Symantec Endpoint Security

The Swimlane Symantec Endpoint Security connector integrates Symantec Endpoint Security with Swimlane to command devices.

Prerequisites

To obtain your client_id and client_secret, required by the asset, log in to the Symantec Securitycloud website. Then, under the Integration tab in the main menu, click Client Applications.

Capabilities

This connector provides the following capabilities:

Add BlackList

Apply Policy

Delete BlackList

Get Devices Information

Get File Finger Print List By Name

Get File Finger Print List

Get Policies

Get Policy by ID

Get Policy Versions

Get Policy Target Rules

Get Device Group Policies

Update BlackList

Make a Custom Scan

Make a Full Scan

Make a Quick Scan ... and so on

Action Setup

Some actions need one or more Device ID to run. The action Get Devices helps to get additional information about your devices. For example, you can use the name input to get information about that specific device.

Relative time format

The following actions accept relative time formats for Start Date and End Date inputs:

Get Incidents

Get Incidents Events

You can use any standard datetime format supported by Pendulum, or a relative datetime.

For the current time:

now

Any other time:

(+/-)(integer) (milliseconds|seconds|minutes|days|weeks|months|years)

For example:

now
-1 months
+3 days
-123 seconds

Queries

The following actions use queries to filter output data:

Get Incidents

Get Commands

You can use the query input to filter out the results. When creating a search query string, consider the following:

You can search supported fields by specifying the field name followed by a colon ":" and then the term you are looking for.

You can also escape special characters that are part of the query syntax. To escape a special character use \ before the character. Here is the current list of special characters: + - && || ! ( ) { } [ ] ^ " ~ * ? \

The date value should follow the ISO 8601 date stamp standard format: (yyyy-MM-dd’T’HH:mm:ss.SSSZ)

Supported Boolean operators for complex query are: AND OR + - NOT Note: Boolean operators must be ALL CAPS.

Multiple terms can be combined together with Boolean operators to form a more complex query in the query clause.

Use parentheses to group clauses to form sub-queries.

Defaults to all incidents updated between the start_time and end_time specified in the query.

The maximum length of the query string is 1024 characters.

Supported fields for query include: state_id, incident_uid, created, modified, reference_incident_uid, priority_id, severity_id, remediation, suspected_breach, detection_type, conclusion,resolution_id

Notes

Symantec Securitycloud website

Symantec Endpoint Security API documentation

Product version tested against: v1

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
custom_client_id	Client ID	string	Required
custom_client_secret	Client Secret	string	Required
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add BlackList

Adds a blacklist as a file fingerprint list to Symantec Endpoint Protection Manager. A system administrator account is required for this action.

Endpoint

URL: api/v1/policy-objects/fingerprints

Method: POST

Input

Argument Name	Type	Required	Description
name	string	Optional	Name of the resource
domainId	string	Optional	Unique identifier
hashType	string	Optional	Type of the resource
description	string	Optional	Parameter for Add BlackList
data	array	Optional	Response data

Input Example

{"name":"Example Name","domainId":"string","hashType":"string","description":"string","data":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Apply Policy

This API lets you apply a policy to device groups.

Endpoint

URL: /v1/policies/{{policy_uid}}/versions/{{version}}/device-groups

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.policy_uid	string	Required	Parameters for the Apply Policy action
path_parameters.version	string	Required	Parameters for the Apply Policy action
target_rules	array	Optional	Parameter for Apply Policy
override	boolean	Optional	Unique identifier
device_group_ids	array	Optional	Unique identifier

Input Example

{"json_body":{"target_rules":["quarantine"],"override":true,"device_group_ids":["Wa1jpJDFRMSFBVoHSbuK7g"]},"path_parameters":{"policy_uid":"string","version":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{},"reason":"OK","json_body":{}}

Cancel Command

This API lets you cancel the endpoint search command.

Endpoint

URL: v1/commands/endpoint-search/{{command_id}}/cancel

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.command_id	string	Required	Parameters for the Cancel Command action

Input Example

{"path_parameters":{"command_id":"EDRC-722EB5FA-9CE7-4770-9948-A18F92F62FAD"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message

Output Example

{"status_code":404,"response_headers":{"Date":"Thu, 22 Dec 2022 19:23:52 GMT","Content-Type":"application/json","Content-Length":"99","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"23","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"message":"Search history object not found for command:EDRC-722EB5FA-9CE7-4770-9948-A18F92F..."}}

Custom Scan

Runs a custom scan

Endpoint

URL: v1/commands/scans/custom

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
org_unit_ids	array	Optional	Unique identifier
is_recursive	boolean	Optional	Parameter for Custom Scan

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Delete BlackList

Deletes an existing blacklist, and removes it from a group to which it applies. A system administrator account is required for this action.

Endpoint

URL: api/v1/policy-objects/fingerprints/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Delete BlackList action

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Delete Command

This API lets you delete the endpoint search command.

