> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-alert-notification-rules/alert-notification-rules.md).

# Alert Notification Rules

Manage alert notification rules for Cortex Cloud.

## List all rules

> This endpoint retrieves a list of alert notification rules and returns their attributes. The meaning behind all attributes in this response could be found in the \`\`\`Rule\`\`\` schema. Please note that the field \`\`\`legacy\_mail\_format\`\`\` is set to False for all rules that were not created in legacy Xpanse environments.

````json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud Alert Notification Rules REST APIs","version":"Cortex Cloud"},"tags":[{"name":"Alert Notification Rules","description":"Manage alert notification rules for Cortex Cloud."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/notifications/v1/list-rules":{"get":{"tags":["Alert Notification Rules"],"summary":"List all rules","description":"This endpoint retrieves a list of alert notification rules and returns their attributes. The meaning behind all attributes in this response could be found in the ```Rule``` schema. Please note that the field ```legacy_mail_format``` is set to False for all rules that were not created in legacy Xpanse environments.","operationId":"listRules","responses":{"200":{"description":"Successfully retrieved rules","content":{"application/json":{"schema":{"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Rule"}},"metadata":{"type":"object","$ref":"#/components/schemas/Metadata"}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"Rule":{"type":"object","description":"Enumerates the various attributes of an alert notification rule that is returned via numerous flows.","properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"rule_uuid":{"type":"string","description":"The unique identifier of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."},"legacy_mail_format":{"type":"boolean","description":"This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)"}},"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack."},"created_by":{"type":"string","description":"This string indicates the user or api-key responsible for creating the notification rule."},"created_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was created."},"modified_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was last modified."},"enabled":{"type":"boolean","default":true,"description":"A flag indicating whether the notification rule is currently active and enabled."}},"additionalProperties":false},"Metadata":{"type":"object","description":"Metadata for the response","additionalProperties":true}},"responses":{"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object"}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Create a new rule

> This endpoint allows the user to create a new alert notification rule and specify its attributes. To see the possible \`\`\`forward\_type\`\`\` values, please check the relevant enum named \`\`\`LogForwardType\`\`\` for additional information. The \`\`\`forward\_source\`\`\` attribute is where a user would define email, Slack, and Syslog configurations; the required formats for these fields are documented in the \`\`\`RuleCreateRequest\`\`\` schema. The \`\`\`applications\`\`\` attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The \`\`\`mail\_format\`\`\`, \`\`\`syslog\_format\`\`\`, and \`\`\`slack\_format\`\`\` attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the \`\`\`RuleCreateRequest\`\`\` schema.

````json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud Alert Notification Rules REST APIs","version":"Cortex Cloud"},"tags":[{"name":"Alert Notification Rules","description":"Manage alert notification rules for Cortex Cloud."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/notifications/v1/rule":{"post":{"tags":["Alert Notification Rules"],"summary":"Create a new rule","description":"This endpoint allows the user to create a new alert notification rule and specify its attributes. To see the possible ```forward_type``` values, please check the relevant enum named ```LogForwardType``` for additional information. The ```forward_source``` attribute is where a user would define email, Slack, and Syslog configurations; the required formats for these fields are documented in the ```RuleCreateRequest``` schema. The ```applications``` attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The ```mail_format```, ```syslog_format```, and ```slack_format``` attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the ```RuleCreateRequest``` schema.","operationId":"createRule","requestBody":{"description":"Rule creation request payload with required details for configuring alert notification rule","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleCreateRequest"}}}},"responses":{"201":{"$ref":"#/components/responses/RuleCreatedSuccess"},"400":{"$ref":"#/components/responses/RuleCreatedBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"RuleCreateRequest":{"type":"object","description":"Enumerates the rule creation request schema for Alert Notifications","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","forward_type"],"properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."}},"required":["distribution_list"],"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"required":["channels"],"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"required":["id"],"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the ```legacy_alert``` format is not permissible for Slack."}}}},"additionalProperties":false}},"responses":{"RuleCreatedSuccess":{"description":"Alert Notification Rule created successfully","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"rule_uuid":{"type":"string","description":"The unique identifier of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."},"legacy_mail_format":{"type":"boolean","description":"This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)"}},"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack."},"created_by":{"type":"string","description":"This string indicates the user or api-key responsible for creating the notification rule."},"created_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was created."},"modified_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was last modified."},"enabled":{"type":"boolean","default":true,"description":"A flag indicating whether the notification rule is currently active and enabled."}}}}}}}},"RuleCreatedBadRequest":{"description":"Bad request for alert notification rule create call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}},"required":["err_extra","err_code"]}},"required":["err_msg","metadata"]}},"required":["data"]}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object"}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Retrieve a specific alert notification rule

