Skip to main content

Create Rules

Creates multiple rules.

Basic Parameters​

ParameterDescription
Rules ListList of rules represented by json objects to create.

For example, here's a list of one rule:
<br/>[<br/> {<br/> "kind": "it:rule:detection",<br/> "predicate": {<br/> "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453",<br/> "definition": {},<br/> "patterns": [<br/> {}<br/> ],<br/> "predicates": [<br/> {}<br/> ],<br/> "lists": [<br/> {}<br/> ]<br/> },<br/> "actions": [<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ],<br/> [<br/> {<br/> "kind": "it:rule:action:kind:incident",<br/> "parameters": {<br/> "probability": 0.15,<br/> "impact": 0.1,<br/> "score": 0.015,<br/> "urgency": 0.2,<br/> "severity": "incident:severity:100:low"<br/> }<br/> },<br/> {<br/> "kind": "it:rule:action:kind:notification",<br/> "parameters": {<br/> "target": {<br/> "id": "someUUID"<br/> }<br/> }<br/> }<br/> ]<br/> ],<br/> "target": {<br/> "defaults": [<br/> {<br/> "kind": "endpoint:agent",<br/> "overlay": true<br/> }<br/> ],<br/> "realms": [<br/> {<br/> "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453",<br/> "overlay": true<br/> }<br/> ]<br/> },<br/> "options": {<br/> "filter": {<br/> "simple": {<br/> "include": [<br/> {<br/> "activity.clumps.primary.item.designations": [<br/> "it:activity:clump:item:first",<br/> "it:activity:clump:item:intermediate",<br/> "it:activity:clump:item:last"<br/> ]<br/> }<br/> ]<br/> }<br/> }<br/> },<br/> "details": {<br/> "name": "USA Part Codes",<br/> "description": "Two-letter codes of all USA parts including states, territories and the DC"<br/> },<br/> "alias": "USA_PART_CODES",<br/> "iver": 319,<br/> "sver": "1.2.3",<br/> "createdAt": "2018-04-12T16:36:51.700Z",<br/> "createdBy": {<br/> "principal": {<br/> "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"<br/> }<br/> },<br/> "updatedAt": "2018-04-12T16:36:51.700Z",<br/> "updatedBy": {<br/> "principal": {<br/> "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"<br/> }<br/> },<br/> "tenant": 123456789,<br/> "extent": "tenant",<br/> "status": "active",<br/> "tags": [<br/> "rules",<br/> "windows",<br/> "agent"<br/> ],<br/> "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"<br/> }<br/>]<br/>

Advanced Parameters​

ParameterDescription
ConsistencyReturn when data is ready for read or query.
Correlation IDID to correlate multiple requests.
TimeoutTime to wait before consistency=query throws.
Transaction IDID for a transaction.

Example Output​

{
    "_status": {
        "status": 0,
        "code": "string"
    },
    "_meta": {
        "stats": {
            "offset": 0,
            "limit": 0,
            "total": 0
        },
        "origin": {}
    },
    "data": [
        "string"
    ]
}

Workflow Library Example​

Create Rules with Proofpoint Itm and Send Results Via Email

Workflow LibraryPreview this Workflow on desktop