Update Policies

Cortex XSIAM Platform APIs

put /api/v2/policies

Update policies/rule instances in the rules management service.

CLIENT REQUEST
curl -X 'PUT'
-H 'Accept: application/json; charset=UTF-8'
-H 'Content-Type: application/json; charset=UTF-8'
'https://api-yourfqdn/api/v2/policies'
-d '{ "action" : "ISSUE", "assetGroups" : [ "group1", "group2" ], "assetGroupsIDs" : [ 1, 2 ], "assetScope" : "<some asset scope in blob form>", "condition" : "<some condition in blob form>", "createdBy" : "user", "description" : "some policy description", "disabled" : false, "evaluationModes" : [ "PERIODIC" ], "evaluationStage" : "CI", "exception" : "<some exception in blob form>", "id" : "policyID", "missingInformationAction" : "ISSUE", "name" : "some policy", "policyRules" : [ { "action" : "ISSUE", "rule_id" : "3", "severity" : "CRITICAL" }, { "action" : "PREVENT", "rule_id" : "4", "severity" : "HIGH" } ], "remediationGuidance" : "some remediation guidance", "severity" : "CRITICAL", "type" : "COMPLIANCE", "usingSystemAssetGroups" : false }'
import http.client conn = http.client.HTTPSConnection("api-yourfqdn") conn.request("PUT", "/api/v2/policies") res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
require 'uri' require 'net/http' require 'openssl' url = URI("https://api-yourfqdn/api/v2/policies") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_NONE request = Net::HTTP::Put.new(url) response = http.request(request) puts response.read_body
const data = null; const xhr = new XMLHttpRequest(); xhr.withCredentials = true; xhr.addEventListener("readystatechange", function () { if (this.readyState === this.DONE) { console.log(this.responseText); } }); xhr.open("PUT", "https://api-yourfqdn/api/v2/policies"); xhr.send(data);
HttpResponse<String> response = Unirest.put("https://api-yourfqdn/api/v2/policies") .asString();
import Foundation let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/api/v2/policies")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PUT" let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume()
<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://api-yourfqdn/api/v2/policies", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "PUT", ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; }
CURL *hnd = curl_easy_init(); curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "PUT"); curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/api/v2/policies"); CURLcode ret = curl_easy_perform(hnd);
var client = new RestClient("https://api-yourfqdn/api/v2/policies"); var request = new RestRequest(Method.PUT); IRestResponse response = client.Execute(request);
Body parameters
array[PolicyPutRequestDataV2]
required
application/json; charset=UTF-8
[
actionstring (Enum)

One of the supported policy actions

Example:"ISSUE"
Allowed values:"ISSUE""PREVENT"null
assetGroupsarray[string]
assetGroupsIDsarray[integer]
assetScopestringbyte
conditionstringbyte
createdBystring
descriptionstring
disabledboolean
evaluationModesarray[string]
evaluationStagestring (Enum)

Lists supported evaluation stages

Example:"CI"
Allowed values:"CI""RUNTIME""DEPLOY"
exceptionstringbyte
idstring
missingInformationActionstring (Enum)

One of the supported policy actions

Example:"ISSUE"
Allowed values:"ISSUE""PREVENT"null
namestring
policyRulesarray

Array of policy_rule objects related to the policy

[
actionstring (Enum)

One of the supported policy actions

Example:"ISSUE"
Allowed values:"ISSUE""PREVENT"null
rule_idstring
severitystring (Enum)

One of the supported policy severities

Example:"CRITICAL"
Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"null
user_remediation_guidancestring
]
remediationGuidancestring
severitystring (Enum)

One of the supported policy severities

Example:"CRITICAL"
Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"null
typestring (Enum)

One of the supported policy types

Example:"MALWARE"
Allowed values:"COMPLIANCE""MALWARE""SECRET""TRUSTED_IMAGES"null
usingSystemAssetGroupsboolean
]
REQUEST
[application/json; charset=UTF-8 content]
Responses

Success

Client error

Body
application/json; charset=UTF-8
errorstring
RESPONSE
[application/json; charset=UTF-8 content]

Forbidden error

Body
application/json; charset=UTF-8

Indicates a forbidden access response

errorstring
RESPONSE
[application/json; charset=UTF-8 content]

Service had unexpected internal error