Endpoint

URL: v1/commands/endpoint-search/{{command_id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.command_id	string	Required	Parameters for the Delete Command action

Input Example

{"path_parameters":{"command_id":"EDRC-722EB5FA-9CE7-4770-9948-A18F92F62FAD"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 19:26:36 GMT","Content-Length":"0","Connection":"keep-alive","Server":"envoy","cache-control":"no-cache, no-store, max-age=0, must-revalidate","pragma":"no-cache","expires":"0","x-xss-protection":"1; mode=block","x-frame-options":"DENY","x-content-type-options":"nosniff","x-envoy-upstream-service-time":"12","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","response_text":""}

Full Dump Command

This API lets you send the full dump command on the device.

Endpoint

URL: v1/commands/endpoint-search/fulldump

Method: POST

Input

Argument Name	Type	Required	Description
device_id	string	Optional	Unique identifier
description	string	Optional	Parameter for Full Dump Command

Input Example

{"json_body":{"device_id":"4u_t38vBRrCg8LH2SoxHwg","description":"test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.command_type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 23 Dec 2022 15:26:43 GMT","Content-Type":"application/json","Content-Length":"206","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"1052","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Full Scan

Runs a full scan

Endpoint

URL: v1/commands/scans/full

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
org_unit_ids	array	Optional	Unique identifier
is_recursive	boolean	Optional	Parameter for Full Scan

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Get Command by ID

This API lets you get the details of endpoint search command.

Endpoint

URL: v1/commands/endpoint-search/{{command_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.command_id	string	Required	Parameters for the Get Command by ID action

Input Example

{"path_parameters":{"command_id":"EDRC-6648F9AF-DB51-4D86-8FF4-4C66C901A879"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
command_id	string	Unique identifier
user_name	string	Name of the resource
create_time	string	Time value
command_status	string	Status value
command_type	string	Type of the resource
total_endpoints	number	Output field: total_endpoints
completed_endpoints	number	Output field: completed_endpoints
endpoint_status_count	object	Status value
endpoint_status_count.FOUND	number	Status value

Output Example

{"status_code":404,"response_headers":{"Date":"Fri, 23 Dec 2022 15:14:44 GMT","Content-Type":"application/json","Content-Length":"99","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"19","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"name":"Public API - Full Dump","command_id":"EDRC-6648F9AF-DB51-4D86-8FF4-4C66C901A879","user_name":"edrCust-gcp-dev861871","create_time":"2021-12-28T10:15:16.507Z","co...

Get Commands

This API lets you get the list of endpoint search commands.

Endpoint

URL: v1/commands/endpoint-search

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	Parameter for Get Commands

Input Example

{"json_body":{"query":"command_status: ERROR"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
commands	array	Output field: commands
commands.file_name	string	Name of the resource
commands.file	string	Output field: commands.file
total	number	Output field: total

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 18:56:21 GMT","Content-Type":"application/json","Content-Length":"25","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"18","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"commands":[],"total":0}}

Get Device Group Policies

This API lets you retrieve a list of policies that are targeted on a device group.

Endpoint

URL: /v1/device-groups/{{group_id}}/policies

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.group_id	string	Required	Parameters for the Get Device Group Policies action

Input Example

{"path_parameters":{"group_id":"U6gNvuC3QYurlf4ilNxlDg"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
policies	array	Output field: policies
policies.name	string	Name of the resource
policies.policy_type	string	Type of the resource
policies.policy_uid	string	Unique identifier
policies.policy_version	number	Output field: policies.policy_version
policies.target_apply_level	string	Output field: policies.target_apply_level
policies.target_rules	array	Output field: policies.target_rules
policies.target_rules.version	number	Output field: policies.target_rules.version
policies.target_rules.enabled	boolean	Output field: policies.target_rules.enabled
policies.target_rules.sort_order	number	Output field: policies.target_rules.sort_order
policies.targeted_date	string	Date value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":10,"policies":[{"name":"Default Intrusion Prevention Policy","policy_type":"Network IPS","policy_uid":"9a2d5a12-4a4a-49d1-a55c-67012cdbd221","policy_version":1,"target_apply_level":"direct","target_rules":[{"version":1,"enabled":false,"sort_order":999999}],"targeted_date":"2021-05-20T00:00:00.000Z"},{"name":"Default Device Control Policy","policy_type":"Device Control","policy_uid":"d30aed4a-dff0-4270-8107-3297d15fe03c",...

