
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine Boolean
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
scriptBasedExecutionMonitoring Boolean
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensorAntiMalware Property Map
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensorTamperingProtection Boolean
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tlsVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
uploadUnknownDetectionRelatedExecutables Boolean
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
uploadUnknownExecutables Boolean
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.

Outputs

All input properties are implicitly available as output properties. Additionally, the DefaultPreventionPolicyLinux resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
LastUpdated string
Id string
The provider-assigned unique ID for this managed resource.
LastUpdated string
id String
The provider-assigned unique ID for this managed resource.
lastUpdated String
id string
The provider-assigned unique ID for this managed resource.
lastUpdated string
id str
The provider-assigned unique ID for this managed resource.
last_updated str
id String
The provider-assigned unique ID for this managed resource.
lastUpdated String

Look up Existing DefaultPreventionPolicyLinux Resource

Get an existing DefaultPreventionPolicyLinux resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: DefaultPreventionPolicyLinuxState, opts?: CustomResourceOptions): DefaultPreventionPolicyLinux
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cloud_anti_malware: Optional[DefaultPreventionPolicyLinuxCloudAntiMalwareArgs] = None,
        custom_blocking: Optional[bool] = None,
        description: Optional[str] = None,
        drift_prevention: Optional[bool] = None,
        email_protocol_visibility: Optional[bool] = None,
        extended_command_line_visibility: Optional[bool] = None,
        filesystem_visibility: Optional[bool] = None,
        ftp_visibility: Optional[bool] = None,
        http_visibility: Optional[bool] = None,
        ioa_rule_groups: Optional[Sequence[str]] = None,
        last_updated: Optional[str] = None,
        memory_visibility: Optional[bool] = None,
        network_visibility: Optional[bool] = None,
        on_write_script_file_visibility: Optional[bool] = None,
        prevent_suspicious_processes: Optional[bool] = None,
        quarantine: Optional[bool] = None,
        script_based_execution_monitoring: Optional[bool] = None,
        sensor_anti_malware: Optional[DefaultPreventionPolicyLinuxSensorAntiMalwareArgs] = None,
        sensor_tampering_protection: Optional[bool] = None,
        tls_visibility: Optional[bool] = None,
        upload_unknown_detection_related_executables: Optional[bool] = None,
        upload_unknown_executables: Optional[bool] = None) -> DefaultPreventionPolicyLinux
func GetDefaultPreventionPolicyLinux(ctx *Context, name string, id IDInput, state *DefaultPreventionPolicyLinuxState, opts ...ResourceOption) (*DefaultPreventionPolicyLinux, error)
public static DefaultPreventionPolicyLinux Get(string name, Input<string> id, DefaultPreventionPolicyLinuxState? state, CustomResourceOptions? opts = null)
public static DefaultPreventionPolicyLinux get(String name, Output<String> id, DefaultPreventionPolicyLinuxState state, CustomResourceOptions options)
resources:  _:    type: crowdstrike:DefaultPreventionPolicyLinux    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
CloudAntiMalware CrowdStrike.Crowdstrike.Inputs.DefaultPreventionPolicyLinuxCloudAntiMalware
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
CustomBlocking bool
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
Description string
Description of the prevention policy.
DriftPrevention bool
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
EmailProtocolVisibility bool
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
ExtendedCommandLineVisibility bool
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
FilesystemVisibility bool
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
FtpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
HttpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
IoaRuleGroups List<string>
IOA Rule Group to attach to the prevention policy.
LastUpdated string
MemoryVisibility bool
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
NetworkVisibility bool
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
OnWriteScriptFileVisibility bool
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
PreventSuspiciousProcesses bool
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
Quarantine bool
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
ScriptBasedExecutionMonitoring bool
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
SensorAntiMalware CrowdStrike.Crowdstrike.Inputs.DefaultPreventionPolicyLinuxSensorAntiMalware
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
SensorTamperingProtection bool
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
TlsVisibility bool
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
UploadUnknownDetectionRelatedExecutables bool
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
UploadUnknownExecutables bool
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
CloudAntiMalware DefaultPreventionPolicyLinuxCloudAntiMalwareArgs
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
CustomBlocking bool
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
Description string
Description of the prevention policy.
DriftPrevention bool
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
EmailProtocolVisibility bool
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
ExtendedCommandLineVisibility bool
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
FilesystemVisibility bool
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
FtpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
HttpVisibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
IoaRuleGroups []string
IOA Rule Group to attach to the prevention policy.
LastUpdated string
MemoryVisibility bool
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
NetworkVisibility bool
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
OnWriteScriptFileVisibility bool
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
PreventSuspiciousProcesses bool
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
Quarantine bool
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
ScriptBasedExecutionMonitoring bool
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
SensorAntiMalware DefaultPreventionPolicyLinuxSensorAntiMalwareArgs
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
SensorTamperingProtection bool
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
TlsVisibility bool
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
UploadUnknownDetectionRelatedExecutables bool
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
UploadUnknownExecutables bool
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
cloudAntiMalware DefaultPreventionPolicyLinuxCloudAntiMalware
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
customBlocking Boolean
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description String
Description of the prevention policy.
driftPrevention Boolean
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
emailProtocolVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extendedCommandLineVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystemVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
httpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
ioaRuleGroups List<String>
IOA Rule Group to attach to the prevention policy.
lastUpdated String
memoryVisibility Boolean
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
networkVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
onWriteScriptFileVisibility Boolean
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
preventSuspiciousProcesses Boolean
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine Boolean
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
scriptBasedExecutionMonitoring Boolean
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensorAntiMalware DefaultPreventionPolicyLinuxSensorAntiMalware
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensorTamperingProtection Boolean
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tlsVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
uploadUnknownDetectionRelatedExecutables Boolean
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
uploadUnknownExecutables Boolean
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
cloudAntiMalware DefaultPreventionPolicyLinuxCloudAntiMalware
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
customBlocking boolean
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description string
Description of the prevention policy.
driftPrevention boolean
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
emailProtocolVisibility boolean
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extendedCommandLineVisibility boolean
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystemVisibility boolean
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftpVisibility boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
httpVisibility boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
ioaRuleGroups string[]
IOA Rule Group to attach to the prevention policy.
lastUpdated string
memoryVisibility boolean
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
networkVisibility boolean
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
onWriteScriptFileVisibility boolean
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
preventSuspiciousProcesses boolean
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine boolean
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
scriptBasedExecutionMonitoring boolean
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensorAntiMalware DefaultPreventionPolicyLinuxSensorAntiMalware
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensorTamperingProtection boolean
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tlsVisibility boolean
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
uploadUnknownDetectionRelatedExecutables boolean
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
uploadUnknownExecutables boolean
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
cloud_anti_malware DefaultPreventionPolicyLinuxCloudAntiMalwareArgs
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
custom_blocking bool
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description str
Description of the prevention policy.
drift_prevention bool
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
email_protocol_visibility bool
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extended_command_line_visibility bool
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystem_visibility bool
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftp_visibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
http_visibility bool
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
ioa_rule_groups Sequence[str]
IOA Rule Group to attach to the prevention policy.
last_updated str
memory_visibility bool
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
network_visibility bool
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
on_write_script_file_visibility bool
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
prevent_suspicious_processes bool
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine bool
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
script_based_execution_monitoring bool
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensor_anti_malware DefaultPreventionPolicyLinuxSensorAntiMalwareArgs
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensor_tampering_protection bool
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tls_visibility bool
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
upload_unknown_detection_related_executables bool
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
upload_unknown_executables bool
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.
cloudAntiMalware Property Map
Use cloud-based machine learning informed by global analysis of executables to detect and prevent known malware for your online hosts.
customBlocking Boolean
Whether to enable the setting. Block processes matching hashes that you add to IOC Management with the action set to "Block" or "Block, hide detection".
description String
Description of the prevention policy.
driftPrevention Boolean
Whether to enable the setting. Block new processes originating from files written in a container. This prevents a container from drifting from its immutable runtime state.
emailProtocolVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor SMTP, IMAP, and POP3 traffic for malicious patterns and improved detections.
extendedCommandLineVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor full CLI commands that include pipes and redirects. This is applicable only for User mode.
filesystemVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor filesystem activity for additional telemetry and improved detections.
ftpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted FTP traffic for malicious patterns and improved detections.
httpVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor unencrypted HTTP traffic for malicious patterns and improved detections.
ioaRuleGroups List<String>
IOA Rule Group to attach to the prevention policy.
lastUpdated String
memoryVisibility Boolean
Whether to enable the setting. When enabled, the sensor will inspect memory-related operations: mmap, mprotect, ptrace and reading/writing remote process memory and produce events.
networkVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor network activity for additional telemetry and improved detections.
onWriteScriptFileVisibility Boolean
Whether to enable the setting. Provides improved visibility into various script files being written to disk in addition to clouding a portion of their content.
preventSuspiciousProcesses Boolean
Whether to enable the setting. Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.
quarantine Boolean
Whether to enable the setting. Quarantine executable files after they’re prevented by NGAV. When this is enabled, we recommend setting anti-malware prevention levels to Moderate or higher and not using other antivirus solutions.
scriptBasedExecutionMonitoring Boolean
Whether to enable the setting. Provides visibility into suspicious scripts, including shell and other scripting languages.
sensorAntiMalware Property Map
For offline and online hosts, use sensor-based machine learning to identify and analyze unknown executables as they run to detect and prevent malware.
sensorTamperingProtection Boolean
Whether to enable the setting. Block attempts to tamper with the sensor by protecting critical components and resources. If disabled, the sensor still creates detections for tampering attempts but will not prevent the activity from occurring. Disabling is not recommended.
tlsVisibility Boolean
Whether to enable the setting. Allows the sensor to monitor TLS traffic for malicious patterns and improved detections.
uploadUnknownDetectionRelatedExecutables Boolean
Whether to enable the setting. Upload all unknown detection-related executables for advanced analysis in the cloud.
uploadUnknownExecutables Boolean
Whether to enable the setting. Upload all unknown executables for advanced analysis in the cloud.

