Policies

APIs for managing Cloud Workload Policies

Get CWP Policies (v2)

get

Fetches a list of all CWP policy instances. You can filter the results by policy type (e.g., COMPLIANCE, MALWARE, SECRET, TRUSTED_IMAGES). By default, all policy types are returned. Use the disableVerbose flag to optimize performance by skipping asset group data updates.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Query parameters

disableVerboseboolean · nullableOptional

Flag to bypass calling platform for asset groups data when fetching policies. Note that this means asset groups will not be updated upon fetching policies.

Default: false

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Responses

200

Success

application/json; charset=UTF-8

The response you get when calling the get policies V2 path

idstringRequired

revisionintegerRequired

createdAtstring · date-timeRequired

modifiedAtstring · date-timeRequired

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

createdBystringRequired

disabledbooleanRequired

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

conditionstring · byteRequired

exceptionstring · byteRequired

assetScopestring · byteRequired

assetGroupsIDsinteger[]Required

assetGroupsstring[]Required

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

remediationGuidancestringRequired

missingInformationActionstring · enum · nullableOptional

One of the supported policy actions

Example: ISSUEPossible values:

usingSystemAssetGroupsbooleanRequired

unifiedPolicyIdstringOptional

gracePeriodstringRequired

Grace period duration string in days

400

Client error

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

get/public_api/v2/cwp/policies

GET /public_api/v2/cwp/policies HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*

[
  {
    "id": "1",
    "revision": 3,
    "createdAt": "2024-07-28T18:50:55Z",
    "modifiedAt": "2024-07-28T18:50:55Z",
    "type": "COMPLIANCE",
    "createdBy": "admin",
    "disabled": false,
    "name": "some policy",
    "description": "some policy description",
    "evaluationModes": [
      "PERIODIC"
    ],
    "usingSystemAssetGroups": false,
    "gracePeriod": "",
    "evaluationStage": "CI",
    "policyRules": [
      {
        "id": "2",
        "rule_id": "3",
        "policy_id": "1",
        "severity": "CRITICAL",
        "action": "ISSUE",
        "policy_revision": 3,
        "rule_name": "ruleName",
        "remediation_guidance": "",
        "user_remediation_guidance": ""
      },
      {
        "id": "3",
        "rule_id": "4",
        "policy_id": "1",
        "severity": "HIGH",
        "action": "PREVENT",
        "policy_revision": 4,
        "rule_name": "ruleName2",
        "remediation_guidance": "",
        "user_remediation_guidance": ""
      }
    ],
    "condition": "U19tZUJhc2U2NERhdGE=",
    "exception": "U39tZUJhc2U2NERhdGE=",
    "assetScope": "U59tZUJhc2U2NERhdGE=",
    "assetGroupsIDs": [
      1,
      2
    ],
    "assetGroups": [
      "group1",
      "group2"
    ],
    "action": "ISSUE",
    "severity": "CRITICAL",
    "remediationGuidance": "some remediation guidance",
    "missingInformationAction": "ISSUE"
  }
]

Add CWP Policies (v2)

post

Creates new CWP policy. This version supports advanced configuration including policyRules, gracePeriod, and usingSystemAssetGroups.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

The schema of a created policy

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

disabledbooleanRequired

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

conditionstring · byteRequired

exceptionstring · byteRequired

assetScopestring · byteRequired

assetGroupsIDsinteger[]Required

assetGroupsstring[]Required

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

remediationGuidancestringRequired

createdBystringRequired

missingInformationActionstring · enum · nullableOptional

One of the supported policy actions

Example: ISSUEPossible values:

usingSystemAssetGroupsbooleanRequired

unifiedPolicyIdstringOptional

gracePeriodstringRequired

Grace period duration string in days

Responses

201

Success

application/json; charset=UTF-8

idstringOptional

400

Client error

application/json; charset=UTF-8

403

Forbidden error

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

post/public_api/v2/cwp/policies

POST /public_api/v2/cwp/policies HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json; charset=UTF-8
Accept: */*
Content-Length: 675

{
  "type": "COMPLIANCE",
  "disabled": false,
  "name": "some policy",
  "description": "some policy description",
  "evaluationModes": [
    "PERIODIC"
  ],
  "evaluationStage": "CI",
  "gracePeriod": "",
  "policyRules": [
    {
      "rule_id": "3",
      "severity": "CRITICAL",
      "action": "ISSUE",
      "user_remediation_guidance": "2"
    },
    {
      "rule_id": "4",
      "severity": "HIGH",
      "action": "PREVENT",
      "user_remediation_guidance": "1"
    }
  ],
  "condition": "Y29uZGl0aW9u",
  "exception": "ZXhjZXB0aW9u",
  "assetScope": "YXNzZXRTY29wZQ==",
  "assetGroupsIDs": [
    1,
    2
  ],
  "assetGroups": [
    "group1",
    "group2"
  ],
  "action": "ISSUE",
  "severity": "CRITICAL",
  "remediationGuidance": "some remediation guidance",
  "createdBy": "user",
  "missingInformationAction": "ISSUE",
  "usingSystemAssetGroups": false
}

