Unified Rules

Manage linked Cloud Security and AppSec rule pairs through a single unified endpoint.

List unified rules

get

Returns a paginated list of all unified rule pairs. Each item in the response contains both the linked AppSec and Cloud Security rule details.

The top-level id field in each result is always the AppSec rule ID. Use this ID for all subsequent GET, PUT, and DELETE operations on a specific unified rule.

Use the nextOffset field in the response to retrieve the next page of results. When nextOffset is null, there are no more results.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters

offsetnumber · doubleOptional

The number of unified rules to skip before returning results. Used for pagination together with limit. Set to 0 to start from the first result.

Default: 0

limitnumber · doubleOptional

The maximum number of unified rules to return per page. Used for pagination together with offset.

Default: 100

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

Ok. Returns a paginated list of unified rule pairs. Each item contains the linked AppSec and Cloud Security (CSPM) rule details.

application/json

A paginated list of unified rule pairs.

offsetnumber · doubleOptional

The number of unified rules skipped before the current page of results. Reflects the offset value from the request.

Example: 0

nextOffsetnumber · double · nullableOptional

The offset value to use in the next request to retrieve the next page of results. Returns null when there are no more results.

Example: 10

warningsstring[]Optional

A list of non-fatal warning messages generated during the list operation (for example, partial data availability from a downstream service).

get/public_api/appsec/v1/unified-rules

GET /public_api/appsec/v1/unified-rules HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*

200

Ok. Returns a paginated list of unified rule pairs. Each item contains the linked AppSec and Cloud Security (CSPM) rule details.

{
  "offset": 0,
  "nextOffset": 10,
  "items": [
    {
      "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
      "appsec": {
        "category": "COMPUTE",
        "cloudProvider": null,
        "createdAt": {
          "value": "2025-06-15T09:30:00.000Z"
        },
        "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
        "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.",
        "detectionMethod": "IaC Security",
        "domain": "POSTURE",
        "findingTypeId": 30040018,
        "frameworks": [
          {
            "definition": "metadata:\n  name: S3 bucket ACL restriction\n  category: compute\n  severity: high\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read\n",
            "definitionLink": null,
            "name": "TERRAFORM",
            "remediationDescription": null,
            "remediationIds": [],
            "resourceTypes": []
          }
        ],
        "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
        "isCustom": true,
        "isEnabled": true,
        "labels": [
          "storage",
          "iac-unified"
        ],
        "name": "S3 bucket ACL restriction",
        "owner": "CAS",
        "scanner": "IAC",
        "severity": "HIGH",
        "subCategory": "OVERPROVISIONED",
        "updatedAt": {
          "value": "2025-06-15T09:30:00.000Z"
        },
        "findingCategory": "Configuration",
        "findingDocs": "Custom IaC rule for Compute Overprovisioned",
        "mitreTactics": [],
        "mitreTechniques": [],
        "shortDescription": null,
        "complianceStandards": []
      },
      "cspm": {
        "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
        "name": "S3 bucket ACL restriction",
        "findingTypeId": 60100018,
        "description": "Detects S3 buckets with a public-read ACL.",
        "type": "config",
        "query": {
          "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'",
          "json": null,
          "rql": null
        },
        "assetTypes": [
          "S3 Bucket"
        ],
        "severity": "high",
        "enabled": false,
        "provider": [
          "aws"
        ],
        "labels": [
          "storage",
          "iac-unified"
        ],
        "systemDefault": false,
        "lastModifiedBy": "Public API - 1"
      },
      "warnings": []
    }
  ],
  "warnings": []
}

Create a unified rule

post

Creates a linked Cloud Security (CSPM) and AppSec rule pair in a single operation.

The endpoint first creates the Cloud Security rule through the Detection Rules API, then creates the AppSec rule with the Cloud Security rule ID cspmRuleId automatically injected to link the two rules. If the AppSec rule creation fails, the Cloud Security rule is automatically rolled back (deleted) to prevent orphaned rules.

Note: The cspmRuleId and shouldConnectToCspm fields are managed automatically by this endpoint. Do not include them in the appsec request body.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Body

The request body for creating a unified rule pair. Both the cspm and appsec rule definitions are required.

The endpoint creates the CSPM rule first, then creates the AppSec rule with the CSPM rule ID automatically injected to link the two rules. If the AppSec rule creation fails, the CSPM rule is automatically rolled back.

