Create a new rule

post /platform/notifications/v1/rule

This endpoint allows the user to create a new alert notification rule and specify its attributes. To see the possible forward_type values, please check the relevant enum named LogForwardType for additional information. The forward_source attribute is where a user would define email, Slack, and Syslog configurations; the required formats for these fields are documented in the RuleCreateRequest schema. The applications attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The mail_format, syslog_format, and slack_format attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the RuleCreateRequest schema.

CLIENT REQUEST

          curl -X 'POST'

        -H
        'Accept: application/json'
      

        -H
        'Content-Type: application/json'
      

      'https://api-cortex.paloaltonetworks.com/platform/notifications/v1/rule'
    

      -d
      '{
  "request_data" : {
    "name" : "Test Rule 01",
    "description" : "a description for the test rule",
    "forward_type" : "alert",
    "filter" : {
      "filter" : {
        "AND" : [ {
          "SEARCH_FIELD" : "is_whitelisted",
          "SEARCH_TYPE" : "EQ",
          "SEARCH_VALUE" : false
        } ]
      }
    },
    "forward_source" : {
      "email" : {
        "distribution_list" : [ "testuser@paloaltonetworks.com" ],
        "aggregation" : 1000
      },
      "syslog" : {
        "id" : 1
      },
      "slack" : {
        "channels" : [ "slack-test-channel1" ]
      }
    },
    "applications" : [ "63e3ad1f-0efc-401d-90dd-a305ab6053a4" ],
    "time_zone" : "Pacific/Nauru",
    "mail_format" : "issue",
    "syslog_format" : "standard_alert",
    "slack_format" : "issue"
  }
}'
    


      

import http.client

conn = http.client.HTTPSConnection("api-")

payload = "{\"request_data\":{\"name\":\"Test Rule 01\",\"description\":\"a description for the test rule\",\"forward_type\":\"alert\",\"filter\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"is_whitelisted\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":false}]}},\"forward_source\":{\"email\":{\"distribution_list\":[\"testuser@paloaltonetworks.com\"],\"aggregation\":1000},\"syslog\":{\"id\":1},\"slack\":{\"channels\":[\"slack-test-channel1\"]}},\"applications\":[\"63e3ad1f-0efc-401d-90dd-a305ab6053a4\"],\"time_zone\":\"Pacific/Nauru\",\"mail_format\":\"issue\",\"syslog_format\":\"standard_alert\",\"slack_format\":\"issue\"}}"

headers = { 'content-type': "application/json" }

conn.request("POST", "%7Bfqdn%7D/platform/notifications/v1/rule", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-/%7Bfqdn%7D/platform/notifications/v1/rule")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)
request["content-type"] = 'application/json'
request.body = "{\"request_data\":{\"name\":\"Test Rule 01\",\"description\":\"a description for the test rule\",\"forward_type\":\"alert\",\"filter\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"is_whitelisted\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":false}]}},\"forward_source\":{\"email\":{\"distribution_list\":[\"testuser@paloaltonetworks.com\"],\"aggregation\":1000},\"syslog\":{\"id\":1},\"slack\":{\"channels\":[\"slack-test-channel1\"]}},\"applications\":[\"63e3ad1f-0efc-401d-90dd-a305ab6053a4\"],\"time_zone\":\"Pacific/Nauru\",\"mail_format\":\"issue\",\"syslog_format\":\"standard_alert\",\"slack_format\":\"issue\"}}"

response = http.request(request)
puts response.read_body

const data = JSON.stringify({
  "request_data": {
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "forward_type": "alert",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue"
  }
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-/%7Bfqdn%7D/platform/notifications/v1/rule");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-/%7Bfqdn%7D/platform/notifications/v1/rule")
  .header("content-type", "application/json")
  .body("{\"request_data\":{\"name\":\"Test Rule 01\",\"description\":\"a description for the test rule\",\"forward_type\":\"alert\",\"filter\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"is_whitelisted\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":false}]}},\"forward_source\":{\"email\":{\"distribution_list\":[\"testuser@paloaltonetworks.com\"],\"aggregation\":1000},\"syslog\":{\"id\":1},\"slack\":{\"channels\":[\"slack-test-channel1\"]}},\"applications\":[\"63e3ad1f-0efc-401d-90dd-a305ab6053a4\"],\"time_zone\":\"Pacific/Nauru\",\"mail_format\":\"issue\",\"syslog_format\":\"standard_alert\",\"slack_format\":\"issue\"}}")
  .asString();

