CrowdStrike Device Control, Firewall Management, Web Filtering and DLP: What Falcon Covers

Searches for "crowdstrike device control", "crowdstrike firewall", "crowdstrike web filtering" and "crowdstrike dlp" are the same question asked four ways: which of the endpoint controls an IT team already runs through Intune, Jamf, Group Policy or an RMM does the Falcon sensor take over? This guide answers it module by module, with what each one does, which Falcon bundle includes it as of November 2026, and where the native OS tool or the RMM keeps the job. It also covers the cluster around those terms: FileVantage, application allowlisting, email security, Falcon for Mobile, browser security and the secure web gateway question.

TL;DR

• Device Control. USB, SD card and Thunderbolt policy in every bundle; host-based rules, no per-user exceptions.
• Firewall Management. A console for the native Windows, macOS and Linux host firewall, from Pro up.
• Web filtering. No URL-category module; FQDN rules, Seraphic browser controls, DNS or SWG filtering elsewhere.
• DLP. Falcon Data Security, a quoted module across endpoint, browser, SaaS and GenAI.
• Still yours. Profiles, software deployment and the patch catalog stay with UEM or RMM.

Six Controls, Four Modules

CrowdStrike's product pages do not use the vocabulary IT teams search with. Nobody at CrowdStrike writes "USB blocking" or "web filtering"; the modules are named Falcon Device Control, Falcon Firewall Management, Falcon Data Security and Falcon FileVantage, and two of the six controls people search for have no first-party module at all. The table maps the search terms to the module that answers them and to the tool that holds the job today.

Two things stand out in that table. First, the only control an IT team gets for free with the entry bundle is device control, so an Intune shop that buys Falcon Go gains a second place to write USB policy, not a replacement for its first one. Second, the controls that sound like network security (web filtering, secure web gateway, DDoS protection) are not endpoint modules in the Falcon catalog, which is why those searches lead to Marketplace partners rather than a CrowdStrike SKU.

Falcon Device Control: USB, SD Card, Thunderbolt and Bluetooth

Falcon Device Control is the removable-media module, and it ships inside every paid Falcon bundle including Go, per CrowdStrike's pricing page read on 9 November 2026. The 2025 data sheet describes the scope: USB devices and SD cards on all supported platforms, plus Bluetooth and Thunderbolt storage on macOS. The sensor reports device class, manufacturer, product name and serial number automatically, so the admin never has to pull a vendor ID out of Device Manager to write a rule.

Policies attach to host groups and allow or block by device class, vendor, product, serial number or a specific device ID, online or offline. A mass-storage rule can grant read and write, read-only, or block execution of applications from the drive while leaving file access alone. There is a monitor-only mode that shows which users would have been blocked before enforcement is switched on, and CrowdStrike's machine-learning classifier flags source code copied to removable media in more than 40 programming languages. Paired with Falcon Insight XDR, device events become searchable history: which drive, which host, which files were written.

The design decision that trips up migrating teams is that Device Control is host-based, full stop. A CrowdStrike employee confirmed it in a July 2025 r/crowdstrike thread from an admin moving off Sophos Intercept X, whose old policy let a named user plug in an approved stick on any machine they signed into: there are no user-based configuration options, the module enforces physical controls on the pluggable media, and the suggested path for per-person exceptions was the Identity and Data Protection modules. The practical pattern the thread's replies converge on is a global block on mass storage, an allowlist of encrypted company sticks by serial number, and host-level exceptions for the handful of machines that need open ports. One admin's four-step ladder, from full block through serial and class exceptions to no block, is the clearest summary of the policy space we have seen.

Compared with the native route, the trade is visibility against identity. Intune's device restriction profile and the Group Policy removable storage settings can block USB storage just as firmly, and Intune can target a user group, which Falcon cannot. What they do not give you is the file-level record of what was copied, the source-code detection, or a single search across Windows and macOS hosts. Teams that already pay for Falcon tend to move enforcement into Device Control for the logging and keep the Intune profile as a backstop so a sensor outage on one host does not reopen the ports.

Falcon Firewall Management: A Console for the Host Firewall

Falcon Firewall Management does not ship a firewall. It manages the one already in the operating system, which is the detail every r/crowdstrike thread on the module eventually states: on Windows it drives Windows Defender Firewall, so a rule written in the Falcon console is enforced by the same engine a Group Policy object would configure. The 2025 data sheet lists Windows, macOS and Linux, policy templates, reusable rule groups, wildcard FQDN and IP rules, application-aware and location-aware policies, rule validation, a monitor mode that reports what would have been blocked, and an audit trail of who changed which rule and when.

