Rules & Rulesets (v2)

Overview

This method enables you to get a list of all the rulesets in your environment.

Sample Queries

Find all the rulesets in your organization:

https://api.threatstack.com/v2/rulesets

Find a ruleset with a specific agentId (for example: 12345678-9abc-def0-1234-56789abcdef0):

https://api.threatstack.com/v2/rulesets?agentId=12345678-9abc-def0-1234-56789abcdef0

Error Handling Tips

A 400 error means the agentId is invalid. The agentId should be a 36 character UUID.

A 404 error means there is no data associated with the query for that agentId.

Overview

This method enables you to create rulesets in your environment.

Sample Query

Create a Ruleset in your organization:

https://api.threatstack.com/v2/rulesets

Error Handling Tips

400: The syntax of the message body is incorrect and the ruleset was unable to be created.

404: One of the ruleIds specified in the message body does not exist, so the ruleset was unable to be created.

409: The ruleset name duplicates an existing ruleset name. The ruleset was unable to be created.

Overview

This method enables you to get the details of a ruleset by rulesetId.

NOTE

You can only pass one rulesetId at a time.

Sample Query

Find a ruleset by rulesetId:

https://api.threatstack.com/v2/rulesets/{rulesetId}

Error Handling Tips

The 404 error code means that the rulesetId was not found.

Overview

This method enables you to update rulesets in your organization.

Sample Query

Update a ruleset in your organization:

https://api.threatstack.com/v2/rulesets/{rulesetID}

Error Handling Tips

400: The syntax of the message body is incorrect and the ruleset did not update.

404: One of the following occurred:

• The ruleset was not found.
• One of the rules in the ruleset does not exist.

409: The ruleset name duplicates an existing ruleset name.

Overview

This method enables you to delete a specific ruleset from your environment.

When you delete a ruleset, two things occur:

• The ruleset permanently deletes from Distributed Cloud AIP.
• All rules included in the ruleset are permanently deleted from Distributed Cloud AIP.

IMPORTANT: Any alerts generated by rule in the deleted ruleset are not deleted. These alerts continue to list the rule that triggered the alert, even though the ruleset no longer exists.

Sample Query

Delete a ruleset with a specific rulesetID (for example: 00000000-aaaa-0000-aaaa-0000000000):

https://api.threatstack.com/v2/rulesets/00000000-aaaa-0000-aaaa-0000000000

Error Handling Tips

404: The ruleset to delete was not found.

Overview

This method enables you to get the list of rules assigned to a ruleset by the rulesetId.

NOTE

You can only pass one rulesetId at a time.

Sample Query

Find list of rules by rulesetId:

https://api.threatstack.com/v2/rulesets/{rulesetId}/rules

Error Handling Tips

The 404 error code means that the rulesetId was not found."

Overview

This method enables you to create a rule for a specific ruleset.

Sample Query

Create a rule for a specific ruleset:

https://api.threatstack.com/v2/rulesets/{rulesetId}/rules

Error Handling Tips

• 400: Invalid value(s) in the rule syntax.
• 404: The selected ruleset cannot be found.

Overview

This method enables you to get the details of a specific rule assigned to a ruleset by the rulesetId and ruleId.

NOTE

You can only pass one rulesetId and one ruleId at a time.

Sample Query

Find the details of a rule by rulesetId and ruleId:

https://api.threatstack.com/v2/rulesets/{rulesetId}/rules/{ruleId}

Error Handling Tips

The 404 error code means the rulesetId or ruleId was not found.

Overview

This method enables you to update a rule.

NOTE

You cannot update the rule's type with this method.

Sample Queries

Update a rule in a specific ruleset:

https://api.threatstack.com/v2/rulesets/{rulesetId}/rules/{ruleId}

Error Handling Tips

• 400: Invalid value(s) in the rule syntax.
• 404: Either the selected ruleset cannot be found, or the rule cannot be found.
• 409: The rule name duplicates an existing rule name.

Overview

This method enables you to delete a rule from a specific ruleset.

Sample Queries

Delete a rule from a specific ruleset

https://api.threatstack.com/v2/rulesets/{rulesetId}/rules/{ruleId}

Error Handling Tips

404: Either the selected ruleset cannot be found, or the rule cannot be found.

Overview

This method enables you to get the list of Distributed Cloud AIP Agents to which a specific ruleset has been assigned.

NOTE

This endpoint returns only active Agents. You can only pass one rulesetId at a time.

Sample Query

Find the list of Distributed Cloud AIP Agents assigned to a specific ruleset:

https://api.threatstack.com/v2/rulesets/{rulesetId}/agents

Error Handling Tips

The 404 error code means rulesetId was not found.

Overview

This method enables you to get a list of AWS EC2 tags for a specific rule.

NOTE

You can only pass one ruleId at a time. You cannot get tags for AWS CloudTrail rules.

Sample Request

Find tags by ruleId

https://api.threatstack.com/v2/rules/{ruleId}/tags

Error Handling Tips

404: No tags found for the selected ruleId.

Overview

This method enables you to set inclusion and exclusion AWS EC2 tags for a specific rule.

NOTE

You can only pass one ruleId at a #docTextSection:zR4WHD8nqEMdNENHa. You cannot set tags for an AWS CloudTrail rule.

Sample Request

Set tags by ruleId

https://api.threatstack.com/v2/rules/{ruleId}/tags

Error Handling Tips

404: No tags found for the selected ruleId.

Overview

This method enables you to update a rule's suppression list.

Sample Queries

Update a rule suppression list in your organization:

https://api.threatstack.com/v2/rules/{ruleID}/suppressions

Error Handling Tips

400: The syntax of the message body is incorrect and the rule did not update. There are three possible messages:

• Error message for an invalid value where invalid1 and invalid2 are strings coming from the suppression body that do not fit an accepted format.
• Error message for an invalid key. Status code 400
• Error message for an invalid value type. Status code 400