{
  "id": "text"
}

Get a CWP Policy by ID (v2)

get

Fetches the detailed configuration of a single CWP policy identified by its unique ID. This includes associated rules, evaluation stages, and asset scope. Use disableVerbose to exclude platform-specific asset group metadata.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Path parameters

idstringRequired

Query parameters

disableVerboseboolean · nullableOptional

Flag to bypass calling platform for asset groups data when fetching policies. Note that this means asset groups will not be updated upon fetching policies.

Default: false

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Responses

200

Success

application/json; charset=UTF-8

The schema of a returned policy

idstringRequired

revisionintegerRequired

createdAtstring · date-timeRequired

modifiedAtstring · date-timeRequired

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

createdBystringRequired

disabledbooleanRequired

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

conditionstring · byteRequired

exceptionstring · byteRequired

assetScopestring · byteRequired

assetGroupsIDsinteger[]Required

assetGroupsstring[]Required

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

remediationGuidancestringRequired

missingInformationActionstring · enum · nullableOptional

One of the supported policy actions

Example: ISSUEPossible values:

usingSystemAssetGroupsbooleanRequired

unifiedPolicyIdstringOptional

gracePeriodstringRequired

Grace period duration string in days

404

Policy ID not found

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

get/public_api/v2/cwp/policies/{id}

GET /public_api/v2/cwp/policies/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*

{
  "id": "1",
  "revision": 3,
  "createdAt": "2024-07-28T18:50:55Z",
  "modifiedAt": "2024-07-28T18:50:55Z",
  "type": "COMPLIANCE",
  "createdBy": "admin",
  "disabled": false,
  "name": "some policy",
  "description": "some policy description",
  "evaluationModes": [
    "PERIODIC"
  ],
  "gracePeriod": "",
  "evaluationStage": "CI",
  "policyRules": [
    {
      "id": "2",
      "rule_id": "3",
      "policy_id": "1",
      "severity": "CRITICAL",
      "action": "ISSUE",
      "policy_revision": 3,
      "rule_name": "Rule1",
      "remediation_guidance": "",
      "user_remediation_guidance": ""
    },
    {
      "id": "3",
      "rule_id": "4",
      "policy_id": "1",
      "severity": "HIGH",
      "action": "PREVENT",
      "policy_revision": 4,
      "rule_name": "Rule2",
      "remediation_guidance": "",
      "user_remediation_guidance": ""
    }
  ],
  "condition": "U29tZUJhc1U2NERhdGE=",
  "exception": "U29tZUJhc3U2NERhdGE=",
  "assetScope": "U29tZUJh42U2NERhdGE=",
  "assetGroupsIDs": [
    1,
    2
  ],
  "assetGroups": [
    "group1",
    "group2"
  ],
  "action": "ISSUE",
  "severity": "CRITICAL",
  "remediationGuidance": "some remediation guidance",
  "missingInformationAction": "ISSUE",
  "usingSystemAssetGroups": false
}

Update a CWP Policy by ID (v2)

put

Updates the configuration of an existing CWP policy. The policy ID is mandatory. Note: The policy revision will be automatically incremented upon a successful update. Fields not provided in the request body will be reset to their default values.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Path parameters

idstringRequired

The policy ID to delete

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

The schema of a created policy

idstringRequired

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

disabledbooleanRequired

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

conditionstring · byteRequired

exceptionstring · byteRequired

assetScopestring · byteRequired

assetGroupsIDsinteger[]Required

assetGroupsstring[]Required

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

remediationGuidancestringRequired

createdBystringOptional

missingInformationActionstring · enum · nullableOptional

One of the supported policy actions

Example: ISSUEPossible values:

usingSystemAssetGroupsbooleanRequired

unifiedPolicyIdstringOptional

gracePeriodstringRequired

Grace period duration string in days

Responses

204

Success

No content

400

Client error

application/json; charset=UTF-8

403

Forbidden error

application/json; charset=UTF-8

404

Policy ID not found

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

put/public_api/v2/cwp/policies/{id}

PUT /public_api/v2/cwp/policies/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json; charset=UTF-8
Accept: */*
Content-Length: 711