Get Devices

Retrieve the list of devices

Endpoint

URL: v1/devices

Method: GET

Input

Argument Name	Type	Required	Description
parameters.client_version	array	Optional	Parameters for the Get Devices action
parameters.device_status	array	Optional	Parameters for the Get Devices action
parameters.device_type	string	Optional	Parameters for the Get Devices action
parameters.edr_enabled	boolean	Optional	Parameters for the Get Devices action
parameters.is_cloud	boolean	Optional	Parameters for the Get Devices action
parameters.is_online	boolean	Optional	Parameters for the Get Devices action
parameters.is_virtual	boolean	Optional	Parameters for the Get Devices action
parameters.name	array	Optional	Parameters for the Get Devices action
parameters.os	array	Optional	Parameters for the Get Devices action

Input Example

{"parameters":{"client_version":["14.3.202.3000","14.3.4615.2000"],"device_status":["AT_RISK","COMPROMISED","NOT_COMPUTED"],"device_type":"WORKSTATION","edr_enabled":false,"is_cloud":false,"is_online":true,"is_virtual":true,"name":["DESKTOP-LQJ2OUU","swim-mitm"],"os":["windows","Linux","iOS","Mac"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
devices	array	Output field: devices
devices.id	string	Unique identifier
devices.name	string	Name of the resource
devices.host	string	Output field: devices.host
devices.domain	string	Output field: devices.domain
devices.created	string	Output field: devices.created
devices.modified	string	Output field: devices.modified
devices.os	object	Output field: devices.os
devices.os.ver	string	Output field: devices.os.ver
devices.os.name	string	Name of the resource
devices.os.type	string	Type of the resource
devices.os.64_bit	boolean	Output field: devices.os.64_bit
devices.os.lang	string	Output field: devices.os.lang
devices.os.major_ver	number	Output field: devices.os.major_ver
devices.os.minor_ver	number	Output field: devices.os.minor_ver
devices.os.sp	number	Output field: devices.os.sp
devices.os.tz_offset	number	Output field: devices.os.tz_offset
devices.os.user	string	Output field: devices.os.user
devices.os.user_domain	string	Output field: devices.os.user_domain
devices.os.vol_avail_mb	number	Output field: devices.os.vol_avail_mb
devices.os.vol_cap_mb	number	Output field: devices.os.vol_cap_mb
devices.hw	object	Output field: devices.hw

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 16:16:58 GMT","Content-Type":"application/json","Content-Length":"4427","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"38","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"total":4,"devices":[{"id":"4u_t38vBRrCg8LH2SoxHwg","name":"DESKTOP-QSI525C","host":"DESKTOP-QSI525C","domain":"","created":"2022-12-12T18:47:18.450Z","modified":"2022-12-22T...

Get File Finger Print List

Gets the file fingerprint list for a specified ID as a set of hash values. A system administrator account is required for this action.

Endpoint

URL: api/v1/policy-objects/fingerprints/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get File Finger Print List action

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
hashType	string	Type of the resource
source	string	Output field: source
description	string	Output field: description
data	array	Response data
groupIds	array	Unique identifier

Output Example

{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","hashType":"string","source":"string","description":"string","data":["string"],"groupIds":["string"]}

Get File Finger Print List By Name

Gets the file fingerprint list for a specified Name as a set of hash values. A system administrator account is required for this action.

Endpoint

URL: api/v1/policy-objects/fingerprints

Method: GET

Input

Argument Name	Type	Required	Description
parameters.name	string	Required	Parameters for the Get File Finger Print List By Name action
parameters.domainId	string	Optional	Parameters for the Get File Finger Print List By Name action

Input Example

{"parameters":{"name":"Example Name","domainId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
hashType	string	Type of the resource
source	string	Output field: source
description	string	Output field: description
data	array	Response data
groupIds	array	Unique identifier

Output Example

{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","hashType":"string","source":"string","description":"string","data":["string"],"groupIds":["string"]}

Get Incident Associate Events

This task lets you retrieve incident associate events based on time range filter.

Endpoint

URL: v1/incidents/events

Method: POST

Input

Argument Name	Type	Required	Description
incident_associate	boolean	Optional	Unique identifier
limit	number	Optional	Parameter for Get Incident Associate Events

Input Example

{"json_body":{"incident_associate":true,"limit":100}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
events	array	Output field: events
events.file_name	string	Name of the resource
events.file	string	Output field: events.file

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 26 Dec 2022 17:27:08 GMT","Content-Type":"application/json","Content-Length":"23","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"128","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"total":0,"events":[]}}

Get Incident By ID

This Task lets you retrieve details for a specific incident.

Endpoint

URL: v1/incidents/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Incident By ID action

Input Example

{"path_parameters":{"id":"700559b9-c260-4c76-b441-f5fc5bd08e6d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message

Output Example

{"status_code":404,"response_headers":{"Date":"Fri, 23 Dec 2022 19:38:01 GMT","Content-Type":"application/json","Content-Length":"95","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"111","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"message":"Incident summary is missing for incident Id: 700559b9-c260-4c76-b441-f5fc5bd08e6..."}}

Get Incidents

This API lets you retrieve incidents and incident events. You can specify a search criteria to filter results.

