단순 규칙
Simple/YAML 규칙에 대한 REST API 작업
개요
상호 작용하려면 다음 API 작업을 사용하세요 룰 다음으로 생성됨 CLI 워크플로우의 간단한 디택션 또는 Panther Console의 Simple 디택션 빌더.
API를 호출하려면 다음을 참조하세요 Panther REST API 사용 방법 지침—다음을 포함하여 이 문서 페이지에서 직접 호출하는 방법에 대한 안내.
필수 권한
자체 호스팅
GET작업을 수행하려면, API 토큰에 다음이 있어야 합니다규칙 보기권한.자체 호스팅
POST,PUT, 그리고DELETE작업을 수행하려면, API 토큰에 다음이 있어야 합니다규칙 관리권한.
작업
set this field to false to exclude running tests prior to saving
trueset this field to true if you want to run tests without saving
falseThe alert context represented in YAML
The alert title represented in YAML
Determines whether the rule should create alerts when it triggers
The amount of time in minutes for grouping alerts
60The description of the rule
The yaml representation of the rule
The display name of the rule
The dynamic severity represented in YAML
Determines whether or not the rule is active
The key on an event to group by represented in YAML
The id of the rule
The filter for the rule represented in YAML
log types
Determines if the simple rule is managed by panther
Destination IDs that override default alert routing based on severity
The python body of the rule
A URL or note for additional reference material
How to handle the generated alert
A list of fields in the event to create top 5 summaries for
The tags for the simple rule
the number of events that must match before an alert is triggered
1OK response.
The alert context represented in YAML
The alert title represented in YAML
Determines whether the rule should create alerts when it triggers
The text of the user-provided CreatedBy field when uploaded via CI/CD
The amount of time in minutes for grouping alerts
60The description of the rule
The yaml representation of the rule
The display name of the rule
The dynamic severity represented in YAML
Determines whether or not the rule is active
The key on an event to group by represented in YAML
The id of the rule
The filter for the rule represented in YAML
log types
Determines if the simple rule is managed by panther
Destination IDs that override default alert routing based on severity
The python body of the rule
A URL or note for additional reference material
How to handle the generated alert
A list of fields in the event to create top 5 summaries for
The tags for the simple rule
the number of events that must match before an alert is triggered
1No Content response.
bad_request: Bad Request response.
exists: Conflict response.
POST /simple-rules HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 599
{
"alertContext": "text",
"alertTitle": "text",
"createAlert": true,
"dedupPeriodMinutes": 60,
"description": "text",
"detection": "text",
"displayName": "text",
"dynamicSeverities": "text",
"enabled": true,
"groupBy": "text",
"id": "text",
"inlineFilters": "text",
"logTypes": [
"text"
],
"managed": true,
"outputIDs": [
"text"
],
"pythonBody": "text",
"reference": "text",
"reports": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"runbook": "text",
"severity": "INFO",
"summaryAttributes": [
"text"
],
"tags": [
"text"
],
"tests": [
{
"expectedResult": true,
"log": null,
"mocks": [
{
"ANY_ADDITIONAL_PROPERTY": "text"
}
],
"name": "text",
"resource": "text"
}
],
"threshold": 1
}{
"alertContext": "text",
"alertTitle": "text",
"createAlert": true,
"createdAt": "text",
"createdBy": {
"id": "user",
"type": "text"
},
"createdByExternal": "text",
"dedupPeriodMinutes": 60,
"description": "text",
"detection": "text",
"displayName": "text",
"dynamicSeverities": "text",
"enabled": true,
"groupBy": "text",
"id": "text",
"inlineFilters": "text",
"lastModified": "text",
"logTypes": [
"text"
],
"managed": true,
"outputIDs": [
"text"
],
"pythonBody": "text",
"reference": "text",
"reports": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"runbook": "text",
"severity": "INFO",
"summaryAttributes": [
"text"
],
"tags": [
"text"
],
"tests": [
{
"expectedResult": true,
"log": null,
"mocks": [
{
"ANY_ADDITIONAL_PROPERTY": "text"
}
],
"name": "text",
"resource": "text"
}
],
"threshold": 1
}ID of the rule to fetch
determines if associated python for the generated rule is returned
falseOK response.
The alert context represented in YAML
The alert title represented in YAML
Determines whether the rule should create alerts when it triggers
The text of the user-provided CreatedBy field when uploaded via CI/CD
The amount of time in minutes for grouping alerts
60The description of the rule
The yaml representation of the rule
The display name of the rule
The dynamic severity represented in YAML
Determines whether or not the rule is active
The key on an event to group by represented in YAML
The id of the rule
The filter for the rule represented in YAML
log types
Determines if the simple rule is managed by panther
Destination IDs that override default alert routing based on severity
The python body of the rule
A URL or note for additional reference material
How to handle the generated alert
A list of fields in the event to create top 5 summaries for
The tags for the simple rule
the number of events that must match before an alert is triggered
1not_found: Not Found response.