{
  "id": "policyID",
  "type": "COMPLIANCE",
  "disabled": false,
  "name": "some policy",
  "description": "some policy description",
  "evaluationModes": [
    "PERIODIC"
  ],
  "gracePeriod": "",
  "evaluationStage": "CI",
  "policyRules": [
    {
      "rule_id": "3",
      "severity": "CRITICAL",
      "action": "ISSUE",
      "user_remediation_guidance": "1"
    },
    {
      "rule_id": "4",
      "severity": "HIGH",
      "action": "PREVENT",
      "user_remediation_guidance": "1"
    }
  ],
  "condition": "U29tZUJhc2U2NERfdGE=",
  "exception": "U29tZUJhc2U2NERfdGE=",
  "assetScope": "U29tZUJhc2U2NEFhdGE=",
  "assetGroupsIDs": [
    1,
    2
  ],
  "assetGroups": [
    "group1",
    "group2"
  ],
  "action": "ISSUE",
  "severity": "CRITICAL",
  "remediationGuidance": "some remediation guidance",
  "createdBy": "user",
  "missingInformationAction": "ISSUE",
  "usingSystemAssetGroups": false
}

No content

Get CWP Policies (v1)

get

Cloud Workload Policies help you prevent and manage security violations in your cloud runtime instances. They enable you to apply detection logic to specific asset groups at the desired SDLC stage, and define what action needs to be taken if the conditions are met.

Get all CWP policies of the given type. Default behavior is all.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Query parameters

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Responses

200

Success

application/json

The response you get when calling the get policies path

idstringOptional

revisionintegerOptional

createdAtstring · date-timeOptional

modifiedAtstring · date-timeOptional

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

createdBystringOptional

disabledbooleanOptional

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

rulesIdsstring[]Required

The UUIDs of the rules that define the condition The rulesIds field is only required for non-compliance policies.

conditionstring · byteRequired

The condition field is only required for non-compliance policies.

exceptionstring · byteOptional

assetScopestring · byteOptional

assetGroupsIDsinteger[]Required

assetGroupsstring[]Optional

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

missingInformationActionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

remediationGuidancestringOptional

400

Client error

application/json

500

Service had unexpected internal error

application/json; charset=UTF-8

get/public_api/v1/cwp/policies

GET /public_api/v1/cwp/policies HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*

[
  {
    "id": "1",
    "revision": 3,
    "createdAt": "2024-07-28T18:50:55Z",
    "modifiedAt": "2024-07-28T18:50:55Z",
    "type": "COMPLIANCE",
    "createdBy": "admin",
    "disabled": false,
    "name": "some policy",
    "description": "some policy description",
    "evaluationModes": [
      "PERIODIC"
    ],
    "evaluationStage": "CI",
    "rulesIds": [
      "1",
      "2"
    ],
    "condition": "U29tZUJhc2U2NEGhdGE=",
    "exception": "U29tZUJhc2U2NEhhdGE=",
    "assetScope": "U29tZUJhc2U2NE2hdGE=",
    "assetGroupsIDs": [
      1,
      2
    ],
    "assetGroups": [
      "group1",
      "group2"
    ],
    "action": "ISSUE",
    "severity": "CRITICAL",
    "missingInformationAction": "ISSUE",
    "remediationGuidance": "some remediation guidance"
  }
]

Add CWP Policies (v1)

post

Add CWP policy instances.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

The schema of a policy

idstringOptional

revisionintegerOptional

createdAtstring · date-timeOptional

modifiedAtstring · date-timeOptional

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

createdBystringOptional

disabledbooleanOptional

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

rulesIdsstring[]Required

The UUIDs of the rules that define the condition The rulesIds field is only required for non-compliance policies.

conditionstring · byteRequired

The condition field is only required for non-compliance policies.

exceptionstring · byteOptional

assetScopestring · byteOptional

assetGroupsIDsinteger[]Required

assetGroupsstring[]Optional

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

missingInformationActionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

remediationGuidancestringOptional

Responses

201

Success

application/json; charset=UTF-8

idstringOptional

400

Client error

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

post/public_api/v1/cwp/policies

POST /public_api/v1/cwp/policies HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 567

{
  "id": "1",
  "revision": 3,
  "createdAt": "2024-07-28T18:50:44Z",
  "modifiedAt": "2024-07-28T18:50:55Z",
  "type": "COMPLIANCE",
  "createdBy": "admin",
  "disabled": false,
  "name": "some policy",
  "description": "some policy description",
  "evaluationModes": [
    "PERIODIC"
  ],
  "evaluationStage": "CI",
  "rulesIds": [],
  "condition": "U29tZUJhc1U2NERhdGE=",
  "exception": "U29tZUJhc5U2NERhdGE=",
  "assetScope": "U29tZUJh72U2NERhdGE=",
  "assetGroupsIDs": [
    1,
    2
  ],
  "assetGroups": [
    "group1",
    "group2"
  ],
  "action": "ISSUE",
  "severity": "CRITICAL",
  "missingInformationAction": "ISSUE",
  "remediationGuidance": "some remediation guidance"
}

