Simple Rules

REST API operations for Simple/YAML Rules

Overview

The /simple-rules REST API operations are in open beta starting with Panther version 1.98, and are available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with rules created as Simple Detections in the CLI workflow or in the Panther Console's Simple Detection Builder.

The simple rule API entity is only applicable to rules that are Simple Detections. To interact with rules created in Python, see Rules.

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Required permissions

• For GET operations, your API token must have the View Rules permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Rules permission.

Operations

create simple rule

post

Authorizations

Query parameters

run-tests-firstboolean · default: trueoptional

set this field to false to exclude running tests prior to saving

run-tests-onlyboolean · default: falseoptional

set this field to true if you want to run tests without saving

Body

alertContextstringoptional

The alert context represented in YAML

alertTitlestringoptional

The alert title represented in YAML

dedupPeriodMinutesinteger · int64 · min: 1 · default: 60optional

The amount of time in minutes for grouping alerts

descriptionstringoptional

The description of the rule

detectionstringrequired

The yaml representation of the rule

displayNamestringoptional

The display name of the rule

dynamicSeveritiesstringoptional

The dynamic severity represented in YAML

enabledbooleanoptional

Determines whether or not the rule is active

groupBystringoptional

The key on an event to group by represented in YAML

idstringrequired

The id of the rule

inlineFiltersstringoptional

The filter for the rule represented in YAML

logTypesstring[]optional

log types

managedbooleanoptional

Determines if the simple rule is managed by panther

pythonBodystringoptional

The python body of the rule

reportsobjectoptional

reports

runbookstringoptional

How to handle the generated alert

severitystring · enumrequired

Options: INFO, LOW, MEDIUM, HIGH, CRITICAL

summaryAttributesstring[]optional

A list of fields in the event to create top 5 summaries for

tagsstring[]optional

The tags for the simple rule

testsobject[]optional

Unit tests for the Rule. Best practice is to include a positive and negative case

thresholdinteger · int64 · min: 1 · default: 1optional

the number of events that must match before an alert is triggered

Responses

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://your-api-host/simple-rules' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "alertContext": "text",
    "alertTitle": "text",
    "dedupPeriodMinutes": 1,
    "description": "text",
    "detection": "text",
    "displayName": "text",
    "dynamicSeverities": "text",
    "enabled": true,
    "groupBy": "text",
    "id": "text",
    "inlineFilters": "text",
    "logTypes": [
      "text"
    ],
    "managed": true,
    "pythonBody": "text",
    "reports": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "runbook": "text",
    "severity": "INFO",
    "summaryAttributes": [
      "text"
    ],
    "tags": [
      "text"
    ],
    "tests": [
      {
        "expectedResult": true,
        "mocks": [
          {
            "ANY_ADDITIONAL_PROPERTY": "text"
          }
        ],
        "name": "text",
        "resource": "text"
      }
    ],
    "threshold": 1
  }'

200

204

400

409

200

{
  "alertContext": "text",
  "alertTitle": "text",
  "createdAt": "text",
  "dedupPeriodMinutes": 1,
  "description": "text",
  "detection": "text",
  "displayName": "text",
  "dynamicSeverities": "text",
  "enabled": true,
  "groupBy": "text",
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "pythonBody": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

OK response.

get a simple rule

get

Authorizations

Path parameters

idstringrequired

ID of the rule to fetch

Query parameters

include-pythonboolean · default: falseoptional

determines if associated python for the generated rule is returned

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url 'https://your-api-host/simple-rules/{id}' \
  --header 'X-API-Key: YOUR_API_KEY'

200

404

200

{
  "alertContext": "text",
  "alertTitle": "text",
  "createdAt": "text",
  "dedupPeriodMinutes": 1,
  "description": "text",
  "detection": "text",
  "displayName": "text",
  "dynamicSeverities": "text",
  "enabled": true,
  "groupBy": "text",
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "pythonBody": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

OK response.

put simple rule

put

put creates or updates a rule

Authorizations

Path parameters

idstringrequired

the id of the rule

Query parameters

run-tests-firstboolean · default: trueoptional

set this field to false to exclude running tests prior to saving

run-tests-onlyboolean · default: falseoptional

set this field to true if you want to run tests without saving

Body

alertContextstringoptional

The alert context represented in YAML

alertTitlestringoptional

The alert title represented in YAML

dedupPeriodMinutesinteger · int64 · min: 1 · default: 60optional

The amount of time in minutes for grouping alerts

descriptionstringoptional

The description of the rule

detectionstringrequired

The yaml representation of the rule

displayNamestringoptional

The display name of the rule

dynamicSeveritiesstringoptional

The dynamic severity represented in YAML

enabledbooleanoptional

Determines whether or not the rule is active

groupBystringoptional

The key on an event to group by represented in YAML

idstringrequired

The id of the rule

inlineFiltersstringoptional

The filter for the rule represented in YAML

logTypesstring[]optional

log types

managedbooleanoptional

Determines if the simple rule is managed by panther

pythonBodystringoptional

The python body of the rule

reportsobjectoptional

reports

runbookstringoptional

How to handle the generated alert

severitystring · enumrequired

Options: INFO, LOW, MEDIUM, HIGH, CRITICAL

summaryAttributesstring[]optional

A list of fields in the event to create top 5 summaries for

tagsstring[]optional

The tags for the simple rule

testsobject[]optional

Unit tests for the Rule. Best practice is to include a positive and negative case

thresholdinteger · int64 · min: 1 · default: 1optional

the number of events that must match before an alert is triggered

Responses

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request PUT \
  --url 'https://your-api-host/simple-rules/{id}' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "alertContext": "text",
    "alertTitle": "text",
    "dedupPeriodMinutes": 1,
    "description": "text",
    "detection": "text",
    "displayName": "text",
    "dynamicSeverities": "text",
    "enabled": true,
    "groupBy": "text",
    "id": "text",
    "inlineFilters": "text",
    "logTypes": [
      "text"
    ],
    "managed": true,
    "pythonBody": "text",
    "reports": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "runbook": "text",
    "severity": "INFO",
    "summaryAttributes": [
      "text"
    ],
    "tags": [
      "text"
    ],
    "tests": [
      {
        "expectedResult": true,
        "mocks": [
          {
            "ANY_ADDITIONAL_PROPERTY": "text"
          }
        ],
        "name": "text",
        "resource": "text"
      }
    ],
    "threshold": 1
  }'

200

201

204

400

200

{
  "alertContext": "text",
  "alertTitle": "text",
  "createdAt": "text",
  "dedupPeriodMinutes": 1,
  "description": "text",
  "detection": "text",
  "displayName": "text",
  "dynamicSeverities": "text",
  "enabled": true,
  "groupBy": "text",
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": true,
  "pythonBody": "text",
  "reports": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": true,
      "mocks": [
        {
          "ANY_ADDITIONAL_PROPERTY": "text"
        }
      ],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

200 returned if the item already existed

delete simple rule

delete

Authorizations

Path parameters

idstringrequired

ID of the simple rule to delete

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request DELETE \
  --url 'https://your-api-host/simple-rules/{id}' \
  --header 'X-API-Key: YOUR_API_KEY'

204

400

404

204

No body

No Content response.

list simple rules

get

Authorizations

Query parameters

cursorstringoptional

the pagination token

limitinteger · int64 · default: 100optional

the maximum results to return

include-pythonboolean · default: falseoptional

determines if associated python for the generated rule is returned

Responses

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url 'https://your-api-host/simple-rules' \
  --header 'X-API-Key: YOUR_API_KEY'

200

200

{
  "next": "text",
  "results": [
    {
      "alertContext": "text",
      "alertTitle": "text",
      "createdAt": "text",
      "dedupPeriodMinutes": 1,
      "description": "text",
      "detection": "text",
      "displayName": "text",
      "dynamicSeverities": "text",
      "enabled": true,
      "groupBy": "text",
      "id": "text",
      "inlineFilters": "text",
      "lastModified": "text",
      "logTypes": [
        "text"
      ],
      "managed": true,
      "pythonBody": "text",
      "reports": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "runbook": "text",
      "severity": "INFO",
      "summaryAttributes": [
        "text"
      ],
      "tags": [
        "text"
      ],
      "tests": [
        {
          "expectedResult": true,
          "mocks": [
            {
              "ANY_ADDITIONAL_PROPERTY": "text"
            }
          ],
          "name": "text",
          "resource": "text"
        }
      ],
      "threshold": 1
    }
  ]
}

OK response.