Endpoint

URL: v1/incidents

Method: POST

Input

Argument Name	Type	Required	Description
start_date	string	Optional	Date value
end_date	string	Optional	Date value
next	number	Optional	Parameter for Get Incidents
limit	number	Optional	Parameter for Get Incidents
include_events	boolean	Optional	Parameter for Get Incidents
query	string	Optional	Parameter for Get Incidents

Input Example

{"json_body":{"start_date":"2022-11-25T22:46:09.230+0000","end_date":"2023-05-21T22:46:09.230+0000","next":0,"limit":10,"include_events":true,"query":"state_id: [0 TO 5] AND remediation:*Memory*"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
incidents	array	Unique identifier
incidents.customer_uid	string	Unique identifier
incidents.incident_uid	string	Unique identifier
incidents.type	string	Unique identifier
incidents.conclusion	string	Unique identifier
incidents.remediation	string	Unique identifier
incidents.priority_id	number	Unique identifier
incidents.category_id	number	Unique identifier
incidents.modified	string	Unique identifier
incidents.state_id	number	Unique identifier
incidents.id	number	Unique identifier
incidents.product_uid	string	Unique identifier
incidents.events	array	Unique identifier
incidents.events.activity_id	number	Unique identifier
incidents.events.actor	object	Unique identifier
incidents.events.actor.cmd_line	string	Unique identifier
incidents.events.actor.file	object	Unique identifier
incidents.events.actor.file.company_name	string	Unique identifier
incidents.events.actor.file.created	number	Unique identifier
incidents.events.actor.file.folder	string	Unique identifier
incidents.events.actor.file.md5	string	Unique identifier
incidents.events.actor.file.name	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 19:07:21 GMT","Content-Type":"application/json","Content-Length":"26","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"186","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"total":1,"incidents":[{}]}}

Get Lineage Events by Incident ID

This Task lets you retrieve process lineage events for a specific incident.

Endpoint

URL: v1/incidents/{{incident_id}}/lineage

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.incident_id	string	Required	Parameters for the Get Lineage Events by Incident ID action

Input Example

{"path_parameters":{"incident_id":"700559b9-c260-4c76-b441-f5fc5bd08e6d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message

Output Example

{"status_code":404,"response_headers":{"Date":"Mon, 26 Dec 2022 17:36:20 GMT","Content-Type":"application/json","Content-Length":"89","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"29","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"message":"There is no event uid for incident Id: 700559b9-c260-4c76-b441-f5fc5bd08e6d"}}

Get Policies

This API lets you retrieve a list of your policies.

Endpoint

URL: /v1/policies

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Get Policies action
parameters.offset	number	Optional	Parameters for the Get Policies action
parameters.name	string	Optional	Parameters for the Get Policies action
parameters.type	string	Optional	Parameters for the Get Policies action

Input Example

{"parameters":{"limit":100,"offset":1,"name":"test","type":"test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
policies	array	Output field: policies
policies.name	string	Name of the resource
policies.author	string	Output field: policies.author
policies.policy_uid	string	Unique identifier
policies.policy_version	number	Output field: policies.policy_version
policies.policy_type	string	Type of the resource
policies.is_imported	boolean	Output field: policies.is_imported
policies.created	string	Output field: policies.created
policies.modified	string	Output field: policies.modified

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":22,"policies":[{"name":"Default Adaptive Protection Policy","author":"System","policy_uid":"fb52866d-18d8-46af-9c3b-c071afc5041e","policy_version":1,"policy_type":"Behavioral Analysis","is_imported":false,"created":"2021-05-16T08:36:34.000Z","modified":"2021-05-16T08:36:34.000Z"},{"name":"Default Allow List Policy","author":"System","policy_uid":"d6c51743-6aa2-4c46-b95d-72da1d31e686","policy_version":1,"policy_type":"Exc...

Get Policy by ID

This API lets you retrieve the details for a policy by using its uid and version.

Endpoint

URL: /v1/policies/{{policy_uid}}/versions/{{version}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.policy_uid	string	Required	Parameters for the Get Policy by ID action
path_parameters.version	string	Required	Parameters for the Get Policy by ID action
headers	object	Optional	HTTP headers for the request
headers.Accept	string	Optional	HTTP headers for the request