{
  "id": "text"
}

Get a CWP Policy by ID (v1)

get

Get a CWP policy by its ID.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Path parameters

idstringRequired

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Responses

200

Success

application/json

The schema of a policy

idstringOptional

revisionintegerOptional

createdAtstring · date-timeOptional

modifiedAtstring · date-timeOptional

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

createdBystringOptional

disabledbooleanOptional

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

rulesIdsstring[]Required

The UUIDs of the rules that define the condition The rulesIds field is only required for non-compliance policies.

conditionstring · byteRequired

The condition field is only required for non-compliance policies.

exceptionstring · byteOptional

assetScopestring · byteOptional

assetGroupsIDsinteger[]Required

assetGroupsstring[]Optional

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

missingInformationActionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

remediationGuidancestringOptional

404

Policy ID not found

application/json

500

Service had unexpected internal error

application/json; charset=UTF-8

get/public_api/v1/cwp/policies/{id}

GET /public_api/v1/cwp/policies/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*

{
  "id": "1",
  "revision": 3,
  "createdAt": "2024-07-28T18:50:44Z",
  "modifiedAt": "2024-07-28T18:50:55Z",
  "type": "COMPLIANCE",
  "createdBy": "admin",
  "disabled": false,
  "name": "some policy",
  "description": "some policy description",
  "evaluationModes": [
    "PERIODIC"
  ],
  "evaluationStage": "CI",
  "rulesIds": [],
  "condition": "U29tZUJhc1U2NERhdGE=",
  "exception": "U29tZUJhc5U2NERhdGE=",
  "assetScope": "U29tZUJh72U2NERhdGE=",
  "assetGroupsIDs": [
    1,
    2
  ],
  "assetGroups": [
    "group1",
    "group2"
  ],
  "action": "ISSUE",
  "severity": "CRITICAL",
  "missingInformationAction": "ISSUE",
  "remediationGuidance": "some remediation guidance"
}

Update a CWP Policy by ID (v1)

put

Update a CWP policy by its ID.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Path parameters

idstringRequired

The policy ID to delete

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

The schema of a policy

idstringOptional

revisionintegerOptional

createdAtstring · date-timeOptional

modifiedAtstring · date-timeOptional

typestring · enum · nullableRequired

One of the supported policy types

Example: MALWAREPossible values:

createdBystringOptional

disabledbooleanOptional

namestringRequired

descriptionstringRequired

evaluationStagestring · enum · nullableRequired

One of the supported evaluation stages

Example: CIPossible values:

rulesIdsstring[]Required

The UUIDs of the rules that define the condition The rulesIds field is only required for non-compliance policies.

conditionstring · byteRequired

The condition field is only required for non-compliance policies.

exceptionstring · byteOptional

assetScopestring · byteOptional

assetGroupsIDsinteger[]Required

assetGroupsstring[]Optional

actionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

severitystring · enum · nullableRequired

One of the supported policy severities

Example: CRITICALPossible values:

missingInformationActionstring · enum · nullableRequired

One of the supported policy actions

Example: ISSUEPossible values:

remediationGuidancestringOptional

Responses

204

Success

No content

400

Client error

application/json; charset=UTF-8

404

Policy ID not found

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

put/public_api/v1/cwp/policies/{id}

PUT /public_api/v1/cwp/policies/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json; charset=UTF-8
Accept: */*
Content-Length: 567

{
  "id": "1",
  "revision": 3,
  "createdAt": "2024-07-28T18:50:44Z",
  "modifiedAt": "2024-07-28T18:50:55Z",
  "type": "COMPLIANCE",
  "createdBy": "admin",
  "disabled": false,
  "name": "some policy",
  "description": "some policy description",
  "evaluationModes": [
    "PERIODIC"
  ],
  "evaluationStage": "CI",
  "rulesIds": [],
  "condition": "U29tZUJhc1U2NERhdGE=",
  "exception": "U29tZUJhc5U2NERhdGE=",
  "assetScope": "U29tZUJh72U2NERhdGE=",
  "assetGroupsIDs": [
    1,
    2
  ],
  "assetGroups": [
    "group1",
    "group2"
  ],
  "action": "ISSUE",
  "severity": "CRITICAL",
  "missingInformationAction": "ISSUE",
  "remediationGuidance": "some remediation guidance"
}

No content

Delete a CWP Policy by ID (v1)

delete

Delete a CWP policy by its ID.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Path parameters

idstringRequired

The policy ID to delete

Query parameters

closeIssuesbooleanOptional

If set, will trigger issue closing of issues opened by the deleted policy

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Responses

204

Success

No content

400

Client error

application/json; charset=UTF-8

404

Policy ID not found

application/json; charset=UTF-8

500

Service had unexpected internal error

application/json; charset=UTF-8

delete/public_api/v1/cwp/policies/{id}

DELETE /public_api/v1/cwp/policies/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*

No content