Disable Injection and Prevention Rules Public API

Get Disable Injection and Prevention rules

post

Retrieves a paginated list of Disable Injection and Prevention rules based on optional filters and sorting criteria.

This endpoint allows you to:

• Retrieve all rules or filter by specific criteria
• Sort results by any field in ascending or descending order
• Paginate through large result sets
• Get total count and filtered count of rules

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

Responses

200

Successful response

application/json

400

Bad Request

application/json

post/public_api/v1/disable_injection_prevention_rules/fetch

POST /public_api/v1/disable_injection_prevention_rules/fetch HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 156

{
  "request_data": {
    "search_from": 0,
    "search_to": 1,
    "sort": {
      "field": "rule_id",
      "keyword": "desc"
    },
    "filters": [
      {
        "field": "status",
        "operator": "eq",
        "value": "active"
      }
    ]
  }
}

{
  "reply": {
    "data": [
      {
        "rule_id": "24bd70bab9d94905aa18773de2555969",
        "rule_name": "Protect Critical App",
        "description": "Disable injection prevention for critical business application",
        "platform": "windows",
        "status": "active",
        "expiration_time": 1770445053461,
        "process_name": "criticalApp.exe",
        "path": "string",
        "created_by": "John Doe",
        "creation_time": 1770358653000,
        "is_global": false,
        "profile_ids": [
          96
        ]
      }
    ],
    "filter_count": 1,
    "total_count": 6
  }
}

Add Disable Injection and Prevention rule

post

Creates a new Disable Injection and Prevention rule to allow specific processes to bypass injection prevention.

This endpoint allows you to:

• Define a new rule with a unique name and description
• Specify the target platform (Windows, Linux, or macOS)
• Set the process name and path to be protected
• Configure expiration time
• Apply the rule globally or to specific profiles

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

Responses

200

OK

application/json

replystringOptional

Returns the Disable Injection and Prevention Rule ID.

Example: e35dcf2150b74d19ba354fbe871f978d

400

Bad Request

application/json

post/public_api/v1/disable_injection_prevention_rules/add

POST /public_api/v1/disable_injection_prevention_rules/add HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 312

{
  "request_data": {
    "rule_name": "Global Windows Exception",
    "description": "Allow injection for trusted Windows application across all endpoints",
    "platform": "windows",
    "process_name": "trustedapp.exe",
    "path": "C:\\Program Files\\TrustedApp\\trustedapp.exe",
    "hours_to_expiration": 24,
    "profile_ids": [
      96
    ],
    "scope": "profile"
  }
}

{
  "reply": "e35dcf2150b74d19ba354fbe871f978d"
}

Disable Disable Injection and Prevention Rules

post

Disables one or more existing Disable Injection and Prevention rules by their IDs.

This endpoint allows you to:

• Disable multiple rules in a single request
• Immediately stop rules from being applied

Header parameters

AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

Responses

200

OK

application/json

replystringOptional

Describes the success message.

Example: The selected rules were disabled

404

Not Found

application/json

post/public_api/v1/disable_injection_prevention_rules/disable

POST /public_api/v1/disable_injection_prevention_rules/disable HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 66

{
  "request_data": {
    "rule_ids": [
      "24bd70bab9d94905aa18773de2555969"
    ]
  }
}

{
  "reply": "The selected rules were disabled"
}