규칙

규칙에 대한 REST API 작업

개요

이러한 API 작업을 사용하여 다음과 상호 작용하세요 룰 Panther에서.

규칙 API 엔터티는 다음에만 적용됩니다 Python 규칙. rules로 생성된 것과 상호작용하려면 Simple/YAML 규칙은 다음을 참조하세요 간단한 규칙.

API를 호출하려면, 다음을 참조하세요 Panther REST API 사용 방법 지침—다음을 포함하여 이 문서 페이지에서 직접 호출하는 방법에 대한 안내.

필요한 권한

다음의 경우 GET 작업의 경우, API 토큰에는 다음이 있어야 합니다 규칙 보기 권한이 있어야 합니다.
다음의 경우 POST, PUT, 그리고 DELETE 작업의 경우, API 토큰에는 다음이 있어야 합니다 규칙 관리 권한이 있어야 합니다.

작업

아래 API 엔드포인트는 Python 기반 규칙에만 해당합니다. 다른 디택션 유형과 상호작용하려면 해당 페이지를 참조하세요: 예약된 규칙, Simple 디택션, 그리고 클라우드 정책.

create rule

post

Authorizations

X-API-KeystringRequired

Query parameters

run-tests-firstbooleanOptional

set this field to false to exclude running tests prior to saving

Default: true

run-tests-onlybooleanOptional

set this field to true if you want to run tests without saving

Default: false

Body

bodystringRequired

The python body of the rule

createAlertbooleanOptional

Determines whether the rule should create alerts when it triggers

dedupPeriodMinutesinteger · int64 · min: 1Optional

The amount of time in minutes for grouping alerts

Default: 60

descriptionstringOptional

The description of the rule

displayNamestringOptional

The display name of the rule

enabledbooleanOptional

Determines whether or not the rule is active

idstringRequired

The id of the rule

inlineFiltersstringOptional

The filter for the rule represented in YAML

logTypesstring[]Optional

log types

managedbooleanOptional

Determines if the rule is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

referencestringOptional

A URL or note for additional reference material

runbookstringOptional

How to handle the generated alert

severitystring · enumRequiredPossible values:

summaryAttributesstring[]Optional

A list of fields in the event to create top 5 summaries for

tagsstring[]Optional

The tags for the rule

thresholdinteger · int64 · min: 1Optional

the number of events that must match before an alert is triggered

Default: 1

Responses

200

OK response.

application/json

bodystringOptional

The python body of the rule

createAlertbooleanOptional

Determines whether the rule should create alerts when it triggers

createdAtstringOptional

createdByExternalstringOptional

The text of the user-provided CreatedBy field when uploaded via CI/CD

dedupPeriodMinutesinteger · int64 · min: 1Optional

The amount of time in minutes for grouping alerts

Default: 60

descriptionstringOptional

The description of the rule

displayNamestringOptional

The display name of the rule

enabledbooleanOptional

Determines whether or not the rule is active

idstringOptional

The id of the rule

inlineFiltersstringOptional

The filter for the rule represented in YAML

lastModifiedstringOptional

logTypesstring[]Optional

log types

managedbooleanOptional

Determines if the rule is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

referencestringOptional

A URL or note for additional reference material

runbookstringOptional

How to handle the generated alert

severitystring · enumOptionalPossible values:

summaryAttributesstring[]Optional

A list of fields in the event to create top 5 summaries for

tagsstring[]Optional

The tags for the rule

thresholdinteger · int64 · min: 1Optional

the number of events that must match before an alert is triggered

Default: 1

204

No Content response.

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

post/rules

POST /rules HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 488

{
  "body": "text",
  "createAlert": true,
  "dedupPeriodMinutes": 60,
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "inlineFilters": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reference": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "log": null,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

{
  "body": "text",
  "createAlert": true,
  "createdAt": "text",
  "createdBy": {
    "id": "user",
    "type": "text"
  },
  "createdByExternal": "text",
  "dedupPeriodMinutes": 60,
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reference": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "log": null,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

get rule

get

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the rule to fetch

Responses

200

OK response.

application/json

bodystringOptional

The python body of the rule

createAlertbooleanOptional

Determines whether the rule should create alerts when it triggers

createdAtstringOptional

createdByExternalstringOptional

The text of the user-provided CreatedBy field when uploaded via CI/CD

dedupPeriodMinutesinteger · int64 · min: 1Optional

The amount of time in minutes for grouping alerts

Default: 60

descriptionstringOptional

The description of the rule

displayNamestringOptional

The display name of the rule

enabledbooleanOptional

Determines whether or not the rule is active

idstringOptional

The id of the rule

inlineFiltersstringOptional

The filter for the rule represented in YAML

lastModifiedstringOptional

logTypesstring[]Optional

log types

managedbooleanOptional

Determines if the rule is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

referencestringOptional

A URL or note for additional reference material

runbookstringOptional

How to handle the generated alert

severitystring · enumOptionalPossible values:

summaryAttributesstring[]Optional

A list of fields in the event to create top 5 summaries for

tagsstring[]Optional

The tags for the rule

thresholdinteger · int64 · min: 1Optional

the number of events that must match before an alert is triggered

Default: 1

404

not_found: Not Found response.

