Required License: **Cortex Xpanse Expander**
Get all or a subset of attack surface rules.
curl -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" -H "x-xdr-auth-id: xXdrAuthId_example" -H "authorization: authorization_example" \
"https://api-yourfqdn/public_api/v1/get_attack_surface_rules" \
-d '{
"request_data" : {
"search_from" : 0,
"filters" : [ {
"field" : "field",
"value" : [ "value", "value" ],
"operator" : "in"
}, {
"field" : "field",
"value" : [ "value", "value" ],
"operator" : "in"
} ],
"sort" : {
"field" : "field",
"keyword" : "keyword"
},
"search_to" : 6
}
}'
xXdrAuthId_example
authorization_example
{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"sort":{"field":"string","keyword":"string"},"search_from":0,"search_to":0}}
(Required) A dictionary containing the API request fields.
An empty dictionary returns all results.
Provides an array of filtered fields. Each JSON object can contain the following keywords:
- field
- operators
- value
Identifies the alert field the filter is matching. Filters are based on the following keywords:
- enabled_status
- category
- priority
- attack_surface_rule_id
- asm_alert_categories
String that identifies the comparison operator you want to use for this filter.
- in
One of the following values:
- attack_surface_rule_name
- category
- attack_surface_rule_id
- created
- modified
- modified_by
- priority
- enabled_status
An integer representing the end offset within the result set after which you do not want attack surface rules returned.
Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list.
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
String that identifies the incident field the filter is matching. Filters are based on the following keywords:
- modification_time: Time the incident has been modified.
- creation_time: Incident's creation time.
- incident_id_list: List of incident IDs.
- description: Incident description.
- alert_sources: Source which detected the alert.
- status: Represents the status of the incident.
- starred: Represents if the incident has been starred or not.
String that identifies the comparison operator you want to use for this filter. Valid keywords and values are: in
- incident_id_list, alert_sources, description — Array of strings contains
- description — String gte / lte
- modification_time, creation_time — Integer in timestamp epoch milliseconds eq / neq
- status
Value that this filter must match. The contents of this field will differ depending on the incident field that you specified for this filter:
- modification_time, creation_time - Integer representing the number of milliseconds after the Unix epoch, UTC timezone.
- incident_id_list - Array of strings. Each item in the list must be an incident ID.
- description - Array of strings.
- alert_sources - Array of strings.
- status - Single value, can be one of the following: new, under_investigation, resolved_true_positive, resolved_known_issue,resolved_duplicate_incident, resolved_false_positive, resolved_auto_resolve
- starred - Boolean value: true or false.
Internal server error. A unified status for API communication type errors. For example, test@test.com is not a valid email address.