> This endpoint retrieves an alert notification rule and returns its attributes. The meaning behind all attributes in this response could be found in the \`\`\`Rule\`\`\` schema. Please note that the field \`\`\`legacy\_mail\_format\`\`\` is set to False for all rules that were not created in legacy Xpanse environments.

````json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud Alert Notification Rules REST APIs","version":"Cortex Cloud"},"tags":[{"name":"Alert Notification Rules","description":"Manage alert notification rules for Cortex Cloud."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/notifications/v1/rule/{rule_uuid}":{"get":{"tags":["Alert Notification Rules"],"summary":"Retrieve a specific alert notification rule","description":"This endpoint retrieves an alert notification rule and returns its attributes. The meaning behind all attributes in this response could be found in the ```Rule``` schema. Please note that the field ```legacy_mail_format``` is set to False for all rules that were not created in legacy Xpanse environments.","operationId":"getRuleByUUID","parameters":[{"name":"rule_uuid","in":"path","required":true,"description":"Full rule uuid of the Alert Notification Rule","schema":{"type":"string"}}],"responses":{"200":{"description":"Successfully retrieved rule","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/Rule"}}}}}},"400":{"$ref":"#/components/responses/GetRuleByUUIDBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"Rule":{"type":"object","description":"Enumerates the various attributes of an alert notification rule that is returned via numerous flows.","properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"rule_uuid":{"type":"string","description":"The unique identifier of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."},"legacy_mail_format":{"type":"boolean","description":"This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)"}},"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack."},"created_by":{"type":"string","description":"This string indicates the user or api-key responsible for creating the notification rule."},"created_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was created."},"modified_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was last modified."},"enabled":{"type":"boolean","default":true,"description":"A flag indicating whether the notification rule is currently active and enabled."}},"additionalProperties":false}},"responses":{"GetRuleByUUIDBadRequest":{"description":"Bad request for alert notification rule get by uuid call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}},"required":["err_extra","err_code"]}},"required":["err_msg","metadata"]}},"required":["data"]}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object"}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Edit an existing Alert Notification Rule

> This endpoint allows the user to edit an alert notification rule and specify its new attributes. To see the possible \`\`\`forward\_type\`\`\` values, please check the relevant enum schema named \`\`\`LogForwardType\`\`\`. The \`\`\`forward\_source\`\`\` attribute is where a user would define email, Slack, and Syslog configurations; the required formats are specified in the \`\`\`RuleEditRequest\`\`\`schema. The \`\`\`applications\`\`\` attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The \`\`\`mail\_format\`\`\`, \`\`\`syslog\_format\`\`\`, and \`\`\`slack\_format\`\`\` attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the \`\`\`RuleEditRequest\`\`\` schema. Please note that you can only edit a rule that is in an \`\`\`Enabled\`\`\` state.