import Foundation

let headers = ["content-type": "application/json"]
let parameters = ["request_data": [
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "forward_type": "alert",
    "filter": ["filter": ["AND": [
          [
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          ]
        ]]],
    "forward_source": [
      "email": [
        "distribution_list": ["testuser@paloaltonetworks.com"],
        "aggregation": 1000
      ],
      "syslog": ["id": 1],
      "slack": ["channels": ["slack-test-channel1"]]
    ],
    "applications": ["63e3ad1f-0efc-401d-90dd-a305ab6053a4"],
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue"
  ]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-/%7Bfqdn%7D/platform/notifications/v1/rule")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-/%7Bfqdn%7D/platform/notifications/v1/rule",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"request_data\":{\"name\":\"Test Rule 01\",\"description\":\"a description for the test rule\",\"forward_type\":\"alert\",\"filter\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"is_whitelisted\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":false}]}},\"forward_source\":{\"email\":{\"distribution_list\":[\"testuser@paloaltonetworks.com\"],\"aggregation\":1000},\"syslog\":{\"id\":1},\"slack\":{\"channels\":[\"slack-test-channel1\"]}},\"applications\":[\"63e3ad1f-0efc-401d-90dd-a305ab6053a4\"],\"time_zone\":\"Pacific/Nauru\",\"mail_format\":\"issue\",\"syslog_format\":\"standard_alert\",\"slack_format\":\"issue\"}}",
  CURLOPT_HTTPHEADER => [
    "content-type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-/%7Bfqdn%7D/platform/notifications/v1/rule");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "content-type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"request_data\":{\"name\":\"Test Rule 01\",\"description\":\"a description for the test rule\",\"forward_type\":\"alert\",\"filter\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"is_whitelisted\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":false}]}},\"forward_source\":{\"email\":{\"distribution_list\":[\"testuser@paloaltonetworks.com\"],\"aggregation\":1000},\"syslog\":{\"id\":1},\"slack\":{\"channels\":[\"slack-test-channel1\"]}},\"applications\":[\"63e3ad1f-0efc-401d-90dd-a305ab6053a4\"],\"time_zone\":\"Pacific/Nauru\",\"mail_format\":\"issue\",\"syslog_format\":\"standard_alert\",\"slack_format\":\"issue\"}}");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-/%7Bfqdn%7D/platform/notifications/v1/rule");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"request_data\":{\"name\":\"Test Rule 01\",\"description\":\"a description for the test rule\",\"forward_type\":\"alert\",\"filter\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"is_whitelisted\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":false}]}},\"forward_source\":{\"email\":{\"distribution_list\":[\"testuser@paloaltonetworks.com\"],\"aggregation\":1000},\"syslog\":{\"id\":1},\"slack\":{\"channels\":[\"slack-test-channel1\"]}},\"applications\":[\"63e3ad1f-0efc-401d-90dd-a305ab6053a4\"],\"time_zone\":\"Pacific/Nauru\",\"mail_format\":\"issue\",\"syslog_format\":\"standard_alert\",\"slack_format\":\"issue\"}}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

Body parameters

application/json

Enumerates the rule creation request schema for Alert Notifications

request_dataobject

namestringrequired

Name of the rule

descriptionstring

Optional description of the rule

forward_typestringrequired

A required value from the LogForwardType Enum.

Example:"alert | audit | agent_audit | case"

filterobject

An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the BaseFilterExample and ComplexFilterExample schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.

forward_sourceobject

This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs.

emailobject

An object containing all the information that configures email output for the given notification rule.

distribution_listarray[string]required

List of valid email addresses that will receive notifications forwarded by the given rule.

aggregationinteger

An integer that is between 0 and 1440 (in minutes).

Example:10

custom_mail_subjectstring

This string value allows the user to customize the mail subject of the event forwarded by the given rule.

Example:"Custom Email Subject"

slackobject

An object containing all the information that configures Slack output for the given notification rule.

channelsarray[string]required

List of valid Slack channels that will receive notifications forwarded by the given rule.

syslogobject

An object containing all the information that configures Syslog output for the given notification rule.

idintegerrequired

This string value that specifies the Syslog integration that will be associated with the given notification rule.