Input Example

{"path_parameters":{"policy_uid":"915ab1a5-3e50-41c7-b054-244ceb5cbccf","version":"1"},"headers":{"Accept":"application/zip"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attributes	object	Output field: attributes
attributes.id	string	Unique identifier
attributes.version	number	Output field: attributes.version
attributes.schemaversion	number	Output field: attributes.schemaversion
attributes.type	number	Type of the resource
features	array	Output field: features
features.configuration	object	Output field: features.configuration
features.configuration.suspicious_behavior_enhancements	string	Output field: features.configuration.suspicious_behavior_enhancements
features.configuration.suspicious_behavior_enhancement_rules	array	Output field: features.configuration.suspicious_behavior_enhancement_rules
features.configuration.suspicious_behavior_enhancement_rules.name	string	Name of the resource
features.configuration.suspicious_behavior_enhancement_rules.desc	string	Output field: features.configuration.suspicious_behavior_enhancement_rules.desc
features.configuration.suspicious_behavior_enhancement_rules.action	string	Output field: features.configuration.suspicious_behavior_enhancement_rules.action
features.properties	object	Output field: features.properties
features.properties.id	string	Unique identifier
features.properties.name	string	Name of the resource
features.properties.policy	string	Output field: features.properties.policy
features.properties.policy_name	string	Name of the resource
features.properties.version	number	Output field: features.properties.version
features.properties.policy_subtype	string	Type of the resource
locations	array	Output field: locations
locations.file_name	string	Name of the resource
locations.file	string	Output field: locations.file

Output Example

{"attributes":{"id":"12345678-1234-1234-1234-123456789abc","version":123,"schemaversion":123,"type":123},"features":[{"configuration":{},"properties":{}}],"locations":[{"file_name":"Example Name","file":"string"}]}

Get Policy Target Rules

This API lets you retrieve a list of target rules.

Endpoint

URL: /v1/policies/target-rules

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Get Policy Target Rules action
parameters.offset	number	Optional	Parameters for the Get Policy Target Rules action

Input Example

{"parameters":{"limit":100,"offset":10}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
target_rules	array	Output field: target_rules
target_rules.name	string	Name of the resource
target_rules.enabled	boolean	Output field: target_rules.enabled
target_rules.description	string	Output field: target_rules.description
target_rules.author	string	Output field: target_rules.author
target_rules.sort_order	number	Output field: target_rules.sort_order
target_rules.created	string	Output field: target_rules.created
target_rules.modified	string	Output field: target_rules.modified

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":2,"target_rules":[{},{}]}}

Get Policy Versions

This API lets you retrieve the versions of a policy.

Endpoint

URL: /v1/policies/{{policy_uid}}/versions

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.policy_uid	string	Required	Parameters for the Get Policy Versions action

Input Example

{"path_parameters":{"policy_uid":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
policy_versions	array	Output field: policy_versions
policy_versions.policy_version	number	Output field: policy_versions.policy_version
policy_versions.device_group_count	number	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":1,"policy_versions":[{}]}}

Patch Deny List Policy

This API lets you perform partial update of Deny list policy.

Endpoint

URL: /v1/policies/deny-list/{{policy_uid}}/versions/{{version}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.policy_uid	string	Required	Parameters for the Patch Deny List Policy action
path_parameters.version	string	Required	Parameters for the Patch Deny List Policy action
add	object	Optional	Parameter for Patch Deny List Policy
add.blacklistrules	array	Optional	Parameter for Patch Deny List Policy
add.blacklistrules.processfile	object	Optional	Parameter for Patch Deny List Policy
add.blacklistrules.processfile.md5	string	Optional	Parameter for Patch Deny List Policy
add.blacklistrules.processfile.name	string	Optional	Name of the resource
add.nonperules	array	Optional	Parameter for Patch Deny List Policy
remove	object	Optional	Parameter for Patch Deny List Policy
remove.blacklistrules	array	Optional	Parameter for Patch Deny List Policy
remove.blacklistrules.processfile	object	Optional	Parameter for Patch Deny List Policy
remove.blacklistrules.processfile.md5	string	Optional	Parameter for Patch Deny List Policy
remove.nonperules	array	Optional	Parameter for Patch Deny List Policy