Responses

201

Created. The unified rule pair was created successfully. The top-level id field is the AppSec rule ID and serves as the primary identifier for all subsequent operations on this unified rule.

application/json

Represents a unified rule pair containing both the linked AppSec and CSPM rule objects.

idstringOptional

The primary identifier of the unified rule pair. This is always the AppSec rule ID. Use this value for all subsequent GET, PUT, and DELETE operations on this unified rule.

Example: APPSEC_CUSTOM_f3b7d9a1-8c42-4e6b-b1d5-92a7c4e8f103

warningsstring[]Optional

A list of non-fatal warning messages generated during the operation (for example, partial data availability from a downstream service).

400

Bad Request.

application/json

500

Internal Server Error.

application/json

503

Service Unavailable.

application/json

post/public_api/appsec/v1/unified-rules

POST /public_api/appsec/v1/unified-rules HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 967

{
  "cspm": {
    "name": "S3 bucket ACL restriction",
    "severity": "HIGH",
    "description": "Detects S3 buckets with a public-read ACL.",
    "providers": [
      "aws"
    ],
    "assetTypes": [
      "S3_BUCKET"
    ],
    "query": {
      "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'",
      "type": "config"
    },
    "metadata": {
      "issue": {
        "category": "Storage"
      }
    },
    "enabled": false,
    "labels": [
      "storage",
      "iac-unified"
    ]
  },
  "appsec": {
    "name": "S3 bucket ACL restriction",
    "severity": "HIGH",
    "scanner": "IAC",
    "category": "COMPUTE",
    "subCategory": "OVERPROVISIONED",
    "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.",
    "labels": [
      "storage",
      "iac-unified"
    ],
    "frameworks": [
      {
        "name": "TERRAFORM",
        "definition": "metadata:\n  name: S3 bucket ACL restriction\n  guidelines: Detects S3 buckets with a public-read ACL.\n  category: general\n  severity: HIGH\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read"
      }
    ]
  }
}

{
  "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "cspm": {
    "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
    "name": "S3 bucket ACL restriction",
    "type": "DETECTION",
    "query": {
      "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'",
      "type": "config"
    },
    "owner": "CSPM",
    "severity": "HIGH",
    "version": "2025.06.15.1234567890",
    "description": "Detects S3 buckets with a public-read ACL.",
    "deleted": false,
    "enabled": false,
    "systemDefault": false,
    "labels": [
      "storage",
      "iac-unified"
    ],
    "createdBy": "Public API - 1",
    "lastModifiedBy": "Public API - 1",
    "creationOn": 1749977400000,
    "lastModificationOn": 1749977400000,
    "providerType": "CLOUD",
    "providers": [
      "aws"
    ],
    "assetTypes": [
      "S3_BUCKET"
    ],
    "metadata": {
      "issue": {
        "category": "Storage"
      }
    },
    "complianceMetadata": []
  },
  "appsec": {
    "category": "COMPUTE",
    "cloudProvider": null,
    "createdAt": {
      "value": "2025-06-15T09:30:00.000Z"
    },
    "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
    "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.",
    "detectionMethod": "IaC Security",
    "domain": "POSTURE",
    "findingTypeId": 30040018,
    "frameworks": [
      {
        "definition": "metadata:\n  name: S3 bucket ACL restriction\n  guidelines: Detects S3 buckets with a public-read ACL.\n  category: compute\n  severity: high\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read\n",
        "definitionLink": null,
        "name": "TERRAFORM",
        "remediationDescription": null,
        "remediationIds": [],
        "resourceTypes": []
      },
      {
        "definition": "metadata:\n  name: S3 bucket ACL restriction\n  guidelines: Detects S3 buckets with a public-read ACL.\n  category: compute\n  severity: high\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read\n",
        "definitionLink": null,
        "name": "TERRAFORMPLAN",
        "remediationDescription": null,
        "remediationIds": [],
        "resourceTypes": []
      }
    ],
    "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "isCustom": true,
    "isEnabled": true,
    "labels": [
      "storage",
      "iac-unified"
    ],
    "name": "S3 bucket ACL restriction",
    "owner": "CAS",
    "scanner": "IAC",
    "severity": "HIGH",
    "subCategory": "OVERPROVISIONED",
    "updatedAt": {
      "value": "2025-06-15T09:30:00.000Z"
    },
    "findingCategory": "Configuration",
    "findingDocs": "Custom IaC rule for Compute Overprovisioned",
    "mitreTactics": [],
    "mitreTechniques": [],
    "shortDescription": null,
    "complianceStandards": []
  }
}

Get a unified rule

get

Returns the full details of a specific unified rule pair, including both the linked AppSec and Cloud Security (CSPM) rule objects.

