​
Basic Parameters​

ParameterDescription
RuleThe attributes of the rule. Provide only the attributes that need to be changed.For instance:{ "status": "active"}
Rule IDRule’s unique ID (uuid).

​
Advanced Parameters​

ParameterDescription
ConsistencyReturn when data is ready for read or query.
Correlation IDID to correlate multiple requests.
TimeoutTime to wait before consistency=query throws.
Transaction IDID for a transaction.

​
Example Output​

{    "_status": {        "status": 0,        "code": "string"    },    "_meta": {        "stats": {            "offset": 0,            "limit": 0,            "total": 0        },        "origin": {}    },    "kind": "it:rule:detection",    "predicate": {        "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453",        "definition": {},        "patterns": [            {}        ],        "predicates": [            {}        ],        "lists": [            {}        ]    },    "actions": [        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ],        [            {                "kind": "it:rule:action:kind:incident",                "parameters": {                    "probability": 0.15,                    "impact": 0.1,                    "score": 0.015,                    "urgency": 0.2,                    "severity": "incident:severity:100:low"                }            },            {                "kind": "it:rule:action:kind:notification",                "parameters": {                    "target": {                        "id": "someUUID"                    }                }            }        ]    ],    "target": {        "defaults": [            {                "kind": "endpoint:agent",                "overlay": true            }        ],        "realms": [            {                "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453",                "overlay": true            }        ]    },    "options": {        "filter": {            "simple": {                "include": [                    {                        "activity.clumps.primary.item.designations": [                            "it:activity:clump:item:first",                            "it:activity:clump:item:intermediate",                            "it:activity:clump:item:last"                        ]                    }                ]            }        }    },    "details": {        "name": "USA Part Codes",        "description": "Two-letter codes of all USA parts including states, territories and the DC"    },    "alias": "USA_PART_CODES",    "iver": 319,    "sver": "1.2.3",    "createdAt": "2018-04-12T16:36:51.700Z",    "createdBy": {        "principal": {            "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"        }    },    "updatedAt": "2018-04-12T16:36:51.700Z",    "updatedBy": {        "principal": {            "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"        }    },    "tenant": 123456789,    "extent": "tenant",    "status": "active",    "tags": [        "rules",        "windows",        "agent"    ],    "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"}

​
Workflow Library Example​

Modify Rule with Proofpoint Itm and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

Modify PredicateProofpoint ITM Custom Action