Supporting Types

DefaultPreventionPolicyLinuxCloudAntiMalware
, DefaultPreventionPolicyLinuxCloudAntiMalwareArgs

Detection This property is required. string
Machine learning level for detection.
Prevention This property is required. string
Machine learning level for prevention.
Detection This property is required. string
Machine learning level for detection.
Prevention This property is required. string
Machine learning level for prevention.
detection This property is required. String
Machine learning level for detection.
prevention This property is required. String
Machine learning level for prevention.
detection This property is required. string
Machine learning level for detection.
prevention This property is required. string
Machine learning level for prevention.
detection This property is required. str
Machine learning level for detection.
prevention This property is required. str
Machine learning level for prevention.
detection This property is required. String
Machine learning level for detection.
prevention This property is required. String
Machine learning level for prevention.

DefaultPreventionPolicyLinuxSensorAntiMalware
, DefaultPreventionPolicyLinuxSensorAntiMalwareArgs

Detection This property is required. string
Machine learning level for detection.
Prevention This property is required. string
Machine learning level for prevention.
Detection This property is required. string
Machine learning level for detection.
Prevention This property is required. string
Machine learning level for prevention.
detection This property is required. String
Machine learning level for detection.
prevention This property is required. String
Machine learning level for prevention.
detection This property is required. string
Machine learning level for detection.
prevention This property is required. string
Machine learning level for prevention.
detection This property is required. str
Machine learning level for detection.
prevention This property is required. str
Machine learning level for prevention.
detection This property is required. String
Machine learning level for detection.
prevention This property is required. String
Machine learning level for prevention.

Import

The mac default prevention policy can be imported by specifying the id.

$ pulumi import crowdstrike:index/defaultPreventionPolicyLinux:DefaultPreventionPolicyLinux default 7fb858a949034a0cbca175f660f1e769
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
crowdstrike crowdstrike/pulumi-crowdstrike
License
Apache-2.0
Notes
This Pulumi package is based on the crowdstrike Terraform Provider.
CrowdStrike v0.0.12 published on Thursday, Apr 3, 2025 by CrowdStrike
crowdstrike/pulumi-crowdstrike