Get rules by IDs

Cortex XSIAM Platform APIs

post /api/v1/rules/fetch

Get rules by a list of IDs. If a rule is not found for a specific ID, an error is returned.

CLIENT REQUEST
curl -X 'POST'
-H 'Accept: application/json; charset=UTF-8'
-H 'Content-Type: application/json'
'https://api-yourfqdn/api/v1/rules/fetch'
-d ''
import http.client conn = http.client.HTTPSConnection("api-yourfqdn") payload = "{\"ids\":[\"rule-id-1\",\"rule-id-2\",\"rule-id-3\"]}" headers = { 'content-type': "application/json" } conn.request("POST", "/api/v1/rules/fetch", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
require 'uri' require 'net/http' require 'openssl' url = URI("https://api-yourfqdn/api/v1/rules/fetch") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Post.new(url) request["content-type"] = 'application/json' request.body = "{\"ids\":[\"rule-id-1\",\"rule-id-2\",\"rule-id-3\"]}" response = http.request(request) puts response.read_body
const data = JSON.stringify({ "ids": [ "rule-id-1", "rule-id-2", "rule-id-3" ] }); const xhr = new XMLHttpRequest(); xhr.withCredentials = true; xhr.addEventListener("readystatechange", function () { if (this.readyState === this.DONE) { console.log(this.responseText); } }); xhr.open("POST", "https://api-yourfqdn/api/v1/rules/fetch"); xhr.setRequestHeader("content-type", "application/json"); xhr.send(data);
HttpResponse<String> response = Unirest.post("https://api-yourfqdn/api/v1/rules/fetch") .header("content-type", "application/json") .body("{\"ids\":[\"rule-id-1\",\"rule-id-2\",\"rule-id-3\"]}") .asString();
import Foundation let headers = ["content-type": "application/json"] let parameters = ["ids": ["rule-id-1", "rule-id-2", "rule-id-3"]] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/api/v1/rules/fetch")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume()
<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://api-yourfqdn/api/v1/rules/fetch", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "{\"ids\":[\"rule-id-1\",\"rule-id-2\",\"rule-id-3\"]}", CURLOPT_HTTPHEADER => [ "content-type: application/json" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; }
CURL *hnd = curl_easy_init(); curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST"); curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/api/v1/rules/fetch"); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "content-type: application/json"); curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers); curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"ids\":[\"rule-id-1\",\"rule-id-2\",\"rule-id-3\"]}"); CURLcode ret = curl_easy_perform(hnd);
var client = new RestClient("https://api-yourfqdn/api/v1/rules/fetch"); var request = new RestRequest(Method.POST); request.AddHeader("content-type", "application/json"); request.AddParameter("application/json", "{\"ids\":[\"rule-id-1\",\"rule-id-2\",\"rule-id-3\"]}", ParameterType.RequestBody); IRestResponse response = client.Execute(request);
Body parameters
required
application/json
idsarray[string]
REQUEST
{ "ids": [ "rule-id-1", "rule-id-2", "rule-id-3" ] }
Responses

Success. Returns a list of rule objects.

Body
application/json; charset=UTF-8
[
availableActionsarray[string]

A list of the available actions

changeLogstring
controlsIDsarray[string]
createdAtstringdate-time
createdBystring
descriptionstring
enginestring (Enum)
Example:"rego"
Allowed values:"rego""bash""embedded""python"
evaluationScriptstring
extraDataobject
isSystemRuleboolean
modifiedAtstringdate-time
modifiedBystring
namestring
platformsarray[string]
providersarray[string]
remediationstring
revisioninteger
ruleIdstring
ruleStandardsarray

Lists rule standards

[
]
ruleUAIAssetsarray

Lists UAI assets relevant to the rule

[
]
severitystring (Enum)

Supported rule severities

Example:"CRITICAL"
Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"
sourcearray[string]
specVerstring
typestring
]
RESPONSE
[application/json; charset=UTF-8 content]

Bad request error.

Body
application/json; charset=UTF-8
errorstring
RESPONSE
[application/json; charset=UTF-8 content]

Rules not found

Body
application/json; charset=UTF-8
errorstring
RESPONSE
[application/json; charset=UTF-8 content]

Service encountered an unexpected internal error.