Input Example

{"json_body":{"add":{"blacklistrules":[{"processfile":{"sha2":"cc58a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd","name":"My Sha256"}},{"processfile":{"sha2":"1287a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd"}},{"processfile":{"md5":"B8EEA75B4224D8079BB86312528EF095","name":"My Md5 "}},{"processfile":{"md5":"EF22AF4E07F0457FDD0CDAF68F712DF7","name":"EF22AF4E07F0457FDD0CDAF68F712DF7"}}],"nonperules":[{"file":{"name":"--","sha2":"CC58A84BAD103041396AF249A16A1D16CBF698868D5388D8951F14D1403559BD","size":900},"actor":{}},{"file":{"name":"Non-Ex md5 - with app access file","md5":"787EAF4E07F0457FDD0CDAF68F712DF7"},"actor":{"directory":"c:\\testloc\\test124\\ttemdj.exe"}},{"file":{"name":"Non-Ex md5 - with app access fingerprint","md5":"123EAF4E07F0457FDD0CDAF68F712DAB"},"actor":{"md5":"A23BAF4E07F0457FDD0CDAF68F712DCD"}},{"file":{"name":"Non-Ex md5 - with file path","md5":"2F305D3E26033D128F3741A18150CF2E","directory":"c:/testmylocation/testloc2/thisfile.doc"},"actor":{}},{"file":{"name":"Non-Ex md5 - with file size","md5":"E27F35B2D30423CD3A281375585E22F9","size":500},"actor":{}},{"file":{"name":"Non-Ex sha256 - with app access file","sha2":"4AFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"},"actor":{"directory":"c:/gest/myfle.exe"}},{"file":{"name":"Non-Ex sha256 - with app access fingerprint","sha2":"3FFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496F123"},"actor":{"sha2":"123ABF6A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"}},{"file":{"name":"Non-Ex sha256 - with file path","sha2":"7AFCC2C38AC334047F0CC957708E5B32CFCB15F72F4C22C9EC53FF48339922B9","directory":"c:\\testloc\\myfile.txt"},"actor":{}},{"file":{"name":"Non-Ex sha256 - with file size","sha2":"BF9C02EA1745BE0A3227FD0841EA53ED6D361006F13DD62677AEB4EED00E0BC5","size":200},"actor":{}}]},"remove":{"blacklistrules":[{"processfile":{"sha2":"6666a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd"}},{"processfile":{"md5":"EF22AF4E07F0457FDD0CDAF68F712DF7"}}],"nonperules":[{"file":{"sha2":"9998A84BAD103041396AF249A16A1D16CBF698868D5388D8951F14D1403559BD","size":900}},{"file":{"md5":"555EAF4E07F0457FDD0CDAF68F712DF7"},"actor":{"directory":"c:\\testloc\\test124\\ttemdj.exe"}},{"file":{"md5":"1333AF4E07F0457FDD0CDAF68F712DAB"},"actor":{"md5":"A23BAF4E07F0457FDD0CDAF68F712DCD"}},{"file":{"md5":"20878D3E26033D128F3741A18150CF2E","directory":"c:/testmylocation/testloc2/thisfile.doc"}}]}},"path_parameters":{"policy_uid":"string","version":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
author	string	Output field: author
policy_uid	string	Unique identifier
policy_version	number	Output field: policy_version
policy_type	string	Type of the resource
is_imported	boolean	Output field: is_imported
locked	boolean	Output field: locked
created	string	Output field: created
modified	string	Output field: modified

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"Deny List Policy - update name","author":"Client Application\\My Client11","policy_uid":"ebe8835f-a84d-4538-85f6-5f3ed450a2d2","policy_version":3,"policy_type":"Deny List","is_imported":false,"locked":true,"created":"2022-08-29T11:14:45.000Z","modified":"2022-08-30T09:54:51.000Z"}}

Process Dump Command

This Task lets you send the process dump command on the device.

Endpoint

URL: v1/commands/endpoint-search/processdump

Method: POST

Input

Argument Name	Type	Required	Description
device_id	string	Optional	Unique identifier
hash	string	Optional	Parameter for Process Dump Command
description	string	Optional	Parameter for Process Dump Command

Input Example

{"json_body":{"device_id":"4u_t38vBRrCg8LH2SoxHwg","hash":"c4e078607db2784be7761c86048dffa6f3ef04b551354a32fcdec3b6a3450905","description":"test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.command_type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 23 Dec 2022 20:46:05 GMT","Content-Type":"application/json","Content-Length":"209","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"1059","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Quarantine Device

This API lets you quarantine devices managed by your Integrate Cyber Defense Manager.

Endpoint

URL: v1/commands/contain

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
org_unit_ids	array	Optional	Unique identifier
payload	object	Optional	Parameter for Quarantine Device
payload.quarantine_host_group_name	string	Optional	Name of the resource
is_recursive	boolean	Optional	Parameter for Quarantine Device

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"payload":{"quarantine_host_group_name":"test_group_name"},"is_recursive":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Quick Scan

Runs a quick scan

Endpoint

URL: v1/commands/scans/quick

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
org_unit_ids	array	Optional	Unique identifier
is_recursive	boolean	Optional	Parameter for Quick Scan

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Restart Device

This API lets you reboot devices that are managed by your Integrated Cyber Defense Manager Defense Manager.

Endpoint

URL: v1/commands/restart

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
payload	object	Optional	Parameter for Restart Device
payload.prompt_type	string	Optional	Type of the resource
payload.schedule_type	string	Optional	Type of the resource
payload.reason_type	string	Optional	Type of the resource
payload.message	string	Optional	Response message

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"payload":{"prompt_type":"prompt","schedule_type":"later","reason_type":"remediation","message":"This is a restart test"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Unquarantine Device

Unquarantine devices managed by your Integrated Cyber Defense Manager

Endpoint

URL: v1/commands/allow

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Update BlackList

Updates an existing blacklist. A system administrator account is required for this action.

