Update informative BTP issues settings

post /public_api/v1/configurations/agent/informative_btp_issues/set

Updates the configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions. When enabled, new BTP alerts include unique, descriptive names and descriptions for immediate clarity. Existing alerts are not retroactively updated.

Important: Update any existing filters, starring policies, exclusion policies, scoring rules, log forwarding queries, or XSOAR/third-party SIEM automation rules to support the changes before enabling this setting.

Authentication: api-key-header-x-xdr-auth-id Api Key "x-xdr-auth-id"

Authentication: api-key-header-authorization Api Key "Authorization"

CLIENT REQUEST

          curl -X 'POST'

         -H "x-xdr-auth-id: [[apiKey]]"
        
         \
      
         -H "Authorization: [[apiKey]]"
        
         \
      
        -H
        'Accept: application/json'
      
        -H
        'Content-Type: application/json'
      
      'https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set'
    
      -d
      '{
  "request_data" : {
    "display_unique_and_informative_btp_rules" : true
  }
}'

import http.client

conn = http.client.HTTPSConnection("api-yourfqdn")

payload = "{\"request_data\":{\"display_unique_and_informative_btp_rules\":true}}"

headers = {
    'x-xdr-auth-id': "REPLACE_KEY_VALUE",
    'content-type': "application/json"
    }

conn.request("POST", "/public_api/v1/configurations/agent/informative_btp_issues/set", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)
request["x-xdr-auth-id"] = 'REPLACE_KEY_VALUE'
request["content-type"] = 'application/json'
request.body = "{\"request_data\":{\"display_unique_and_informative_btp_rules\":true}}"

response = http.request(request)
puts response.read_body

const data = JSON.stringify({
  "request_data": {
    "display_unique_and_informative_btp_rules": true
  }
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set");
xhr.setRequestHeader("x-xdr-auth-id", "REPLACE_KEY_VALUE");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set")
  .header("x-xdr-auth-id", "REPLACE_KEY_VALUE")
  .header("content-type", "application/json")
  .body("{\"request_data\":{\"display_unique_and_informative_btp_rules\":true}}")
  .asString();

import Foundation

let headers = [
  "x-xdr-auth-id": "REPLACE_KEY_VALUE",
  "content-type": "application/json"
]
let parameters = ["request_data": ["display_unique_and_informative_btp_rules": true]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"request_data\":{\"display_unique_and_informative_btp_rules\":true}}",
  CURLOPT_HTTPHEADER => [
    "content-type: application/json",
    "x-xdr-auth-id: REPLACE_KEY_VALUE"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "x-xdr-auth-id: REPLACE_KEY_VALUE");
headers = curl_slist_append(headers, "content-type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"request_data\":{\"display_unique_and_informative_btp_rules\":true}}");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-yourfqdn/public_api/v1/configurations/agent/informative_btp_issues/set");
var request = new RestRequest(Method.POST);
request.AddHeader("x-xdr-auth-id", "REPLACE_KEY_VALUE");
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"request_data\":{\"display_unique_and_informative_btp_rules\":true}}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

Body parameters

required

application/json

Request payload for updating informative BTP issues display configuration.

request_dataobject

display_unique_and_informative_btp_rulesbooleanrequired

Set to true to display unique and informative Behavioral Threat Protection (BTP) rules in the console.

Example:true

REQUEST
{
  "request_data": {
    "display_unique_and_informative_btp_rules": true
  }
}

Responses

Successful response indicating the configuration was updated.

Body

application/json

Standard success response for configuration update operations.

replyboolean

Indicates whether the operation completed successfully.

Example:true

RESPONSE
{
  "reply": true
}

Bad request. The request was malformed or contained invalid parameters.

Body

application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSEbadrequest
{
  "reply": {
    "err_code": 400,
    "err_msg": "Bad request. Got an invalid JSON.",
    "err_extra": "Additional error context"
  }
}

Unauthorized. Authentication credentials are missing or invalid.

Body

application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSEunauthorized
{
  "reply": {
    "err_code": 401,
    "err_msg": "Public API request unauthorized",
    "err_extra": "Additional error context"
  }
}

Forbidden. The API key does not have the required permissions.

Body

application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSEforbidden
{
  "reply": {
    "err_code": 403,
    "err_msg": "Forbidden. Access was denied to this resource.",
    "err_extra": "Insufficient permissions for api key"
  }
}

Internal server error.

Body

application/json

Standard error response returned when a request fails.

replyobject

Error details container.

err_codeinteger

Numeric error code identifying the type of error.

err_msgstring

Human-readable error message describing what went wrong.

err_extrastring

Additional context about the error, if available.

RESPONSEInternalServerError
{
  "reply": {
    "err_code": 500,
    "err_msg": "Internal server error",
    "err_extra": "Additional error context"
  }
}