The FQDN point deserves a date. In a February 2025 thread asking whether the module could block an outbound connection to a named domain, a CrowdStrike staffer answered that it could not, while a customer in the same thread reported FQDN rules working in their tenant; by the 2025 data sheet, wildcard FQDN rules are a listed capability, and a May 2025 thread shows an admin configuring Address Type: FQDN in a live policy. Treat older forum answers on this module as dated. The same May 2025 thread also carries the most useful warning in the cluster: the admin set the policy default to Inbound: Block All to stop WhatsApp Web, and lost ping, printers and internal services across the test group until inbound was returned to Allow. Falcon's policy defaults replace the Windows profile defaults, so a rollout that starts in monitor mode and inherits the existing inbound posture is the safe order.

Where the module earns its place is precedence and reach. Windows Firewall through Group Policy has no rule ordering an admin can see, applies only to domain-joined machines on the domain network, and gives no central view of which rules matched. Falcon's console orders rules explicitly, follows the laptop onto hotel wifi, and shows matched rules per host. Admins in the February 2025 thread describe it as easier than Group Policy and as their choice for servers; one calls it nothing more than a manager for the Windows firewall, which is accurate and is also the point. A team that already manages its firewall through Intune's endpoint security profiles gives up less by staying put than a team still on Group Policy objects accumulated over a decade.

Web Filtering, URL Blocking and the Browser

As of November 2026, CrowdStrike's pricing page and endpoint catalog list no URL-category web filter, no secure web gateway and no DDoS product, so "crowdstrike web filtering" and "crowdstrike secure web gateway" describe integrations rather than modules. What Falcon can do natively is coarse: a wildcard FQDN block rule in Firewall Management stops a host reaching a named domain and everything under it, which handles a shortlist of banned sites but not categories, time windows or per-user policy. Category filtering for a managed fleet still comes from a DNS filtering service or a secure web gateway, and Zscaler, Netskope and Cloudflare all list Falcon integrations on the CrowdStrike Marketplace that share device posture with their proxies.

The browser is where CrowdStrike is moving. On 13 January 2026 the company announced an agreement to acquire Seraphic Security, whose technology enforces policy inside Chrome, Edge, Safari and Firefox on managed and unmanaged devices, and by November 2026 "Seraphic Enterprise Browser" appears in the Platform menu on crowdstrike.com. The pitch is in-session zero trust and web DLP for contractors and personal devices where no sensor can be installed. It is a browser security product, not a web filter: it governs what a session can do with data, not which categories of site a user may open.

Falcon Data Security: DLP on the Same Sensor

CrowdStrike's DLP module has had two names in fourteen months. At Fal.Con in September 2025 the company expanded Falcon Data Protection with real-time controls aimed at replacing legacy DLP and data security posture management tools; in March 2026 it introduced Falcon Data Security, and the en-us platform page now carries that name while regional pages still say Data Protection. The module runs on the existing sensor and extends into the browser, SaaS applications including Microsoft 365, generative AI tools and cloud storage, with classification done on the device by an AI model rather than by regular expressions written in advance.

That last point is the technical argument for buying DLP from the endpoint vendor. Classic DLP asks the admin to define what sensitive data looks like, then matches patterns as files move; Falcon Data Security classifies content on the host and ties the result to the identity, process and destination the sensor already sees, which is the same telemetry Device Control uses for its source-code detection. CrowdStrike's own page claims faster response and fewer hours spent on tuning, with the figures footnoted to customer interviews, so read them as vendor claims. Pricing is not on the public pricing page; the module is quoted, and the r/crowdstrike staffer in the USB thread above pointed the per-user exception question at this module because it can key policy to identity where Device Control cannot.

For a team choosing between Falcon Data Security and the DLP already inside Microsoft 365 or Google Workspace, the dividing line is scope. Purview and Workspace DLP see their own suites deeply and the endpoint only through their agents; Falcon sees the endpoint, browser and SaaS layer from one sensor and the Microsoft suite from the outside. Our roundup of data loss prevention software puts both approaches beside the standalone DLP vendors.

FileVantage, Allowlisting, Email, Mobile and the Rest of the Cluster

Falcon FileVantage is CrowdStrike's file integrity monitoring module, built for the PCI DSS and SOX requirement to record changes to critical files, folders and registry keys. It watches creation, modification and deletion in real time, ships predefined policies for operating system files, lets the admin set a severity per policy and switch noisy rules off, and pivots from a change event into CrowdStrike's threat intelligence. The FileVantage data sheet states that the module requires Falcon Insight, so it is an add-on to an EDR bundle rather than a standalone purchase.