Example:305

applicationsarray[string]

List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.

time_zonestring

This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: Africa/Abidjan, Africa/Accra, Africa/Addis_Ababa, Africa/Algiers, Africa/Asmara, Africa/Asmera, Africa/Bamako, Africa/Bangui, Africa/Banjul, Africa/Bissau, Africa/Blantyre, Africa/Brazzaville, Africa/Bujumbura, Africa/Cairo, Africa/Casablanca, Africa/Ceuta, Africa/Conakry, Africa/Dakar, Africa/Dar_es_Salaam, Africa/Djibouti, Africa/Douala, Africa/El_Aaiun, Africa/Freetown, Africa/Gaborone, Africa/Harare, Africa/Johannesburg, Africa/Juba, Africa/Kampala, Africa/Khartoum, Africa/Kigali, Africa/Kinshasa, Africa/Lagos, Africa/Libreville, Africa/Lome, Africa/Luanda, Africa/Lubumbashi, Africa/Lusaka, Africa/Malabo, Africa/Maputo, Africa/Maseru, Africa/Mbabane, Africa/Mogadishu, Africa/Monrovia, Africa/Nairobi, Africa/Ndjamena, Africa/Niamey, Africa/Nouakchott, Africa/Ouagadougou, Africa/Porto-Novo, Africa/Sao_Tome, Africa/Timbuktu, Africa/Tripoli, Africa/Tunis, Africa/Windhoek, America/Adak, America/Anchorage, America/Anguilla, America/Antigua, America/Araguaina, America/Argentina/Buenos_Aires, America/Argentina/Catamarca, America/Argentina/ComodRivadavia, America/Argentina/Cordoba, America/Argentina/Jujuy, America/Argentina/La_Rioja, America/Argentina/Mendoza, America/Argentina/Rio_Gallegos, America/Argentina/Salta, America/Argentina/San_Juan, America/Argentina/San_Luis, America/Argentina/Tucuman, America/Argentina/Ushuaia, America/Aruba, America/Asuncion, America/Atikokan, America/Atka, America/Bahia, America/Bahia_Banderas, America/Barbados, America/Belem, America/Belize, America/Blanc-Sablon, America/Boa_Vista, America/Bogota, America/Boise, America/Buenos_Aires, America/Cambridge_Bay, America/Campo_Grande, America/Cancun, America/Caracas, America/Catamarca, America/Cayenne, America/Cayman, America/Chicago, America/Chihuahua, America/Ciudad_Juarez, America/Coral_Harbour, America/Cordoba, America/Costa_Rica, America/Coyhaique, America/Creston, America/Cuiaba, America/Curacao, America/Danmarkshavn, America/Dawson, America/Dawson_Creek, America/Denver, America/Detroit, America/Dominica, America/Edmonton, America/Eirunepe, America/El_Salvador, America/Ensenada, America/Fort_Nelson, America/Fort_Wayne, America/Fortaleza, America/Glace_Bay, America/Godthab, America/Goose_Bay, America/Grand_Turk, America/Grenada, America/Guadeloupe, America/Guatemala, America/Guayaquil, America/Guyana, America/Halifax, America/Havana, America/Hermosillo, America/Indiana/Indianapolis, America/Indiana/Knox, America/Indiana/Marengo, America/Indiana/Petersburg, America/Indiana/Tell_City, America/Indiana/Vevay, America/Indiana/Vincennes, America/Indiana/Winamac, America/Indianapolis, America/Inuvik, America/Iqaluit, America/Jamaica, America/Jujuy, America/Juneau, America/Kentucky/Louisville, America/Kentucky/Monticello, America/Knox_IN, America/Kralendijk, America/La_Paz, America/Lima, America/Los_Angeles, America/Louisville, America/Lower_Princes, America/Maceio, America/Managua, America/Manaus, America/Marigot, America/Martinique, America/Matamoros, America/Mazatlan, America/Mendoza, America/Menominee, America/Merida, America/Metlakatla, America/Mexico_City, America/Miquelon, America/Moncton, America/Monterrey, America/Montevideo, America/Montreal, America/Montserrat, America/Nassau, America/New_York, America/Nipigon, America/Nome, America/Noronha, America/North_Dakota/Beulah, America/North_Dakota/Center, America/North_Dakota/New_Salem, America/Nuuk, America/Ojinaga, America/Panama, America/Pangnirtung, America/Paramaribo, America/Phoenix, America/Port-au-Prince, America/Port_of_Spain, America/Porto_Acre, America/Porto_Velho, America/Puerto_Rico, America/Punta_Arenas, America/Rainy_River, America/Rankin_Inlet, America/Recife, America/Regina, America/Resolute, America/Rio_Branco, America/Rosario, America/Santa_Isabel, America/Santarem, America/Santiago, America/Santo_Domingo, America/Sao_Paulo, America/Scoresbysund, America/Shiprock, America/Sitka, America/St_Barthelemy, America/St_Johns, America/St_Kitts, America/St_Lucia, America/St_Thomas, America/St_Vincent, America/Swift_Current, America/Tegucigalpa, America/Thule, America/Thunder_Bay, America/Tijuana, America/Toronto, America/Tortola, America/Vancouver, America/Virgin, America/Whitehorse, America/Winnipeg, America/Yakutat, America/Yellowknife, Antarctica/Casey, Antarctica/Davis, Antarctica/DumontDUrville, Antarctica/Macquarie, Antarctica/Mawson, Antarctica/McMurdo, Antarctica/Palmer, Antarctica/Rothera, Antarctica/South_Pole, Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok, Arctic/Longyearbyen, Asia/Aden, Asia/Almaty, Asia/Amman, Asia/Anadyr, Asia/Aqtau, Asia/Aqtobe, Asia/Ashgabat, Asia/Ashkhabad, Asia/Atyrau, Asia/Baghdad, Asia/Bahrain, Asia/Baku, Asia/Bangkok, Asia/Barnaul, Asia/Beirut, Asia/Bishkek, Asia/Brunei, Asia/Calcutta, Asia/Chita, Asia/Choibalsan, Asia/Chongqing, Asia/Chungking, Asia/Colombo, Asia/Dacca, Asia/Damascus, Asia/Dhaka, Asia/Dili, Asia/Dubai, Asia/Dushanbe, Asia/Famagusta, Asia/Gaza, Asia/Harbin, Asia/Hebron, Asia/Ho_Chi_Minh, Asia/Hong_Kong, Asia/Hovd, Asia/Irkutsk, Asia/Istanbul, Asia/Jakarta, Asia/Jayapura, Asia/Jerusalem, Asia/Kabul, Asia/Kamchatka, Asia/Karachi, Asia/Kashgar, Asia/Kathmandu, Asia/Katmandu, Asia/Khandyga, Asia/Kolkata, Asia/Krasnoyarsk, Asia/Kuala_Lumpur, Asia/Kuching, Asia/Kuwait, Asia/Macao, Asia/Macau, Asia/Magadan, Asia/Makassar, Asia/Manila, Asia/Muscat, Asia/Nicosia, Asia/Novokuznetsk, Asia/Novosibirsk, Asia/Omsk, Asia/Oral, Asia/Phnom_Penh, Asia/Pontianak, Asia/Pyongyang, Asia/Qatar, Asia/Qostanay, Asia/Qyzylorda, Asia/Rangoon, Asia/Riyadh, Asia/Saigon, Asia/Sakhalin, Asia/Samarkand, Asia/Seoul, Asia/Shanghai, Asia/Singapore, Asia/Srednekolymsk, Asia/Taipei, Asia/Tashkent, Asia/Tbilisi, Asia/Tehran, Asia/Tel_Aviv, Asia/Thimbu, Asia/Thimphu, Asia/Tokyo, Asia/Tomsk, Asia/Ujung_Pandang, Asia/Ulaanbaatar, Asia/Ulan_Bator, Asia/Urumqi, Asia/Ust-Nera, Asia/Vientiane, Asia/Vladivostok, Asia/Yakutsk, Asia/Yangon, Asia/Yekaterinburg, Asia/Yerevan, Atlantic/Azores, Atlantic/Bermuda, Atlantic/Canary, Atlantic/Cape_Verde, Atlantic/Faeroe, Atlantic/Faroe, Atlantic/Jan_Mayen, Atlantic/Madeira, Atlantic/Reykjavik, Atlantic/South_Georgia, Atlantic/St_Helena, Atlantic/Stanley, Australia/ACT, Australia/Adelaide, Australia/Brisbane, Australia/Broken_Hill, Australia/Canberra, Australia/Currie, Australia/Darwin, Australia/Eucla, Australia/Hobart, Australia/LHI, Australia/Lindeman, Australia/Lord_Howe, Australia/Melbourne, Australia/NSW, Australia/North, Australia/Perth, Australia/Queensland, Australia/South, Australia/Sydney, Australia/Tasmania, Australia/Victoria, Australia/West, Australia/Yancowinna, Brazil/Acre, Brazil/DeNoronha, Brazil/East, Brazil/West, CET, CST6CDT, Canada/Atlantic, Canada/Central, Canada/Eastern, Canada/Mountain, Canada/Newfoundland, Canada/Pacific, Canada/Saskatchewan, Canada/Yukon, Chile/Continental, Chile/EasterIsland, Cuba, EET, EST, EST5EDT, Egypt, Eire, Etc/GMT, Etc/GMT+0, Etc/GMT+1, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Etc/GMT+2, Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8, Etc/GMT+9, Etc/GMT-0, Etc/GMT-1, Etc/GMT-10, Etc/GMT-11, Etc/GMT-12, Etc/GMT-13, Etc/GMT-14, Etc/GMT-2, Etc/GMT-3, Etc/GMT-4, Etc/GMT-5, Etc/GMT-6, Etc/GMT-7, Etc/GMT-8, Etc/GMT-9, Etc/GMT0, Etc/Greenwich, Etc/UCT, Etc/UTC, Etc/Universal, Etc/Zulu, Europe/Amsterdam, Europe/Andorra, Europe/Astrakhan, Europe/Athens, Europe/Belfast, Europe/Belgrade, Europe/Berlin, Europe/Bratislava, Europe/Brussels, Europe/Bucharest, Europe/Budapest, Europe/Busingen, Europe/Chisinau, Europe/Copenhagen, Europe/Dublin, Europe/Gibraltar, Europe/Guernsey, Europe/Helsinki, Europe/Isle_of_Man, Europe/Istanbul, Europe/Jersey, Europe/Kaliningrad, Europe/Kiev, Europe/Kirov, Europe/Kyiv, Europe/Lisbon, Europe/Ljubljana, Europe/London, Europe/Luxembourg, Europe/Madrid, Europe/Malta, Europe/Mariehamn, Europe/Minsk, Europe/Monaco, Europe/Moscow, Europe/Nicosia, Europe/Oslo, Europe/Paris, Europe/Podgorica, Europe/Prague, Europe/Riga, Europe/Rome, Europe/Samara, Europe/San_Marino, Europe/Sarajevo, Europe/Saratov, Europe/Simferopol, Europe/Skopje, Europe/Sofia, Europe/Stockholm, Europe/Tallinn, Europe/Tirane, Europe/Tiraspol, Europe/Ulyanovsk, Europe/Uzhgorod, Europe/Vaduz, Europe/Vatican, Europe/Vienna, Europe/Vilnius, Europe/Volgograd, Europe/Warsaw, Europe/Zagreb, Europe/Zaporozhye, Europe/Zurich, GB, GB-Eire, GMT, GMT+0, GMT-0, GMT0, Greenwich, HST, Hongkong, Iceland, Indian/Antananarivo, Indian/Chagos, Indian/Christmas, Indian/Cocos, Indian/Comoro, Indian/Kerguelen, Indian/Mahe, Indian/Maldives, Indian/Mauritius, Indian/Mayotte, Indian/Reunion, Iran, Israel, Jamaica, Japan, Kwajalein, Libya, MET, MST, MST7MDT, Mexico/BajaNorte, Mexico/BajaSur, Mexico/General, NZ, NZ-CHAT, Navajo, PRC, PST8PDT, Pacific/Apia, Pacific/Auckland, Pacific/Bougainville, Pacific/Chatham, Pacific/Chuuk, Pacific/Easter, Pacific/Efate, Pacific/Enderbury, Pacific/Fakaofo, Pacific/Fiji, Pacific/Funafuti, Pacific/Galapagos, Pacific/Gambier, Pacific/Guadalcanal, Pacific/Guam, Pacific/Honolulu, Pacific/Johnston, Pacific/Kanton, Pacific/Kiritimati, Pacific/Kosrae, Pacific/Kwajalein, Pacific/Majuro, Pacific/Marquesas, Pacific/Midway, Pacific/Nauru, Pacific/Niue, Pacific/Norfolk, Pacific/Noumea, Pacific/Pago_Pago, Pacific/Palau, Pacific/Pitcairn, Pacific/Pohnpei, Pacific/Ponape, Pacific/Port_Moresby, Pacific/Rarotonga, Pacific/Saipan, Pacific/Samoa, Pacific/Tahiti, Pacific/Tarawa, Pacific/Tongatapu, Pacific/Truk, Pacific/Wake, Pacific/Wallis, Pacific/Yap, Poland, Portugal, ROC, ROK, Singapore, Turkey, UCT, US/Alaska, US/Aleutian, US/Arizona, US/Central, US/East-Indiana, US/Eastern, US/Hawaii, US/Indiana-Starke, US/Michigan, US/Mountain, US/Pacific, US/Samoa, UTC, Universal, W-SU, WET, Zulu

