Update (custom) Compliance rules

post /api/v1/rules/update

Update (custom) Compliance rules in the rules management service.

CLIENT REQUEST

          curl -X 'POST'

        -H
        'Accept: application/json; charset=UTF-8'
      

        -H
        'Content-Type: application/json; charset=UTF-8'
      

      'https://api-yourfqdn/api/v1/rules/update'
    

      -d
      '{
  "changeLog" : "format the rego script",
  "controlsIDs" : [ "2a16a9f3-2602-4f0c-a909-7c184ddfeda2", "2a16a9f3-2602-4f0c-a909-7c184ddfe11" ],
  "createdAt" : "2024-06-12T09:55:22",
  "createdBy" : "eli",
  "description" : "Some description for the rule",
  "engine" : "rego",
  "evaluationScript" : " package pan.k8s_policy default allow = false allow { not has_wildcard_resources(input.resource) not has_wildcard_verbs(input.resource) } has_wildcard_resources(role) { some i role.resources[i] == \"*\" } has_wildcard_verbs(role) { some i role.verbs[i] == \"*\" } ",
  "extraData" : {
    "compliance" : [ {
      "control" : "5.4.1",
      "name" : "CIS AKS",
      "version" : "1.5"
    } ],
    "finding" : {
      "category" : "IDENTITY",
      "description" : "Cool k8s finding",
      "name" : "Kubernetes role with excessive rights found",
      "typeId" : 80
    },
    "scannableAssets" : [ {
      "group" : "rbac.authorization.k8s.io",
      "resource" : "role",
      "version" : "v1"
    }, {
      "group" : "rbac.authorization.k8s.io",
      "resourfce" : "clusterroles",
      "version" : "v1"
    } ],
    "supportedActions" : [ "Issue" ]
  },
  "isSystemRule" : true,
  "modifiedAt" : "2024-11-23T19:35:48",
  "modifiedBy" : "gil",
  "name" : "Minimize wildcard use in Roles and ClusterRoles",
  "platforms" : [ "Linux" ],
  "providers" : [ "AWS", "GCP" ],
  "remediation" : "Enable ssl mode",
  "revision" : 1,
  "ruleId" : "2808bbd9-51a4-47cc-a2fa-60d54903fe9c",
  "severity" : "LOW",
  "source" : [ "K8sApi" ],
  "specVer" : "1",
  "type" : "COMPLIANCE"
}'
    


      

import http.client

conn = http.client.HTTPSConnection("api-yourfqdn")

conn.request("POST", "/api/v1/rules/update")

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-yourfqdn/api/v1/rules/update")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

const data = null;

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-yourfqdn/api/v1/rules/update");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-yourfqdn/api/v1/rules/update")
  .asString();

import Foundation

let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/api/v1/rules/update")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-yourfqdn/api/v1/rules/update",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/api/v1/rules/update");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-yourfqdn/api/v1/rules/update");
var request = new RestRequest(Method.POST);
IRestResponse response = client.Execute(request);

Body parameters

array[RuleDef]

required

application/json; charset=UTF-8

[

availableActionsarray[string]

A list of the available actions

changeLogstring

controlsIDsarray[string]

createdAtstringdate-time

createdBystring

descriptionstring

enginestring (Enum)

Example:"rego"

Allowed values:"rego""bash""embedded""python"

evaluationScriptstring

extraDataobject

isSystemRuleboolean

modifiedAtstringdate-time

modifiedBystring

namestring

platformsarray[string]

providersarray[string]

remediationstring

revisioninteger

ruleIdstring

ruleStandardsarray

Lists rule standards

[

]

ruleUAIAssetsarray

Lists UAI assets relevant to the rule

[

]

severitystring (Enum)

Supported rule severities

Example:"CRITICAL"

Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"

sourcearray[string]

specVerstring

typestring

]

REQUEST
[application/json; charset=UTF-8 content]

Responses

Success

Client error

Body

application/json; charset=UTF-8

errorstring

RESPONSE
[application/json; charset=UTF-8 content]

Forbidden error

Body

application/json; charset=UTF-8

Indicates a forbidden access response

errorstring

RESPONSE
[application/json; charset=UTF-8 content]

Service encountered an unexpected internal error