Get the Compliance Rules

Cortex XSIAM Platform APIs

get /api/v1/rules/get

Get all Compliance rules (system and custom).This API supports pagination.

Query parameters
offset Integer

Fetches rules from offset location, default is 0.

Example: 56
limit Integer

The maximum number of rules to fetch in a single page request, if not specified. default is set to fetch all.

Example: 56
types array[PolicyType]

The policy rule definitions types to fetch.

platform String

The platform to which the rules should be applied.

Example: platform_example
source String

The scanner source type for the rule.

Example: K8sApi
CLIENT REQUEST
curl -X 'GET'
-H 'Accept: application/json; charset=UTF-8'
'https://api-yourfqdn/api/v1/rules/get?offset=56&limit=56&types=&platform=platform_example&source=K8sApi'
import http.client conn = http.client.HTTPSConnection("api-yourfqdn") conn.request("GET", "/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi") res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
require 'uri' require 'net/http' require 'openssl' url = URI("https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Get.new(url) response = http.request(request) puts response.read_body
const data = null; const xhr = new XMLHttpRequest(); xhr.withCredentials = true; xhr.addEventListener("readystatechange", function () { if (this.readyState === this.DONE) { console.log(this.responseText); } }); xhr.open("GET", "https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi"); xhr.send(data);
HttpResponse<String> response = Unirest.get("https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi") .asString();
import Foundation let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume()
<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "GET", ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; }
CURL *hnd = curl_easy_init(); curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "GET"); curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi"); CURLcode ret = curl_easy_perform(hnd);
var client = new RestClient("https://api-yourfqdn/api/v1/rules/get?offset=SOME_INTEGER_VALUE&limit=SOME_INTEGER_VALUE&types=null&platform=SOME_STRING_VALUE&source=K8sApi"); var request = new RestRequest(Method.GET); IRestResponse response = client.Execute(request);
Responses

Success

Body
application/json; charset=UTF-8

Returns a compliance rules page

limitinteger

The maximum rules to fetch in a single page request, if not provided default is to fetch all.

Example:50
offsetinteger

The offset from where the rules fetched

Example:150
rulesarray
[
availableActionsarray[string]

Lists available actions

changeLogstring
controlsIDsarray[string]
createdAtstringdate-time
createdBystring
descriptionstring
enginestring (Enum)
Example:"rego"
Allowed values:"rego""bash""embedded""python"
evaluationScriptstring
extraDataobject
isSystemRuleboolean
modifiedAtstringdate-time
modifiedBystring
namestring
platformsarray[string]
providersarray[string]
remediationstring
revisioninteger
ruleIdstring
ruleStandardsarray

Lists rule standards

[
]
ruleUAIAssetsarray

Lists UAI assets relevant to the rule

[
]
severitystring (Enum)

Supported rule severities

Example:"CRITICAL"
Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"
sourcearray[string]
specVerstring
typestring
]
totalinteger

Total filtered count of rules

Example:347
RESPONSE
[application/json; charset=UTF-8 content]

Client error

Body
application/json; charset=UTF-8
errorstring
RESPONSE
[application/json; charset=UTF-8 content]

Service encountered an unexpected internal error