Simple Rules

REST API operations for Simple/YAML Rules

Overview

The /simple-rules REST API operations are in open beta starting with Panther version 1.98, and are available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with rules created as Simple Detections in the CLI workflow or in the Panther Console's Simple Detection Builder.

The simple rule API entity is only applicable to rules that are Simple Detections. To interact with rules created in Python, see Rules.

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Required permissions

• For GET operations, your API token must have the View Rules permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Rules permission.

Operations

create simple rule

POSThttps://your-api-host/simple-rules

Query parameters

Body

application/json

alertContextstring

The alert context represented in YAML

alertTitlestring

The alert title represented in YAML

dedupPeriodMinutesinteger

The amount of time in minutes for grouping alerts

descriptionstring

The description of the rule

detection*string

The yaml representation of the rule

displayNamestring

The display name of the rule

dynamicSeveritiesstring

The dynamic severity represented in YAML

enabledboolean

Determines whether or not the rule is active

groupBystring

The key on an event to group by represented in YAML

id*string

The id of the rule

inlineFiltersstring

The filter for the rule represented in YAML

logTypesarray of string

log types

managedboolean

Determines if the simple rule is managed by panther

pythonBodystring

The python body of the rule

reportsobject

reports

runbookstring

How to handle the generated alert

severity*enum

INFOLOWMEDIUMHIGHCRITICAL

summaryAttributesarray of string

A list of fields in the event to create top 5 summaries for

tagsarray of string

The tags for the simple rule

testsarray of SimpleRuleAPI.UnitTest (object)

Unit tests for the Rule. Best practice is to include a positive and negative case

thresholdinteger

the number of events that must match before an alert is triggered

Response

200204400409

OK response.

Body

application/json

SimpleRuleAPI.SimpleRulecreateResponseBody (any)

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/simple-rules', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "id": "text",
      "detection": "text",
      "severity": "INFO"
    }),
});
const data = await response.json();

Response

400409

{
  "message": "text",
  "testResults": [
    {
      "error": {
        "code": "text",
        "message": "text"
      },
      "errored": false,
      "functions": {
        "alertContext": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "dedup": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "description": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "destinations": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "detection": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "reference": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "runbook": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "severity": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "title": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        }
      },
      "name": "text",
      "passed": false,
      "triggerAlert": false
    }
  ]
}

get a simple rule

GEThttps://your-api-host/simple-rules/{id}

Path parameters

id*string

ID of the rule to fetch

Query parameters

Response

200404

OK response.

Body

application/json

alertContextstring

The alert context represented in YAML

alertTitlestring

The alert title represented in YAML

createdAtstring

dedupPeriodMinutesinteger

The amount of time in minutes for grouping alerts

descriptionstring

The description of the rule

detectionstring

The yaml representation of the rule

displayNamestring

The display name of the rule

dynamicSeveritiesstring

The dynamic severity represented in YAML

enabledboolean

Determines whether or not the rule is active

groupBystring

The key on an event to group by represented in YAML

idstring

The id of the rule

inlineFiltersstring

The filter for the rule represented in YAML

lastModifiedstring

logTypesarray of string

log types

managedboolean

Determines if the simple rule is managed by panther

pythonBodystring

The python body of the rule

reportsobject

reports

runbookstring

How to handle the generated alert

severityenum

INFOLOWMEDIUMHIGHCRITICAL

summaryAttributesarray of string

A list of fields in the event to create top 5 summaries for

tagsarray of string

The tags for the simple rule

testsarray of SimpleRuleAPI.UnitTest (object)

Unit tests for the Rule. Best practice is to include a positive and negative case

thresholdinteger

the number of events that must match before an alert is triggered

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/simple-rules/{id}', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200404

{
  "alertContext": "text",
  "alertTitle": "text",
  "createdAt": "text",
  "dedupPeriodMinutes": 60,
  "description": "text",
  "detection": "text",
  "displayName": "text",
  "dynamicSeverities": "text",
  "enabled": false,
  "groupBy": "text",
  "id": "text",
  "inlineFilters": "text",
  "lastModified": "text",
  "logTypes": [
    "text"
  ],
  "managed": false,
  "pythonBody": "text",
  "runbook": "text",
  "severity": "INFO",
  "summaryAttributes": [
    "text"
  ],
  "tags": [
    "text"
  ],
  "tests": [
    {
      "expectedResult": false,
      "mocks": [],
      "name": "text",
      "resource": "text"
    }
  ],
  "threshold": 1
}

put simple rule

put creates or updates a rule

PUThttps://your-api-host/simple-rules/{id}

Path parameters

id*string

the id of the rule

Query parameters

Body

application/json

alertContextstring

The alert context represented in YAML

alertTitlestring

The alert title represented in YAML

dedupPeriodMinutesinteger

The amount of time in minutes for grouping alerts

descriptionstring

The description of the rule

detection*string

The yaml representation of the rule

displayNamestring

The display name of the rule

dynamicSeveritiesstring

The dynamic severity represented in YAML

enabledboolean

Determines whether or not the rule is active

groupBystring

The key on an event to group by represented in YAML

id*string

The id of the rule

inlineFiltersstring

The filter for the rule represented in YAML

logTypesarray of string

log types

managedboolean

Determines if the simple rule is managed by panther

pythonBodystring

The python body of the rule

reportsobject

reports

runbookstring

How to handle the generated alert

severity*enum

INFOLOWMEDIUMHIGHCRITICAL

summaryAttributesarray of string

A list of fields in the event to create top 5 summaries for

tagsarray of string

The tags for the simple rule

testsarray of SimpleRuleAPI.UnitTest (object)

Unit tests for the Rule. Best practice is to include a positive and negative case

thresholdinteger

the number of events that must match before an alert is triggered

Response

200201204400

200 returned if the item already existed

Body

application/json

SimpleRuleAPI.SimpleRulecreateResponseBody (any)

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/simple-rules/{id}', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "id": "text",
      "detection": "text",
      "severity": "INFO"
    }),
});
const data = await response.json();

Response

400

{
  "message": "text",
  "testResults": [
    {
      "error": {
        "code": "text",
        "message": "text"
      },
      "errored": false,
      "functions": {
        "alertContext": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "dedup": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "description": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "destinations": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "detection": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "reference": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "runbook": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "severity": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "title": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        }
      },
      "name": "text",
      "passed": false,
      "triggerAlert": false
    }
  ]
}

delete simple rule

DELETEhttps://your-api-host/simple-rules/{id}

Path parameters

id*string

ID of the simple rule to delete

Response

204400404

No Content response.

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/simple-rules/{id}', {
    method: 'DELETE',
    headers: {},
});
const data = await response.json();

Response

400404

{
  "message": "text",
  "testResults": [
    {
      "error": {
        "code": "text",
        "message": "text"
      },
      "errored": false,
      "functions": {
        "alertContext": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "dedup": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "description": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "destinations": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "detection": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "reference": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "runbook": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "severity": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        },
        "title": {
          "error": {
            "code": "text",
            "message": "text"
          },
          "output": "text"
        }
      },
      "name": "text",
      "passed": false,
      "triggerAlert": false
    }
  ]
}

list simple rules

GEThttps://your-api-host/simple-rules

Query parameters

Response

200

OK response.

Body

application/json

nextstring

pagination token for the next page of results

resultsarray of SimpleRuleAPI.SimpleRulecreateResponseBody (any)

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/simple-rules', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200

{
  "next": "text",
  "results": []
}