The ruleId path parameter is the AppSec rule ID, which is the primary identifier for the unified rule pair. You can retrieve this value from the id field in the response of List unified rules.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters

ruleIdstringRequired

The unique identifier of the unified rule to retrieve. This is the AppSec rule ID, which serves as the primary identifier for the unified rule pair. You can retrieve this value from the id field in the response of List unified rules.

Example: appsec-rule-abc123

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

Ok. Returns the full details of the unified rule pair, including both the AppSec and CSPM rule objects.

application/json

Represents a unified rule pair containing both the linked AppSec and CSPM rule objects.

idstringOptional

The primary identifier of the unified rule pair. This is always the AppSec rule ID. Use this value for all subsequent GET, PUT, and DELETE operations on this unified rule.

Example: APPSEC_CUSTOM_f3b7d9a1-8c42-4e6b-b1d5-92a7c4e8f103

warningsstring[]Optional

A list of non-fatal warning messages generated during the operation (for example, partial data availability from a downstream service).

get/public_api/appsec/v1/unified-rules/{ruleId}

GET /public_api/appsec/v1/unified-rules/{ruleId} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*

200

Ok. Returns the full details of the unified rule pair, including both the AppSec and CSPM rule objects.

{
  "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "appsec": {
    "category": "COMPUTE",
    "cloudProvider": null,
    "createdAt": {
      "value": "2025-06-15T09:30:00.000Z"
    },
    "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
    "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.",
    "detectionMethod": "IaC Security",
    "domain": "POSTURE",
    "findingTypeId": 30040018,
    "frameworks": [
      {
        "definition": "metadata:\n  name: S3 bucket ACL restriction\n  category: compute\n  severity: high\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read\n",
        "definitionLink": null,
        "name": "TERRAFORM",
        "remediationDescription": null,
        "remediationIds": [],
        "resourceTypes": []
      },
      {
        "definition": "metadata:\n  name: S3 bucket ACL restriction\n  category: compute\n  severity: high\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read\n",
        "definitionLink": null,
        "name": "TERRAFORMPLAN",
        "remediationDescription": null,
        "remediationIds": [],
        "resourceTypes": []
      }
    ],
    "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "isCustom": true,
    "isEnabled": true,
    "labels": [
      "storage",
      "iac-unified"
    ],
    "name": "S3 bucket ACL restriction",
    "owner": "CAS",
    "scanner": "IAC",
    "severity": "HIGH",
    "subCategory": "OVERPROVISIONED",
    "updatedAt": {
      "value": "2025-06-15T09:30:00.000Z"
    },
    "findingCategory": "Configuration",
    "findingDocs": "Custom IaC rule for Compute Overprovisioned",
    "mitreTactics": [],
    "mitreTechniques": [],
    "shortDescription": null,
    "complianceStandards": []
  },
  "cspm": {
    "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
    "name": "S3 bucket ACL restriction",
    "findingTypeId": 60100018,
    "description": "Detects S3 buckets with a public-read ACL.",
    "type": "config",
    "query": {
      "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'",
      "json": null,
      "rql": null
    },
    "assetTypes": [
      "S3 Bucket"
    ],
    "severity": "high",
    "enabled": false,
    "provider": [
      "aws"
    ],
    "labels": [
      "storage",
      "iac-unified"
    ],
    "systemDefault": false,
    "lastModifiedBy": "Public API - 1"
  },
  "warnings": []
}

Update a unified rule

put

Updates one or both rules in a unified rule pair in a single request.

You can update only the AppSec rule, only the Cloud Security (CSPM) rule, or both simultaneously by including the respective rule object in the request body. Include only the fields you want to change — omitted fields are left unchanged.

The ruleId path parameter is the AppSec rule ID. You can retrieve this value from the id field in the response of List unified rules.

Partial failure handling: If one update succeeds and the other fails, the endpoint returns a 207 Multi-Status response with per-rule status details indicating which update succeeded and which failed.

Note: The cspmRuleId field on the AppSec rule cannot be changed through this endpoint. The CSPM link is managed by the unified rule system.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters

ruleIdstringRequired

The unique identifier of the unified rule to update. This is the AppSec rule ID, which serves as the primary identifier for the unified rule pair. You can retrieve this value from the id field in the response of List unified rules.

Example: appsec-rule-abc123

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Body

The request body for updating a unified rule pair. Include only the rule object or fields you want to update. You can update the CSPM rule, the AppSec rule, or both in a single request.