Endpoint

URL: api/v1/policy-objects/fingerprints/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update BlackList action
name	string	Optional	Name of the resource
domainId	string	Optional	Unique identifier
hashType	string	Optional	Type of the resource
description	string	Optional	Parameter for Update BlackList
data	array	Optional	Response data

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"name":"Example Name","domainId":"string","hashType":"string","description":"string","data":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Update Content

This API lets you update security definitions and content of devices managed by your Integrated Cyber Defense Manager.

Endpoint

URL: v1/commands/update_content

Method: POST

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
org_unit_ids	array	Optional	Unique identifier
is_recursive	boolean	Optional	Parameter for Update Content

Input Example

{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	number	Status value
status_text	string	Status value
results	object	Result of the operation
results.data	array	Response data
results.data.command_state_ref	string	Response data
results.data.device_id	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}

Update Deny List Policy

This API lets you perform update of Deny list policy.

Endpoint

URL: /v1/policies/deny-list/{{policy_uid}}/versions/{{version}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.policy_uid	string	Required	Parameters for the Update Deny List Policy action
path_parameters.version	string	Required	Parameters for the Update Deny List Policy action
features	array	Optional	Parameter for Update Deny List Policy
features.configuration	object	Optional	Parameter for Update Deny List Policy
features.configuration.blacklistrules	array	Optional	Parameter for Update Deny List Policy
features.configuration.blacklistrules.processfile	object	Optional	Parameter for Update Deny List Policy
features.configuration.blacklistrules.processfile.md5	string	Optional	Parameter for Update Deny List Policy
features.configuration.blacklistrules.processfile.name	string	Optional	Name of the resource
features.configuration.nonperules	array	Optional	Parameter for Update Deny List Policy
features.properties	object	Optional	Parameter for Update Deny List Policy
features.properties.policy_name	string	Optional	Name of the resource
features.state	object	Optional	Parameter for Update Deny List Policy
features.state.locked	boolean	Optional	Parameter for Update Deny List Policy

Input Example

{"json_body":{"features":[{"configuration":{"blacklistrules":[{"processfile":{"sha2":"cc58a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd","name":"My Sha256"}},{"processfile":{"sha2":"1287a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd"}},{"processfile":{"md5":"B8EEA75B4224D8079BB86312528EF095","name":"My Md5 "}},{"processfile":{"md5":"EF22AF4E07F0457FDD0CDAF68F712DF7","name":"EF22AF4E07F0457FDD0CDAF68F712DF7"}}],"nonperules":[{"file":{"name":"--","sha2":"CC58A84BAD103041396AF249A16A1D16CBF698868D5388D8951F14D1403559BD","size":900},"actor":{}},{"file":{"name":"Non-Ex md5 - with app access file","md5":"787EAF4E07F0457FDD0CDAF68F712DF7"},"actor":{"directory":"c:\\testloc\\test124\\ttemdj.exe"}},{"file":{"name":"Non-Ex md5 - with app access fingerprint","md5":"123EAF4E07F0457FDD0CDAF68F712DAB"},"actor":{"md5":"A23BAF4E07F0457FDD0CDAF68F712DCD"}},{"file":{"name":"Non-Ex md5 - with file path","md5":"2F305D3E26033D128F3741A18150CF2E","directory":"c:/testmylocation/testloc2/thisfile.doc"},"actor":{}},{"file":{"name":"Non-Ex md5 - with file size","md5":"E27F35B2D30423CD3A281375585E22F9","size":500},"actor":{}},{"file":{"name":"Non-Ex sha256 - with app access file","sha2":"4AFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"},"actor":{"directory":"c:/gest/myfle.exe"}},{"file":{"name":"Non-Ex sha256 - with app access fingerprint","sha2":"3FFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496F123"},"actor":{"sha2":"123ABF6A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"}},{"file":{"name":"Non-Ex sha256 - with file path","sha2":"7AFCC2C38AC334047F0CC957708E5B32CFCB15F72F4C22C9EC53FF48339922B9","directory":"c:\\testloc\\myfile.txt"},"actor":{}},{"file":{"name":"Non-Ex sha256 - with file size","sha2":"BF9C02EA1745BE0A3227FD0841EA53ED6D361006F13DD62677AEB4EED00E0BC5","size":200},"actor":{}}]},"properties":{"policy_name":"Deny List Policy - update name"},"state":{"locked":false}}]},"path_parameters":{"policy_uid":"string","version":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
author	string	Output field: author
policy_uid	string	Unique identifier
policy_version	number	Output field: policy_version
policy_type	string	Type of the resource
is_imported	boolean	Output field: is_imported
locked	boolean	Output field: locked
created	string	Output field: created
modified	string	Output field: modified

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"Deny List - 30 Aug","author":"Client Application\\My Client11","policy_uid":"55dd0dbe-4ce9-4184-b601-4b6ec984bca2","policy_version":3,"policy_type":"Deny List","is_imported":false,"locked":true,"created":"2022-08-29T11:14:45.000Z","modified":"2022-08-30T09:54:51.000Z"}}

Update Policy

This API lets you update policy with new configurations.

