정책

정책에 대한 REST API 작업

개요

와 같이 반환할 수 있습니다(스타일 취향에 따라). /policies REST API 작업은 Panther 버전 1.98부터 오픈 베타로 제공되며 모든 고객이 사용할 수 있습니다. 버그 리포트 및 기능 요청은 Panther 지원팀과 공유하세요.

이 API 작업을 사용하여 policies 을(를) Panther에서 상호작용할 수 있습니다.

API 호출 방법은 Panther REST API 사용 방법 지침을 참조하세요—포함하여 이 문서 페이지에서 직접 호출하는 방법에 대한 지침.

필수 권한

• 에 대해 GET 작업의 경우, API 토큰은 정책 보기 권한을 가져야 합니다.

• 에 대해 POST, PUT, 및 DELETE 작업의 경우, API 토큰은 정책 관리 권한을 가져야 합니다.

작업

아래 API 엔드포인트는 클라우드 정책 전용입니다. 다른 탐지 유형과 상호작용하려면 해당 페이지를 참조하세요: 파이썬 기반 규칙, 스케줄된 규칙, 및 Simple Detections.

create policy

post

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Query parameters

run-tests-firstbooleanOptional

set this field to false to exclude running tests prior to saving

Default: true

run-tests-onlybooleanOptional

set this field to true if you want to run tests without saving

Default: false

Body

application/json

bodystringRequired

The python body of the policy

descriptionstringOptional

The description of the policy

displayNamestringOptional

The display name of the policy

enabledbooleanOptional

Determines whether or not the policy is active

idstringRequired

The id of the policy

managedbooleanOptional

Determines if the policy is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

resourceTypesstring[]Optional

Resource types

severitystring · enumRequiredPossible values:

suppressionsstring[]Optional

Resources to ignore via a pattern that matches the resource id

Example: ["aws::s3::*"]

tagsstring[]Optional

The tags for the policy

Responses

200

OK response.

application/json

204

No Content response.

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

post

/policies

HTTPcURLJavaScriptPython

POST /policies HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 367

{
  "body": "text",
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "resourceTypes": [
    "text"
  ],
  "severity": "INFO",
  "suppressions": [
    "aws::s3::*"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ]
}

{
  "body": "text",
  "createdAt": "text",
  "createdBy": {
    "id": "user",
    "type": "text"
  },
  "createdByExternal": "text",
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "lastModified": "text",
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "resourceTypes": [
    "text"
  ],
  "severity": "INFO",
  "suppressions": [
    "aws::s3::*"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ]
}

get policy

get

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

the id of the policy to fetch

Responses

200

OK response.

application/json

404

not_found: Not Found response.

application/json

get

/policies/{id}

HTTPcURLJavaScriptPython

GET /policies/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "body": "text",
  "createdAt": "text",
  "createdBy": {
    "id": "user",
    "type": "text"
  },
  "createdByExternal": "text",
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "lastModified": "text",
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "resourceTypes": [
    "text"
  ],
  "severity": "INFO",
  "suppressions": [
    "aws::s3::*"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ]
}

put policy

put

put creates or updates a policy

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

the id of the policy

Query parameters

run-tests-firstbooleanOptional

set this field to false to exclude running tests prior to saving

Default: true

run-tests-onlybooleanOptional

set this field to true if you want to run tests without saving

Default: false

Body

application/json

bodystringRequired

The python body of the policy

descriptionstringOptional

The description of the policy

displayNamestringOptional

The display name of the policy

enabledbooleanOptional

Determines whether or not the policy is active

idstringRequired

The id of the policy

managedbooleanOptional

Determines if the policy is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

resourceTypesstring[]Optional

Resource types

severitystring · enumRequiredPossible values:

suppressionsstring[]Optional

Resources to ignore via a pattern that matches the resource id

Example: ["aws::s3::*"]

tagsstring[]Optional

The tags for the policy

Responses

200

200 returned if the item already existed

application/json

201

201 returned if the item was created

application/json

204

No Content response.

400

bad_request: Bad Request response.

application/json

put

/policies/{id}

HTTPcURLJavaScriptPython

PUT /policies/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 367

{
  "body": "text",
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "resourceTypes": [
    "text"
  ],
  "severity": "INFO",
  "suppressions": [
    "aws::s3::*"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ]
}

{
  "body": "text",
  "createdAt": "text",
  "createdBy": {
    "id": "user",
    "type": "text"
  },
  "createdByExternal": "text",
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "lastModified": "text",
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "resourceTypes": [
    "text"
  ],
  "severity": "INFO",
  "suppressions": [
    "aws::s3::*"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ]
}

delete policy

delete

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the policy to delete

Responses

204

No Content response.

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

delete

/policies/{id}

HTTPcURLJavaScriptPython

DELETE /policies/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content

list policies

get

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Query parameters

cursorstringOptional

the pagination token

limitinteger · int64Optional

the maximum results to return

Default: 100

compliance-statusstring · enumOptional

Only include policies with this compliance status

Possible values:

name-containsstringOptional

Substring search by name (case-insensitive)

statestring · enumOptional

Only include policies in the given state

Possible values:

resource-typestring[]Optional

Only include policies which apply to one of the given resource types

tagstring[]Optional

Only include policies with one of the given tags (case-insensitive)

created-bystringOptional

Only include policies whose creator matches this user ID or actor ID

last-modified-bystringOptional

Only include policies last modified by this user ID or actor ID

Responses

200

OK response.

application/json

get

/policies

HTTPcURLJavaScriptPython

GET /policies HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

200

OK response.

{
  "next": "text",
  "results": [
    {
      "body": "text",
      "createdAt": "text",
      "createdBy": {
        "id": "user",
        "type": "text"
      },
      "createdByExternal": "text",
      "description": "text",
      "displayName": "text",
      "enabled": true,
      "id": "text",
      "lastModified": "text",
      "managed": true,
      "outputIDs": [
        "text"
      ],
      "reports": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "resourceTypes": [
        "text"
      ],
      "severity": "INFO",
      "suppressions": [
        "aws::s3::*"
      ],
      "tags": [
        "text"
      ],
      "tests": [
        {
          "expectedResult": true,
          "mocks": [
            {
              "ANY_ADDITIONAL_PROPERTY": "text"
            }
          ],
          "name": "text",
          "resource": "text"
        }
      ]
    }
  ]
}