Responses

200

Ok. Both rules were updated successfully. Returns the updated unified rule pair.

application/json

Represents a unified rule pair containing both the linked AppSec and CSPM rule objects.

idstringOptional

The primary identifier of the unified rule pair. This is always the AppSec rule ID. Use this value for all subsequent GET, PUT, and DELETE operations on this unified rule.

Example: APPSEC_CUSTOM_f3b7d9a1-8c42-4e6b-b1d5-92a7c4e8f103

warningsstring[]Optional

A list of non-fatal warning messages generated during the operation (for example, partial data availability from a downstream service).

put/public_api/appsec/v1/unified-rules/{ruleId}

PUT /public_api/appsec/v1/unified-rules/{ruleId} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "appsec": {
    "labels": [
      "storage",
      "iac-unified",
      "reviewed"
    ]
  }
}

200

Ok. Both rules were updated successfully. Returns the updated unified rule pair.

{
  "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
  "appsec": {
    "category": "COMPUTE",
    "cloudProvider": null,
    "createdAt": {
      "value": "2025-06-15T09:30:00.000Z"
    },
    "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
    "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.",
    "detectionMethod": "IaC Security",
    "domain": "POSTURE",
    "findingTypeId": 30040018,
    "frameworks": [
      {
        "definition": "metadata:\n  name: S3 bucket ACL restriction\n  category: compute\n  severity: high\nscope:\n  provider: aws\ndefinition:\n  cond_type: attribute\n  resource_types:\n    - aws_s3_bucket\n  attribute: acl\n  operator: not_equals\n  value: public-read\n",
        "definitionLink": null,
        "name": "TERRAFORM",
        "remediationDescription": null,
        "remediationIds": [],
        "resourceTypes": []
      }
    ],
    "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "isCustom": true,
    "isEnabled": true,
    "labels": [
      "storage",
      "iac-unified",
      "reviewed"
    ],
    "name": "S3 bucket ACL restriction",
    "owner": "CAS",
    "scanner": "IAC",
    "severity": "HIGH",
    "subCategory": "OVERPROVISIONED",
    "updatedAt": {
      "value": "2025-06-15T10:15:00.000Z"
    },
    "findingCategory": "Configuration",
    "findingDocs": "Custom IaC rule for Compute Overprovisioned",
    "mitreTactics": [],
    "mitreTechniques": [],
    "shortDescription": null,
    "complianceStandards": []
  },
  "cspm": {
    "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde",
    "name": "S3 bucket ACL restriction",
    "findingTypeId": 60100018,
    "description": "Detects S3 buckets with a public-read ACL.",
    "type": "config",
    "query": {
      "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'",
      "json": null,
      "rql": null
    },
    "assetTypes": [
      "S3 Bucket"
    ],
    "severity": "high",
    "enabled": false,
    "provider": [
      "aws"
    ],
    "labels": [
      "storage",
      "iac-unified"
    ],
    "systemDefault": false,
    "lastModifiedBy": "Public API - 1"
  },
  "warnings": []
}

Delete a unified rule

delete

Deletes both the AppSec and Cloud Security rules in a unified rule pair in a single operation.

The ruleId path parameter is the AppSec rule ID. You can retrieve this value from the id field in the response of List unified rules.

Partial failure handling: The AppSec rule is always deleted first, followed by the linked Cloud Security rule. If the AppSec rule is deleted successfully but the subsequent Cloud Security rule deletion fails, the endpoint returns a 207 Multi-Status response with per-rule status details, and the Cloud Security rule may be left orphaned. There is no scenario where the Cloud Security rule is deleted but the AppSec rule deletion fails.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters

ruleIdstringRequired

The unique identifier of the unified rule to delete. This is the AppSec rule ID, which serves as the primary identifier for the unified rule pair. You can retrieve this value from the id field in the response of List unified rules.

Example: appsec-rule-abc123

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

204

Deleted. Both the AppSec and CSPM rules were deleted successfully. No content is returned.

No content

207

Multi-Status. The AppSec rule is always deleted first. This status is returned when the AppSec rule was deleted successfully but the subsequent Cloud Security rule deletion failed, potentially leaving the Cloud Security rule orphaned. The response body contains per-rule status details (success for appsec, failed for cspm).

application/json

404

Not Found

application/json

delete/public_api/appsec/v1/unified-rules/{ruleId}

DELETE /public_api/appsec/v1/unified-rules/{ruleId} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*

No content