GET /simple-rules/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*
{
"alertContext": "text",
"alertTitle": "text",
"createAlert": true,
"createdAt": "text",
"createdBy": {
"id": "user",
"type": "text"
},
"createdByExternal": "text",
"dedupPeriodMinutes": 60,
"description": "text",
"detection": "text",
"displayName": "text",
"dynamicSeverities": "text",
"enabled": true,
"groupBy": "text",
"id": "text",
"inlineFilters": "text",
"lastModified": "text",
"logTypes": [
"text"
],
"managed": true,
"outputIDs": [
"text"
],
"pythonBody": "text",
"reference": "text",
"reports": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"runbook": "text",
"severity": "INFO",
"summaryAttributes": [
"text"
],
"tags": [
"text"
],
"tests": [
{
"expectedResult": true,
"log": null,
"mocks": [
{
"ANY_ADDITIONAL_PROPERTY": "text"
}
],
"name": "text",
"resource": "text"
}
],
"threshold": 1
}put creates or updates a rule
the id of the rule
set this field to false to exclude running tests prior to saving
trueset this field to true if you want to run tests without saving
falseThe alert context represented in YAML
The alert title represented in YAML
Determines whether the rule should create alerts when it triggers
The amount of time in minutes for grouping alerts
60The description of the rule
The yaml representation of the rule
The display name of the rule
The dynamic severity represented in YAML
Determines whether or not the rule is active
The key on an event to group by represented in YAML
The id of the rule
The filter for the rule represented in YAML
log types
Determines if the simple rule is managed by panther
Destination IDs that override default alert routing based on severity
The python body of the rule
A URL or note for additional reference material
How to handle the generated alert
A list of fields in the event to create top 5 summaries for
The tags for the simple rule
the number of events that must match before an alert is triggered
1200 returned if the item already existed
The alert context represented in YAML
The alert title represented in YAML
Determines whether the rule should create alerts when it triggers
The text of the user-provided CreatedBy field when uploaded via CI/CD
The amount of time in minutes for grouping alerts
60The description of the rule
The yaml representation of the rule
The display name of the rule
The dynamic severity represented in YAML
Determines whether or not the rule is active
The key on an event to group by represented in YAML
The id of the rule
The filter for the rule represented in YAML
log types
Determines if the simple rule is managed by panther
Destination IDs that override default alert routing based on severity
The python body of the rule
A URL or note for additional reference material
How to handle the generated alert
A list of fields in the event to create top 5 summaries for
The tags for the simple rule
the number of events that must match before an alert is triggered
1201 returned if the item was created
No Content response.
bad_request: Bad Request response.
PUT /simple-rules/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 599
{
"alertContext": "text",
"alertTitle": "text",
"createAlert": true,
"dedupPeriodMinutes": 60,
"description": "text",
"detection": "text",
"displayName": "text",
"dynamicSeverities": "text",
"enabled": true,
"groupBy": "text",
"id": "text",
"inlineFilters": "text",
"logTypes": [
"text"
],
"managed": true,
"outputIDs": [
"text"
],
"pythonBody": "text",
"reference": "text",
"reports": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"runbook": "text",
"severity": "INFO",
"summaryAttributes": [
"text"
],
"tags": [
"text"
],
"tests": [
{
"expectedResult": true,
"log": null,
"mocks": [
{
"ANY_ADDITIONAL_PROPERTY": "text"
}
],
"name": "text",
"resource": "text"
}
],
"threshold": 1
}{
"alertContext": "text",
"alertTitle": "text",
"createAlert": true,
"createdAt": "text",
"createdBy": {
"id": "user",
"type": "text"
},
"createdByExternal": "text",
"dedupPeriodMinutes": 60,
"description": "text",
"detection": "text",
"displayName": "text",
"dynamicSeverities": "text",
"enabled": true,
"groupBy": "text",
"id": "text",
"inlineFilters": "text",
"lastModified": "text",
"logTypes": [
"text"
],
"managed": true,
"outputIDs": [
"text"
],
"pythonBody": "text",
"reference": "text",
"reports": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"runbook": "text",
"severity": "INFO",
"summaryAttributes": [
"text"
],
"tags": [
"text"
],
"tests": [
{
"expectedResult": true,
"log": null,
"mocks": [
{
"ANY_ADDITIONAL_PROPERTY": "text"
}
],
"name": "text",
"resource": "text"
}
],
"threshold": 1
}ID of the simple rule to delete
No Content response.
No content
bad_request: Bad Request response.
not_found: Not Found response.
DELETE /simple-rules/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*
No content
the pagination token
the maximum results to return
100determines if associated python for the generated rule is returned
falseSubstring search by name (case-insensitive)
Only include rules in the given state
Only include rules which apply to one of the given log types
Only include rules with one of the given tags (case-insensitive)
Only include rules whose creator matches this user ID or actor ID
Only include rules last modified by this user ID or actor ID
OK response.
pagination token for the next page of results
GET /simple-rules HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*
OK response.
{
"next": "text",
"results": [
{
"alertContext": "text",
"alertTitle": "text",
"createAlert": true,
"createdAt": "text",
"createdBy": {
"id": "user",
"type": "text"
},
"createdByExternal": "text",
"dedupPeriodMinutes": 60,
"description": "text",
"detection": "text",
"displayName": "text",
"dynamicSeverities": "text",
"enabled": true,
"groupBy": "text",
"id": "text",
"inlineFilters": "text",
"lastModified": "text",
"logTypes": [
"text"
],
"managed": true,
"outputIDs": [
"text"
],
"pythonBody": "text",
"reference": "text",
"reports": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"runbook": "text",
"severity": "INFO",
"summaryAttributes": [
"text"
],
"tags": [
"text"
],
"tests": [
{
"expectedResult": true,
"log": null,
"mocks": [
{
"ANY_ADDITIONAL_PROPERTY": "text"
}
],
"name": "text",
"resource": "text"
}
],
"threshold": 1
}
]
}마지막 업데이트
도움이 되었나요?