Rules

Operations for managing compliance rules

Add compliance rules to a compliance control

post

Add compliance rules to the specific compliance control.

Required license: Requires the Cortex Cloud Posture Management add-on.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Rules added successfully

application/json

successbooleanOptional

Whether the rules were added successfully

400

Bad request - invalid input parameters

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/add_rules_to_control

POST /public_api/v1/compliance/add_rules_to_control HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 594

{
  "request_data": {
    "control_id": "0b0b5354d06d43ffc3d7465858378135",
    "rules": [
      {
        "name": "Rule 1",
        "description": "Description 1",
        "type": "Identity",
        "logical_id": "2b16a9f3-260x2-4xsf0cc-a9091",
        "severity": "high",
        "scannable_assets": [
          "KUBERNETES_NODE"
        ],
        "remediation_steps": "Run the following command...",
        "generate_findings": true,
        "generate_issues": true,
        "generate_scan_logs": true
      },
      {
        "name": "Rule 2",
        "description": "Description 2",
        "type": "Identity",
        "logical_id": "2b16a9f3-cc2x602-4vvxXccXfn0c1",
        "scannable_assets": [
          "KUBERNETES_NODE"
        ],
        "generate_findings": false,
        "generate_issues": true,
        "generate_scan_logs": true
      }
    ]
  }
}

{
  "success": true
}

Delete rules from control

post

Remove specific rules from the specified compliance control.

Required license: Requires the Cortex Cloud Posture Management add-on.

Authorizations

x-xdr-auth-idstringRequired

API Key ID for authentication

AuthorizationstringRequired

API Key for authentication

Body

Responses

200

Rules deleted successfully

application/json

successbooleanOptional

Whether the rules were successfully deleted from the compliance control

400

Bad request - invalid input parameters

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/delete_rules_from_control

POST /public_api/v1/compliance/delete_rules_from_control HTTP/1.1
Host: api.xdr.us.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 112

{
  "request_data": {
    "control_id": "48e2f6a9cdc049479e3c6a8eda3bd161",
    "rules_ids": [
      "2b26a9f3-ca2x602-4vvxXccXf3c1"
    ]
  }
}

{
  "success": true
}