Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Alert Notification Rules

Manage alert notification rules for Cortex Cloud.

List all rules

get

This endpoint retrieves a list of alert notification rules and returns their attributes. The meaning behind all attributes in this response could be found in the Rule schema. Please note that the field legacy_mail_format is set to False for all rules that were not created in legacy Xpanse environments.

Responses
200

Successfully retrieved rules

application/json
get/platform/notifications/v1/list-rules
GET /platform/notifications/v1/list-rules HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Accept: */*

{
  "data": [
    {
      "rule_uuid": "5b0082c2-c0e3-4cad-b354-415d496ad995",
      "name": "Test Rule 1",
      "description": "This is a description placeholder",
      "filter": {
        "filter": {
          "AND": [
            {
              "SEARCH_FIELD": "is_whitelisted",
              "SEARCH_TYPE": "EQ",
              "SEARCH_VALUE": false
            }
          ]
        }
      },
      "applications": [
        "1111-TeSt-1223-09ID-415305650"
      ],
      "forward_source": {},
      "forward_type": "alert",
      "time_zone": "Pacific/Nauru",
      "slack_format": "issue",
      "syslog_format": "issue",
      "mail_format": "issue",
      "created_by": "testuser@paloaltonetworks.com",
      "created_at": 1764873308164,
      "modified_at": 1764873308164,
      "enabled": true
    },
    {
      "rule_uuid": "5b0082c2-c0e3-4c2d-b354-415d496ad990",
      "name": "Test Rule 2",
      "description": "another test description",
      "filter": {
        "filter": {
          "AND": [
            {
              "SEARCH_FIELD": "severity",
              "SEARCH_TYPE": "EQ",
              "SEARCH_VALUE": "SEV_040_HIGH"
            }
          ]
        }
      },
      "applications": [
        "2222-TeSt-1223-09ID-415305650"
      ],
      "forward_source": {
        "email": {
          "aggregation": 1200,
          "distribution_list": [
            "testuser@gmail.com"
          ],
          "legacy_mail_format": false
        }
      },
      "forward_type": "alert",
      "time_zone": "Pacific/Nauru",
      "slack_format": "issue",
      "syslog_format": "standard_alert",
      "mail_format": "issue",
      "created_by": "testuser@paloaltonetworks.com",
      "created_at": 1764878761056,
      "modified_at": 1764878761056,
      "enabled": true
    }
  ],
  "metadata": {
    "total_count": 2
  }
}

Create a new rule

post

This endpoint allows the user to create a new alert notification rule and specify its attributes. To see the possible forward_type values, please check the relevant enum named LogForwardType for additional information. The forward_source attribute is where a user would define email, Slack, and Syslog configurations; the required formats for these fields are documented in the RuleCreateRequest schema. The applications attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The mail_format, syslog_format, and slack_format attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the RuleCreateRequest schema.

Body

Enumerates the rule creation request schema for Alert Notifications

Responses
201

Alert Notification Rule created successfully

application/json
post/platform/notifications/v1/rule
POST /platform/notifications/v1/rule HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Content-Type: application/json
Accept: */*
Content-Length: 542

{
  "request_data": {
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "forward_type": "alert",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue"
  }
}
{
  "data": {
    "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4",
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000,
        "legacy_mail_format": false
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "forward_type": "alert",
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue",
    "created_by": "testuser@paloaltonetworks.com",
    "created_at": 1764958056697,
    "modified_at": 1764958056697,
    "enabled": true
  }
}

Retrieve a specific alert notification rule

get

This endpoint retrieves an alert notification rule and returns its attributes. The meaning behind all attributes in this response could be found in the Rule schema. Please note that the field legacy_mail_format is set to False for all rules that were not created in legacy Xpanse environments.

