> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Rules

Retrieves a list of rules according to the provided search query.

<Note>
  External Documentation

  To learn more, visit the [AlgoSec Firewall Analyzer documentation](https://techdocs.algosec.com/en/asms/a32.60/asms-help/content/api-guide/advancedsearch_full.htm).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
  | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Device Tree Name  | Tree name of the device. Can refer to a device, group or `ALL_FIREWALLS`. Can be obtained via `List Devices` action.                                                                                                                                                                                                                                                                                                                                                                                      |
  | Rule Search Query | Search query. The format for a simple query is: `[Column Name][Basic Operator][Value]`.<br /><br />For example: `Source ==1.2.3.4` which equals to `Source equals to "1.2.3.4"`.<br /><br />For further information regarding Advanced Search Query format, please refer to [AlgoSec Documentation](https://techdocs.algosec.com/en/asms/a32.60/asms-help/content/api-guide/advancedsearch_full.htm?tocpath=Suite%7CASMS%20API%20reference%7CAFA%20REST%20web%20services%7CRule%20data%20APIs%7C_____7#). |
  | Search Type       | Defines the type of the search to perform and the amount information to retrieve.<br /><br />  \* `Basic` - Returns only basic information on the rules. By default, search results are limited to 10,000 rules for basic search.<br /><br />  \* `Full` - Returns more information on the rules. By default, search results are limited to 5,000 rules for full search.                                                                                                                                  |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter           | Description                                                                                                                    |
  | ------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
  | Exact Match         | Determines whether to list **only** the objects that contain the **exact** IP address(es) or service(s) you are searching for. |
  | Include Any         | In addition to the search query, include rules that contain the value `Any` in any of the queried fields.                      |
  | Include Containment | Enhance the query to search additionally for objects that contain the searched object/IP address.                              |
</div>

## Example Output

```json theme={"dark"}
{
  "totalFoundRulesCount": 2,
  "devicesFoundBySearch": [
    {
      "deviceFoundRulesCount": 2,
      "deviceInfo": {
        "treeName": "Anemone_Meraki",
        "displayName": "Anemone1_Meraki",
        "brand": "ciscomeraki"
      },
      "foundRules": [
        {
          "criteriaMatch": [
            {
              "field": "Src. Address",
              "values": [
                "Any"
              ]
            }
          ],
          "rule": {
            "deviceId": 60400,
            "deviceDisplayName": "Anemone1_Meraki",
            "ruleId": "l3_inbound_rule_default",
            "ruleNum": "17",
            "source": [
              {
                "canonizedName": "Any",
                "invalidNamedObject": true
              }
            ],
            "isNegateSource": false,
            "destination": [
              {
                "canonizedName": "Any",
                "invalidNamedObject": true
              }
            ],
            "urlCategories": [
              {
                "canonizedName": "",
                "invalidNamedObject": true
              }
            ],
            "isNegateDestination": false,
            "service": [
              {
                "canonizedName": "Any",
                "invalidNamedObject": true
              }
            ],
            "isNegateService": false,
            "action": "",
            "comment": [
              "Default rule"
            ],
            "enable": "",
            "log": "",
            "link": "rule_l3_inbound_rule_default",
            "documentation": {
              "business criticality": "",
              "business partner": "",
              "documentation": "",
              "business applications": ""
            },
            "additionalData": {
              "group_policy_name": [
                {
                  "value": ""
                }
              ],
              "src_port": [
                {
                  "value": ""
                }
              ],
              "protocol": [
                {
                  "value": ""
                }
              ],
              "group_rulenum": [
                {
                  "value": ""
                }
              ],
              "dst_port": [
                {
                  "value": ""
                }
              ],
              "policy": [
                {
                  "value": "Deny"
                }
              ]
            },
            "isValidUserSourceModel": true
          }
        },
        {
          "criteriaMatch": [
            {
              "field": "Src. Address",
              "values": [
                "GroupPolicy_Public_GP_Clients"
              ]
            }
          ],
          "rule": {
            "deviceId": 40900,
            "deviceDisplayName": "Anemone1_Meraki",
            "ruleId": "Public_rule_1",
            "ruleNum": "8",
            "source": [
              {
                "canonizedName": "GroupPolicy_Public_GP_Clients",
                "invalidNamedObject": true
              }
            ],
            "isNegateSource": false,
            "destination": [
              {
                "canonizedName": "10.60.17.88/32",
                "invalidNamedObject": true
              }
            ],
            "urlCategories": [
              {
                "canonizedName": "",
                "invalidNamedObject": true
              }
            ],
            "isNegateDestination": false,
            "service": [
              {
                "canonizedName": "tcp/*/*",
                "invalidNamedObject": true
              }
            ],
            "isNegateService": false,
            "action": "",
            "comment": [
              "test drop"
            ],
            "enable": "",
            "log": "",
            "link": "rule_Public_rule_1",
            "documentation": {
              "business criticality": "",
              "business partner": "",
              "documentation": "",
              "business applications": ""
            },
            "additionalData": {
              "group_policy_name": [
                {
                  "value": "Public_GP"
                }
              ],
              "src_port": [
                {
                  "value": "Any"
                }
              ],
              "protocol": [
                {
                  "value": "TCP"
                }
              ],
              "group_rulenum": [
                {
                  "value": "1"
                }
              ],
              "dst_port": [
                {
                  "value": "Any"
                }
              ],
              "policy": [
                {
                  "value": "Deny"
                }
              ]
            },
            "isValidUserSourceModel": true
          }
        },
        {
          "criteriaMatch": [
            {
              "field": "Src. Address",
              "values": [
                "Any"
              ]
            }
          ],
          "rule": {
            "deviceId": 40900,
            "deviceDisplayName": "Anemone1_Meraki",
            "ruleId": "l3_outbound_rule_default",
            "ruleNum": "16",
            "source": [
              {
                "canonizedName": "Any",
                "invalidNamedObject": true
              }
            ],
            "isNegateSource": false,
            "destination": [
              {
                "canonizedName": "Any",
                "invalidNamedObject": true
              }
            ],
            "urlCategories": [
              {
                "canonizedName": "",
                "invalidNamedObject": true
              }
            ],
            "isNegateDestination": false,
            "service": [
              {
                "canonizedName": "Any",
                "invalidNamedObject": true
              }
            ],
            "isNegateService": false,
            "action": "",
            "comment": [
              "Default rule"
            ],
            "enable": "",
            "log": "",
            "link": "rule_l3_outbound_rule_default",
            "documentation": {
              "business criticality": "",
              "business partner": "",
              "documentation": "",
              "business applications": ""
            },
            "additionalData": {
              "group_policy_name": [
                {
                  "value": ""
                }
              ],
              "src_port": [
                {
                  "value": "Any"
                }
              ],
              "protocol": [
                {
                  "value": "Any"
                }
              ],
              "group_rulenum": [
                {
                  "value": ""
                }
              ],
              "dst_port": [
                {
                  "value": "Any"
                }
              ],
              "policy": [
                {
                  "value": "Allow"
                }
              ]
            },
            "isValidUserSourceModel": true
          }
        },
      ]
    }
  ]
}
```

## Workflow Library Example

[Search Rules with Algosec Firewall Analyzer and Send Results Via Email](https://library.blinkops.com/workflows/search-rules-with-algosec-firewall-analyzer-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/search-rules-with-algosec-firewall-analyzer-and-send-results-via-email/canvas" />
</div>