Endpoint

URL: /v1/policies

Method: PUT

Input

Argument Name	Type	Required	Description
attributes	object	Optional	Parameter for Update Policy
attributes.id	string	Optional	Unique identifier
attributes.version	number	Optional	Parameter for Update Policy
attributes.schemaversion	number	Optional	Parameter for Update Policy
attributes.type	number	Optional	Type of the resource
features	array	Optional	Parameter for Update Policy
features.configuration	object	Optional	Parameter for Update Policy
features.configuration.rule_sets	array	Optional	Parameter for Update Policy
features.configuration.rule_sets.name	string	Optional	Name of the resource
features.configuration.rule_sets.description	string	Optional	Parameter for Update Policy
features.configuration.rule_sets.enabled	boolean	Optional	Parameter for Update Policy
features.configuration.rule_sets.mode	string	Optional	Parameter for Update Policy
features.configuration.rule_sets.version	number	Optional	Parameter for Update Policy
features.configuration.rule_sets.log_action	number	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules	array	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules.name	string	Optional	Name of the resource
features.configuration.rule_sets.control_rules.description	string	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules.enabled	boolean	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules.child_process	boolean	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules.processes	array	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules.exclude_processes	array	Optional	Parameter for Update Policy
features.configuration.rule_sets.control_rules.condition_list	array	Optional	Parameter for Update Policy
features.properties	object	Optional	Parameter for Update Policy
features.properties.id	string	Optional	Unique identifier
features.properties.name	string	Optional	Name of the resource

Input Example

{"json_body":{"attributes":{"id":"string","version":100,"schemaversion":100,"type":100},"features":[{"configuration":{"rule_sets":[{"name":"Block programs from running from removable drives [AC2]","description":"This rule will block any program from running from any removable media, including floppies, USB flash drives, CD/DVD drives and other drives, such as Zip and Jazz drives.","enabled":false,"mode":"PRODUCTION","version":0,"log_action":1,"control_rules":[{"name":"Block running applications from removable media","description":" ","enabled":true,"child_process":false,"processes":[{"file":{"enable_checksum":false,"enable_name":true,"name":"*","regex":false,"enable_drive_types":false,"enable_device_instance":false}}],"exclude_processes":[],"condition_list":[{"name":"Block programs from running from removable drives [AC2]","description":"This rule will block any program from running from any removable media, including floppies, USB flash drives, CD/DVD drives and other drives, such as Zip and Jazz drives.","enabled":1,"launch_process_condition":{"action":{"action":"BLOCK","severity":3,"log_action":1},"processes":[{"file":{"enable_checksum":false,"enable_name":true,"name":"*","regex":false,"enable_drive_types":true,"drive_types":["REMOVABLE","CD_DVD"],"enable_device_instance":false}},{"file":{"enable_checksum":false,"enable_name":true,"name":"*","regex":false,"enable_drive_types":false,"enable_device_instance":true,"device_instance_id":"USBSTOR*"}}],"exclude_processes":[]}}]}]}]},"properties":{"id":"{25DFB16F-A981-476C-8D1E-D6AB79FE97AC}","name":"APP_CONTROL_LITE","policy":"0f311289-bf45-4c97-b7eb-3db508827c87","policy_name":"Default Custom Application Behaviors Policy","version":1,"policy_subtype":"EG"},"state":{"locked":true}}],"locations":[],"type":"APP_CONTROL_LITE"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
author	string	Output field: author
policy_uid	string	Unique identifier
policy_version	number	Output field: policy_version
policy_type	string	Type of the resource
is_imported	boolean	Output field: is_imported
locked	boolean	Output field: locked
created	string	Output field: created
modified	string	Output field: modified

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"Broadcom policy name","author":"Client Application\\My Client11","policy_uid":"1d3fd28f-4d10-4089-8c01-b3604dfbc564","policy_version":1,"policy_type":"Custom Application Behavior","is_imported":false,"locked":true,"created":"2022-08-29T10:32:47.000Z","modified":"2022-08-30T09:49:54.000Z"}}

Response Headers

Header	Description	Example
Alt-Svc	HTTP response header: Alt-Svc	h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
Connection	HTTP response header: Connection	keep-alive
Content-Length	The length of the response body in bytes	25
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Fri, 23 Dec 2022 20:46:05 GMT
expires	The date/time after which the response is considered stale	0
pragma	HTTP response header: pragma	no-cache
Server	Information about the software used by the origin server	envoy
Via	HTTP response header: Via	1.1 google
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-envoy-upstream-service-time	HTTP response header: x-envoy-upstream-service-time	1052
x-frame-options	HTTP response header: x-frame-options	DENY
x-xss-protection	HTTP response header: x-xss-protection	1; mode=block