Rules & Rulesets (v3)

Overview

This method enables you to retrieve a list of all the rulesets in your organization.

Sample Query

List all rulesets in your organization:

https://api.threatstack.com/v3/rulesets

Overview

This method enables you to create a new ruleset in your organization.

NOTE

To add a rule to a ruleset, use the Create a Rule or Update a Rule endpoints.

Sample Query

Create a ruleset in your organization:

https://api.threatstack.com/v3/rulesets

Error Handling Tips

• 400: Incorrect syntax in the message body.
• 409: The ruleset name duplicates an existing ruleset name.

Overview

This method enables you to retrieve the details of a ruleset using a rulesetId.

NOTE

You can only pass one rulesetId at a time.

Sample Query

Retrieve a ruleset by ID:

https://api.threatstack.com/v3/rulesets/{rulesetId}

Error Handling Tips

• 404: The rulesetId was not found.

Overview

This method enables you to update a ruleset in your organization.

NOTE

• You can only pass one rulesetId at a time.
• The id in the request body must match the rulesetId in the path.

Sample Query

Update a ruleset by ID:

https://api.threatstack.com/v3/rulesets/{rulesetID}

Error Handling Tips

• 400: Incorrect syntax in the message body.
• 404: One of the following occurred:
  • The ruleset was not found.
  • One of the rules in the ruleset does not exist.
• 409: The ruleset name duplicates an existing ruleset name.

Overview

This method enables you to permanently delete a ruleset from your organization.

IMPORTANT:

This method does not delete the rules associated with the deleted ruleset. Any alerts generated by rules in the deleted ruleset are not deleted. These alerts continue to list the rule that triggered the alert, even though the ruleset no longer exists.

Sample Query

Delete a ruleset by ID:

https://api.threatstack.com/v3/rulesets/{rulesetId}

Error Handling Tips

• 404: The ruleset was not found.

Overview

This method enables you to retrieve a list of all Agents assigned to a ruleset in your organization.

Sample Query

Retrieve a list of all Agents assigned to a ruleset by ruleset ID:

https://api.threatstack.com/v3/rulesets/{rulesetId}/agents

Error Handling Tips

• 404: The ruleset was not found.

Overview

This method enables you to retrieve a list of all rules in your organization.

Sample Query

Retrieve a list of all rules:

https://api.threatstack.com/v3/rules

Overview

This method enables you to create a rule in your organization.

Sample Query

Create a rule:

https://api.threatstack.com/v3/rules

Error Handling Tips

• 400: Incorrect syntax in the message body.

Overview

This method enables you to retrieve the details of a rule in your organization.

NOTE

You can only pass one ruleId at a time.

Sample Query

Retrieve a rule by ID:

https://api.threatstack.com/v3/rules/{ruleId}

Error Handling Tips

• 404: The rule was not found.

Overview

This method enables you to update an existing rule in your environment.

NOTE

• You can only pass one ruleId at a time.
• The id in the request body must match the ruleId in the path.
• You cannot update the ruleType with this method.

Sample Query

Update a rule by ID:

https://api.threatstack.com/v3/rules/{ruleId}

Error Handling Tips

• 400: Incorrect syntax in message body.
• 404: The rule was not found.

Overview

This method enables you to delete a rule from your organization.

NOTE

You can only pass one ruleId at a time.

IMPORTANT

This method does not delete any alerts that the rule has generated. These alerts continue to list the rule that triggered the alert, even though the rule no longer exists.

Sample Query

Delete a rule by ID:

https://api.threatstack.com/v3/rules/{ruleId} 

Error Handling Tips

• 404: The rule was not found.

Overview

This method allows you to add a suppression to an existing rule in your environment.

NOTE

• You can only pass one ruleId at a time.
• You can only pass one suppressionId at a time.

IMPORTANT

Any active alerts that would have been suppressed prior to adding the suppression will not be retroactively suppressed.