application/json

get/rules/{id}

GET /rules/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "body": "text",
  "createAlert": true,
  "createdAt": "text",
  "createdBy": {
    "id": "user",
    "type": "text"
  },
  "createdByExternal": "text",
  "dedupPeriodMinutes": 60,
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reference": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "log": null,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

put rule

put

put creates or updates a rule

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

the id of the rule

Query parameters

run-tests-firstbooleanOptional

set this field to false to exclude running tests prior to saving

Default: true

run-tests-onlybooleanOptional

set this field to true if you want to run tests without saving

Default: false

Body

bodystringRequired

The python body of the rule

createAlertbooleanOptional

Determines whether the rule should create alerts when it triggers

dedupPeriodMinutesinteger · int64 · min: 1Optional

The amount of time in minutes for grouping alerts

Default: 60

descriptionstringOptional

The description of the rule

displayNamestringOptional

The display name of the rule

enabledbooleanOptional

Determines whether or not the rule is active

idstringRequired

The id of the rule

inlineFiltersstringOptional

The filter for the rule represented in YAML

logTypesstring[]Optional

log types

managedbooleanOptional

Determines if the rule is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

referencestringOptional

A URL or note for additional reference material

runbookstringOptional

How to handle the generated alert

severitystring · enumRequiredPossible values:

summaryAttributesstring[]Optional

A list of fields in the event to create top 5 summaries for

tagsstring[]Optional

The tags for the rule

thresholdinteger · int64 · min: 1Optional

the number of events that must match before an alert is triggered

Default: 1

Responses

200

200 returned if the item already existed

application/json

bodystringOptional

The python body of the rule

createAlertbooleanOptional

Determines whether the rule should create alerts when it triggers

createdAtstringOptional

createdByExternalstringOptional

The text of the user-provided CreatedBy field when uploaded via CI/CD

dedupPeriodMinutesinteger · int64 · min: 1Optional

The amount of time in minutes for grouping alerts

Default: 60

descriptionstringOptional

The description of the rule

displayNamestringOptional

The display name of the rule

enabledbooleanOptional

Determines whether or not the rule is active

idstringOptional

The id of the rule

inlineFiltersstringOptional

The filter for the rule represented in YAML

lastModifiedstringOptional

logTypesstring[]Optional

log types

managedbooleanOptional

Determines if the rule is managed by panther

outputIDsstring[]Optional

Destination IDs that override default alert routing based on severity

referencestringOptional

A URL or note for additional reference material

runbookstringOptional

How to handle the generated alert

severitystring · enumOptionalPossible values:

summaryAttributesstring[]Optional

A list of fields in the event to create top 5 summaries for

tagsstring[]Optional

The tags for the rule

thresholdinteger · int64 · min: 1Optional

the number of events that must match before an alert is triggered

Default: 1

201

201 returned if the item was created

application/json

204

No Content response.

400

bad_request: Bad Request response.

application/json

put/rules/{id}

PUT /rules/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 488

{
  "body": "text",
  "createAlert": true,
  "dedupPeriodMinutes": 60,
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "inlineFilters": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reference": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "log": null,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

{
  "body": "text",
  "createAlert": true,
  "createdAt": "text",
  "createdBy": {
    "id": "user",
    "type": "text"
  },
  "createdByExternal": "text",
  "dedupPeriodMinutes": 60,
  "description": "text",
  "displayName": "text",
  "enabled": true,
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "outputIDs": [
    "text"
  ],
  "reference": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "log": null,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

delete rule

delete

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the rule to delete

Responses

204

No Content response.

No content

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

delete/rules/{id}

DELETE /rules/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content

list rules

get

Authorizations

X-API-KeystringRequired

Query parameters

cursorstringOptional

the pagination token

limitinteger · int64Optional

the maximum results to return

Default: 100

name-containsstringOptional

Substring search by name (case-insensitive)

statestring · enumOptional

Only include rules in the given state

Possible values:

log-typestring[]Optional

Only include rules which apply to one of the given log types

tagstring[]Optional

Only include rules with one of the given tags (case-insensitive)

created-bystringOptional

Only include rules whose creator matches this user ID or actor ID

last-modified-bystringOptional

Only include rules last modified by this user ID or actor ID

Responses

200

OK response.

application/json

nextstringOptional

pagination token for the next page of results

get/rules

GET /rules HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

200

OK response.

{
  "next": "text",
  "results": [
    {
      "body": "text",
      "createAlert": true,
      "createdAt": "text",
      "createdBy": {
        "id": "user",
        "type": "text"
      },
      "createdByExternal": "text",
      "dedupPeriodMinutes": 60,
      "description": "text",
      "displayName": "text",
      "enabled": true,
      "id": "text",
      "inlineFilters": "text",
      "lastModified": "text",
      "logTypes": [
        "text"
      ],
      "managed": true,
      "outputIDs": [
        "text"
      ],
      "reference": "text",
      "reports": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "runbook": "text",
      "severity": "INFO",
      "summaryAttributes": [
        "text"
      ],
      "tags": [
        "text"
      ],
      "tests": [
        {
          "expectedResult": true,
          "log": null,
          "mocks": [
            {
              "ANY_ADDITIONAL_PROPERTY": "text"
            }
          ],
          "name": "text",
          "resource": "text"
        }
      ],
      "threshold": 1
    }
  ]
}

이전역할

다음예약된 규칙

마지막 업데이트 7개월 전

도움이 되었나요?