Path parameters
rule_uuidstringRequired

Full rule uuid of the Alert Notification Rule

Example: 3053ad1f-0efc-305d-90dd-a305ab4153a4
Responses
200

Successfully retrieved rule

application/json
get/platform/notifications/v1/rule/{rule_uuid}
GET /platform/notifications/v1/rule/{rule_uuid} HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Accept: */*

{
  "data": {
    "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4",
    "name": "Test Rule 1",
    "description": "This is a description placeholder",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "applications": [
      "1111-TeSt-1223-09ID-415305650"
    ],
    "forward_source": {},
    "forward_type": "alert",
    "time_zone": "Pacific/Nauru",
    "slack_format": "issue",
    "syslog_format": "issue",
    "mail_format": "issue",
    "created_by": "testuser@paloaltonetworks.com",
    "created_at": 1764873308164,
    "modified_at": 1764873308164,
    "enabled": true
  }
}

Edit an existing Alert Notification Rule

put

This endpoint allows the user to edit an alert notification rule and specify its new attributes. To see the possible forward_type values, please check the relevant enum schema named LogForwardType. The forward_source attribute is where a user would define email, Slack, and Syslog configurations; the required formats are specified in the RuleEditRequestschema. The applications attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The mail_format, syslog_format, and slack_format attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the RuleEditRequest schema. Please note that you can only edit a rule that is in an Enabled state.

Path parameters
rule_uuidstringRequired

Full rule uuid of the Alert Notification Rule

Body

Enumerates the various attributes required for editing an existing notification rule

Responses
200

Alert Notification Rule edited successfully

application/json
put/platform/notifications/v1/rule/{rule_uuid}
PUT /platform/notifications/v1/rule/{rule_uuid} HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Content-Type: application/json
Accept: */*
Content-Length: 542

{
  "request_data": {
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "forward_type": "alert",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue"
  }
}
{
  "data": {
    "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4",
    "name": "Test Rule 01",
    "description": "a description for the test rule",
    "filter": {
      "filter": {
        "AND": [
          {
            "SEARCH_FIELD": "is_whitelisted",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": false
          }
        ]
      }
    },
    "applications": [
      "63e3ad1f-0efc-401d-90dd-a305ab6053a4"
    ],
    "forward_source": {
      "email": {
        "distribution_list": [
          "testuser@paloaltonetworks.com"
        ],
        "aggregation": 1000,
        "legacy_mail_format": false
      },
      "syslog": {
        "id": 1
      },
      "slack": {
        "channels": [
          "slack-test-channel1"
        ]
      }
    },
    "forward_type": "alert",
    "time_zone": "Pacific/Nauru",
    "mail_format": "issue",
    "syslog_format": "standard_alert",
    "slack_format": "issue",
    "created_by": "testuser@paloaltonetworks.com",
    "created_at": 1764958056697,
    "modified_at": 1764958056697,
    "enabled": true
  }
}

Delete an existing Alert Notification Rule

delete

Allows the user to delete an existing Alert Notification Rule by its unique identifier.

Path parameters
rule_uuidstringRequired

Full rule uuid of the Alert Notification Rule

Example: 3053ad1f-0efc-305d-90dd-a305ab4153a4
Responses
204

Successful deletion of Alert Notification Rule

application/json
nullOptional
delete/platform/notifications/v1/rule/{rule_uuid}
DELETE /platform/notifications/v1/rule/{rule_uuid} HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Accept: */*

No content

Edit the status of an existing Alert Notification Rule

patch

This endpoint allows a user to modify a rule's status without requiring a full update. A user can either enable or disable an Alert Notification Rule.

Path parameters
rule_uuidstringRequired

Full rule uuid of the Alert Notification Rule

Example: 3053ad1f-0efc-305d-90dd-a305ab4153a4
Body

Enumerates the various para meters required for updating the status of a rule

Responses
204

Alert Notification Rule status updated successfully

application/json
nullOptional
patch/platform/notifications/v1/update-rule-status/{rule_uuid}
PATCH /platform/notifications/v1/update-rule-status/{rule_uuid} HTTP/1.1
Host: api-cortex.paloaltonetworks.com
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "request_data": {
    "status": "enable"
  }
}
No content
PreviousCortex Cloud Alert Notification Rules overview
NextModels

Last updated

Was this helpful?