Sample Query

Add a suppression to a rule by IDs:

https://api.threatstack.com/v3/rules/{ruleId}/suppressions/{suppressionId}

Error Handling Tips

• 404: One of the following occurred:
  • The rule was not found.
  • The suppression was not found.

Overview

This method enables you to remove a suppression from a rule in your organization.

NOTE

• You can only pass one ruleId at a time.
• You can only pass one suppressionId at a time.

Sample Query

Remove a suppression from a rule by IDs:

https://api.threatstack.com/v3/rules/{ruleId}/suppressions/{suppressionId}

Error Handling Tips

• 404: One of the following occurred:
  • The rule was not found.
  • The suppression was not found.

Overview

This method enables you to retrieve a list of all classification labels attached to a rule.

NOTE

You can only pass one ruleId at a time.

Sample Query

Retrieve a list of all classification labels attached to a rule by ID:

https://api.threatstack.com/v3/rules/{ruleId}/classificationLabels

Error Handling Tips

• 404: The rule was not found.

Overview

This method enables you to attach multiple classification labels to an existing rule.

NOTE

You can only pass one ruleId at a time.

Sample Query

Attach classification labels to a rule by ID:

https://api.threatstack.com/v3/rules/{ruleId}/classificationLabels

Error Handling Tips

• 404: One of the following occurred:
  • The rule was not found.
  • One or more of the classification labels was not found.

Overview

This method enables you to attach a classification label to a rule.

NOTE

• You can only pass one ruleId at a time.
• You can only pass one labelId at a time.

Sample Queries

Attach a classification label to a rule by IDs:

https://api.threatstack.com/v3/rules/{ruleId}/classificationLabels/{labelId}

Attach a classification label with modifier to a rule by IDs:

https://api.threatstack.com/v3/rules/{ruleId}/classificationLabels/{labelId}?modifier=(b)

Error Handling Tips

• 404: One of the following occurred:
  • The rule was not found.
  • The classification label was not found.

Overview

This method enables you to remove a classification label from a rule.

NOTE

• You can only pass one ruleId at a time.
• You can only pass one labelId at a time.

Sample Query

Remove a classification label from a rule by IDs:

https://api.threatstack.com/v3/rules/{ruleId}/classificationLabels/{labelId}

Error Handling Tips

• 404: One of the following occurred:
  • The rule was not found.
  • The classification label was not found.

Overview

This method enables you to retrieve a list of all suppressions in your organization.

Sample Queries

Retrieve a list of all suppressions:

https://api.threatstack.com/v3/suppressions

Overview

This method enables you to create a rule suppression in your organization.

Sample Query

Create a suppression in your organization:

https://api.threatstack.com/v3/suppressions

Error Handling Tips

• 400: Incorrect syntax in the message body.

Overview

This method enables you to retrieve the details of a suppression using a suppressionId.

NOTE

You can only pass one suppressionId at a time.

Sample Query

Retrieve a suppression by ID:

https://api.threatstack.com/v3/suppressions/{suppressionId}

Error Handling Tips

• 404: The rule was not found.

Overview

This method enables you to update a suppression by suppressionId.

NOTE

You can only pass one suppressionId at a time.

Sample Query

Update a suppression:

https://api.threatstack.com/v3/suppressions/{suppressionId}

Error Handling Tips

• 400: Incorrect syntax in the message body.
• 404: The suppression was not found.

Overview

This method enables you to delete a suppression by suppressionId.

NOTE

You can only pass one suppressionId at a time.

IMPORTANT

Any suppressions that you delete are automatically removed from the rules to which they were added and no longer suppress alerts. Once the suppression is deleted, previously suppressed alerts will not generate retroactively, but new alerts may generate that previously would have been suppressed.

Sample Query

Delete a suppression:

https://api.threatstack.com/v3/suppressions/{suppressionId}

Error Handling Tips

• 400: Incorrect syntax in the message body.
• 404: The suppression was not found.