Application allowlisting is the search term with no first-party answer. Falcon's native controls over executables are indicator blocklists, custom indicators of attack and machine-learning prevention, which stop known-bad and suspicious binaries but do not implement a default-deny list of approved software. Teams that want that model buy it from Airlock Digital or ThreatLocker, both of which sell Marketplace integrations that correlate allowlisting events with Falcon telemetry, or use AppLocker and Windows Defender Application Control on Windows. Email security follows the same pattern: CrowdStrike sells no mail gateway, and Marketplace partners cover the inbox while Falcon covers what happens after a click.

Falcon for Mobile is the exception that is included. Every bundle on the pricing page lists Mobile Device Protection for Android and iOS, which detects malicious activity on phones and tablets; it is not an MDM, so enrollment, Wi-Fi and VPN profiles and app deployment stay in Intune, Jamf or whichever MDM already owns the device. The data sheets for Device Control and Firewall Management both point to a supported operating systems page for exact version coverage, and that page, not the marketing copy, is what to read before a Linux or older macOS rollout. Our Falcon sensor guide covers how the agent itself installs and runs.

Pricing and Bundling, as of November 2026

Public list prices come from CrowdStrike's pricing page, read on 9 November 2026; the table shows which of the modules in this guide each bundle includes.

The footnotes on the same pricing page matter for small fleets: Falcon Go is capped at 100 devices, every bundle carries a 15-day free trial with no credit card, and a Black Friday sale window runs 23 November to 4 December 2026. The jump from Go to Pro is where Firewall Management arrives, which makes Pro the floor for a team that wants Falcon to own both the USB ports and the host firewall. Falcon Data Security and FileVantage are quoted, usually inside a Falcon Flex commitment, so budget for a conversation rather than a cart.

What Falcon for IT Adds, and What Intune, Jamf or an RMM Still Owns

Falcon for IT does not configure any of the controls above. What it adds is verification and repair: an osquery-based query across the fleet that returns which hosts have the firewall service stopped, BitLocker suspended or a USB policy missing, and a script action against the hosts the query returns. In our Falcon for IT review that loop is the module's strongest case, and it pairs naturally with Device Control and Firewall Management because the policies, the drift check and the fix all run through one sensor.

The jobs that stay outside Falcon are the ones a UEM or RMM was built for. Configuration profiles for Wi-Fi, VPN, certificates and browser settings live in Intune or Jamf. Software deployment, a maintained third-party patch catalog with maintenance windows, remote control for the help desk and per-client reporting live in the RMM. Device Control and Firewall Management are enforcement points; the tool that decides what a new laptop looks like on day one is still the management platform, and the sensible division is Falcon for the controls that need security telemetry behind them and the UEM or RMM for everything that needs a schedule, a reboot prompt or a client's name on the report.

Who It Fits

Device Control fits any Falcon customer with a USB policy to enforce, because it is already in the bundle and the file-level log is better than what Intune or Group Policy records. Firewall Management fits teams still managing Windows Firewall through Group Policy objects and teams with roaming laptops that leave the domain network, and it is a smaller gain for a team already running firewall policy through Intune. Falcon Data Security fits organizations that want DLP tied to endpoint identity and process context across browser and SaaS, and it is a quote and a project rather than a checkbox. Web filtering, allowlisting and email security are partner decisions, and the Falcon console is where their events land rather than where their policies are written.

The short answer: Falcon covers USB and host firewall enforcement in the bundle, DLP and file integrity as quoted modules, and nothing in the web filtering or allowlisting categories first-hand. Keep the UEM for profiles and the RMM for deployment, patching and reporting. Teams building an open, AI-native stack run Falcon for the controls and OpenFrame for the RMM, PSA and remediation side, at $1 a device a month with 10 million AI tokens included, per OpenFrame pricing. Flamingo builds OpenFrame, which competes with some of the tools covered here.

Keywords: crowdstrike device control, falcon device control, crowdstrike usb device control, crowdstrike firewall, crowdstrike falcon firewall management, falcon firewall management, crowdstrike web filtering, crowdstrike url filtering, crowdstrike dlp, crowdstrike data loss prevention, falcon data protection, crowdstrike falcon dlp, crowdstrike filevantage, crowdstrike file integrity monitoring, crowdstrike application whitelisting, crowdstrike email security, crowdstrike falcon for mobile, crowdstrike browser security, crowdstrike secure web gateway, crowdstrike ddos protection