````json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud Alert Notification Rules REST APIs","version":"Cortex Cloud"},"tags":[{"name":"Alert Notification Rules","description":"Manage alert notification rules for Cortex Cloud."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/notifications/v1/rule/{rule_uuid}":{"put":{"parameters":[{"name":"rule_uuid","in":"path","required":true,"description":"Full rule uuid of the Alert Notification Rule","schema":{"type":"string"}}],"tags":["Alert Notification Rules"],"summary":"Edit an existing Alert Notification Rule","description":"This endpoint allows the user to edit an alert notification rule and specify its new attributes. To see the possible ```forward_type``` values, please check the relevant enum schema named ```LogForwardType```. The ```forward_source``` attribute is where a user would define email, Slack, and Syslog configurations; the required formats are specified in the ```RuleEditRequest```schema. The ```applications``` attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The ```mail_format```, ```syslog_format```, and ```slack_format``` attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the ```RuleEditRequest``` schema. Please note that you can only edit a rule that is in an ```Enabled``` state.","operationId":"editRule","requestBody":{"description":"Enumerates the JSON payload required to edit an Alert Notification Rule","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleEditRequest"}}}},"responses":{"200":{"$ref":"#/components/responses/RuleEditSuccess"},"400":{"$ref":"#/components/responses/RuleEditBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"RuleEditRequest":{"type":"object","description":"Enumerates the various attributes required for editing an existing notification rule","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","forward_type"],"properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum. It must be the same as its current forward_type as this field is not mutable during edits."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","items":{"type":"string"},"description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes). The default is 10 minutes."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."}},"required":["distribution_list"],"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"required":["channels"],"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"required":["id"],"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the ```legacy_alert``` format is not permissible for Slack."}}}},"additionalProperties":false}},"responses":{"RuleEditSuccess":{"description":"Alert Notification Rule edited successfully","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"rule_uuid":{"type":"string","description":"The unique identifier of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."},"legacy_mail_format":{"type":"boolean","description":"This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)"}},"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack."},"created_by":{"type":"string","description":"This string indicates the user or api-key responsible for creating the notification rule."},"created_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was created."},"modified_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was last modified."},"enabled":{"type":"boolean","default":true,"description":"A flag indicating whether the notification rule is currently active and enabled."}}}}}}}},"RuleEditBadRequest":{"description":"Bad request for alert notification rule edit call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}},"required":["err_extra","err_code"]}},"required":["err_msg","metadata"]}},"required":["data"]}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object"}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
````

## Delete an existing Alert Notification Rule

> Allows the user to delete an existing Alert Notification Rule by its unique identifier.

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud Alert Notification Rules REST APIs","version":"Cortex Cloud"},"tags":[{"name":"Alert Notification Rules","description":"Manage alert notification rules for Cortex Cloud."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/notifications/v1/rule/{rule_uuid}":{"delete":{"tags":["Alert Notification Rules"],"description":"Allows the user to delete an existing Alert Notification Rule by its unique identifier.","parameters":[{"name":"rule_uuid","in":"path","required":true,"description":"Full rule uuid of the Alert Notification Rule","schema":{"type":"string"}}],"summary":"Delete an existing Alert Notification Rule","operationId":"deleteRule","responses":{"204":{"$ref":"#/components/responses/RuleDeleteSuccess"},"400":{"$ref":"#/components/responses/RuleDeleteBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"responses":{"RuleDeleteSuccess":{"description":"Successful deletion of Alert Notification Rule","content":{"application/json":{"schema":{"type":"null"}}}},"RuleDeleteBadRequest":{"description":"Bad request for rule delete call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}},"required":["err_extra","err_code"]}},"required":["err_msg","metadata"]}},"required":["data"]}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object"}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
```

## Edit the status of an existing Alert Notification Rule

> This endpoint allows a user to modify a rule's status without requiring a full update. A user can either enable or disable an Alert Notification Rule.

```json
{"openapi":"3.1.2","info":{"title":"Cortex Cloud Alert Notification Rules REST APIs","version":"Cortex Cloud"},"tags":[{"name":"Alert Notification Rules","description":"Manage alert notification rules for Cortex Cloud."}],"servers":[{"url":"https://api-{fqdn}","variables":{"fqdn":{"default":"cortex.paloaltonetworks.com","description":"The fully qualified domain name for your Cortex tenant"}}}],"paths":{"/platform/notifications/v1/update-rule-status/{rule_uuid}":{"patch":{"tags":["Alert Notification Rules"],"description":"This endpoint allows a user to modify a rule's status without requiring a full update. A user can either enable or disable an Alert Notification Rule.","parameters":[{"name":"rule_uuid","in":"path","required":true,"description":"Full rule uuid of the Alert Notification Rule","schema":{"type":"string"}}],"summary":"Edit the status of an existing Alert Notification Rule","operationId":"updateRuleStatus","requestBody":{"description":"Enumerates the JSON payload required to edit the status of an Alert Notification Rule","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleStatusUpdateRequest"}}}},"responses":{"204":{"$ref":"#/components/responses/RuleStatusUpdateSuccess"},"400":{"$ref":"#/components/responses/RuleStatusUpdateBadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/UnauthorizedImproperPermissions"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"RuleStatusUpdateRequest":{"type":"object","description":"Enumerates the various para meters required for updating the status of a rule","required":["request_data"],"properties":{"request_data":{"type":"object","required":["status"],"properties":{"status":{"type":"string","description":"Value of updated status {enable|disable}","minLength":1}}}},"additionalProperties":false}},"responses":{"RuleStatusUpdateSuccess":{"description":"Alert Notification Rule status updated successfully","content":{"application/json":{"schema":{"type":"null"}}}},"RuleStatusUpdateBadRequest":{"description":"Bad request for rule status update call","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"err_msg":{"type":"string","description":"Error message describing the issue"},"metadata":{"type":"object","properties":{"err_extra":{"type":"string","description":"Additional error details"},"err_code":{"type":"integer","description":"HTTP error code"}},"required":["err_extra","err_code"]}},"required":["err_msg","metadata"]}},"required":["data"]}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object"}}}},"UnauthorizedImproperPermissions":{"description":"Unauthorized access due to lack of sufficient permissions","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_msg":{"type":"string"},"err_extra":{"type":"string"},"err_code":{"type":"integer"}}}}}}}},"InternalError":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-alert-notification-rules/alert-notification-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.