Default:"UTC"

mail_formatstring

This string indicates whether the rule will use the issue, standard_alert, or legacy_alert format for mail integration. This string is strictly to be used with the alert log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.

Default:"issue"

syslog_formatstring

This string indicates whether the rule will use the issue, standard_alert, or legacy_alert format for Syslog integration. This string is strictly to be used with the alert log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.

Default:"issue"

slack_formatstring

This string indicates whether the rule will use the issue or standard_alert format for Slack integration. This string is strictly to be used with the alert log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the legacy_alert format is not permissible for Slack.

Default:"issue"

REQUEST
{
  "request_data": {
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "forward_type": "alert",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue"
  }
}

Responses

Body

application/json

dataobject

namestring

Name of the rule

rule_uuidstring

The unique identifier of the rule

descriptionstring

Optional description of the rule

forward_typestring

A required value from the LogForwardType Enum.

Example:"alert | audit | agent_audit | case"

filterobject

forward_sourceobject

This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs.

emailobject

An object containing all the information that configures email output for the given notification rule.

distribution_listarray[string]

List of valid email addresses that will receive notifications forwarded by the given rule.

aggregationinteger

An integer that is between 0 and 1440 (in minutes).

Example:10

custom_mail_subjectstring

This string value allows the user to customize the mail subject of the event forwarded by the given rule.

Example:"Custom Email Subject"

legacy_mail_formatboolean

This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)

slackobject

An object containing all the information that configures Slack output for the given notification rule.

channelsarray[string]

List of valid Slack channels that will receive notifications forwarded by the given rule.

syslogobject

An object containing all the information that configures Syslog output for the given notification rule.

idinteger

This string value that specifies the Syslog integration that will be associated with the given notification rule.

Example:305

applicationsarray[string]

List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.

time_zonestring

Default:"UTC"

mail_formatstring

Default:"issue"

syslog_formatstring

Default:"issue"

slack_formatstring

This string indicates whether the rule will use the issue or standard_alert format for Slack integration. This string is strictly to be used with the alert log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the legacy_alert format is not permissible for Slack.

Default:"issue"

created_bystring

This string indicates the user or api-key responsible for creating the notification rule.

created_atintegerint64

This value represents the timestamp when the notification rule was created.

modified_atintegerint64

This value represents the timestamp when the notification rule was last modified.

enabledboolean

A flag indicating whether the notification rule is currently active and enabled.

Default:true

RESPONSE
{
  "data": {
    "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4",
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000,
        "legacy_mail_format": false
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "forward_type": "alert",
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue",
    "created_by": "testuser@paloaltonetworks.com",
    "created_at": 1764958056697,
    "modified_at": 1764958056697,
    "enabled": true
  }
}

Body

application/json

dataobject

err_msgstringrequired

Error message describing the issue

metadataobject

err_extrastringrequired

Additional error details

err_codeintegerrequired

HTTP error code

RESPONSE
{
  "data": {
    "err_msg": "The request contains invalid or missing parameters.",
    "metadata": {
      "err_extra": "The mail format field provided is invalid.",
      "err_code": 400
    }
  }
}

Body

application/json

RESPONSE
{
  "reply": {
    "err_code": 401,
    "err_msg": "Public API request unauthorized",
    "err_extra": null
  }
}

Body

application/json

replyobject

err_msgstring

err_extrastring

err_codeinteger

RESPONSE
{
  "reply": {
    "err_code": 403,
    "err_msg": "Forbidden. Access was denied to this resource.",
    "err_extra": "Insufficient permissions for api key"
  }
}