> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/alert-notification-rules/models.md).

# Models

## The RuleCreateRequest object

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"RuleCreateRequest":{"type":"object","description":"Enumerates the rule creation request schema for Alert Notifications","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","forward_type"],"properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."}},"required":["distribution_list"],"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"required":["channels"],"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"required":["id"],"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the ```legacy_alert``` format is not permissible for Slack."}}}},"additionalProperties":false}}}}
````

## The Rule object

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"Rule":{"type":"object","description":"Enumerates the various attributes of an alert notification rule that is returned via numerous flows.","properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"rule_uuid":{"type":"string","description":"The unique identifier of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1,"items":{"type":"string"}},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes)."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."},"legacy_mail_format":{"type":"boolean","description":"This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)"}},"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack."},"created_by":{"type":"string","description":"This string indicates the user or api-key responsible for creating the notification rule."},"created_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was created."},"modified_at":{"type":"integer","format":"int64","description":"This value represents the timestamp when the notification rule was last modified."},"enabled":{"type":"boolean","default":true,"description":"A flag indicating whether the notification rule is currently active and enabled."}},"additionalProperties":false}}}}
````

## The RuleEditRequest object

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"RuleEditRequest":{"type":"object","description":"Enumerates the various attributes required for editing an existing notification rule","required":["request_data"],"properties":{"request_data":{"type":"object","required":["name","forward_type"],"properties":{"name":{"type":"string","description":"Name of the rule","minLength":1},"description":{"type":"string","description":"Optional description of the rule"},"forward_type":{"type":"string","description":"A required value from the LogForwardType Enum. It must be the same as its current forward_type as this field is not mutable during edits."},"filter":{"type":"object","items":{"type":"string"},"description":"An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.","minItems":1},"forward_source":{"type":"object","properties":{"email":{"type":"object","properties":{"distribution_list":{"type":"array","items":{"type":"string"},"description":"List of valid email addresses that will receive notifications forwarded by the given rule.","minItems":1},"aggregation":{"type":"integer","description":"An integer that is between 0 and 1440 (in minutes). The default is 10 minutes."},"custom_mail_subject":{"type":"string","description":"This string value allows the user to customize the mail subject of the event forwarded by the given rule."}},"required":["distribution_list"],"description":"An object containing all the information that configures email output for the given notification rule.","minItems":1},"slack":{"type":"object","properties":{"channels":{"type":"array","minItems":1,"items":{"type":"string"},"description":"List of valid Slack channels that will receive notifications forwarded by the given rule."}},"required":["channels"],"description":"An object containing all the information that configures Slack output for the given notification rule."},"syslog":{"type":"object","properties":{"id":{"type":"integer","description":"This string value that specifies the Syslog integration that will be associated with the given notification rule."}},"required":["id"],"description":"An object containing all the information that configures Syslog output for the given notification rule."}},"description":" This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs."},"applications":{"type":"array","description":"List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.","minItems":1,"items":{"type":"string"}},"time_zone":{"type":"string","default":"UTC","description":"This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```"},"mail_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"syslog_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI."},"slack_format":{"type":"string","default":"issue","description":"This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the ```legacy_alert``` format is not permissible for Slack."}}}},"additionalProperties":false}}}}
````

## The RuleStatusUpdateRequest object

```json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"RuleStatusUpdateRequest":{"type":"object","description":"Enumerates the various para meters required for updating the status of a rule","required":["request_data"],"properties":{"request_data":{"type":"object","required":["status"],"properties":{"status":{"type":"string","description":"Value of updated status {enable|disable}","minLength":1}}}},"additionalProperties":false}}}}
```

## The LogForwardType object

````json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"LogForwardType":{"type":"string","description":"The chosen log forwarding type  - Possible values: alert (Refers to ```Issues```  log type on the UI. It can be used with email, Slack, Syslog, AWS S3, AWS SQS, Splunk, and webhook), audit (Refers to ```Management Audit Logs``` log type on the UI. It can be used with email and Syslog), agent_audit (Refers to ```Agent Audit Logs``` log type on the UI. It can be used with email and Syslog), and case (Refers to ```Cases``` log type on the UI. It can be used with email, Slack, AWS S3, AWS SQS, Splunk, and webhook).","enum":["alert","audit","agent_audit","case"]}}}}
````

## The BaseFilterExample object

```json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"BaseFilterExample":{"type":"object","description":"Base filter object for log forwarding rules with nested logical conditions. The SEARCH_FIELD and SEARCH_VALUE parameters are in essence open-ended and context-dependent. The field names vary by data source, module, and UI context. The field values depend on the specific field type and business logic. Please refer to the Create/Edit Notification Rule page on the UI for the latest availability of options for these fields. This filter is constructed as a logical requirement that limits data to a specific subset. It begins with the \"filter\" object, which acts as the container for the entire rule. Inside, it uses an \"AND\" logic gate, represented as a list (the square brackets []). This structure is designed to hold one or multiple conditions that must all be true at the same time for a result to be shown.","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator."}}}}}}
```

## The ComplexFilterExample object

```json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"ComplexFilterExample":{"type":"object","description":"Complex filter object for log forwarding rules with nested logical conditions. It is best to view each set of inner brackets as nested logical statements. This filter operates as a broad \"OR\" gate that allows a record to pass if it satisfies any one of three distinct logical paths. The first path is a straightforward check for records where the whitelist status is set to false, while the second path independently looks for records where the alert name field is empty. The third path is a complex, multi-layered requirement that only triggers if a record simultaneously meets several specific criteria: it must have a status of \"Under Investigation,\" it must contain a valid device hash, and it must belong to a domain that is neither IT, Hunting, nor Health. By nesting these \"AND\" conditions within a primary \"OR\" structure, the filter is constructed to capture a wide net of general alerts while applying a highly specific set of exclusions for investigative data. The SEARCH_FIELD and SEARCH_VALUE parameters are in essence open-ended and context-dependent. The field names vary by data source, module, and UI context. The field values depend on the specific field type and business logic. Please refer to the Create/Edit Notification Rule page on the UI for the latest availability of options for these fields.","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator."}}}}}}
```

## The Metadata object

```json
{"openapi":"3.1.2","info":{"title":"Cortex XSIAM Alert Notification Rules REST APIs","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"Metadata":{"type":"object","description":"Metadata for the response","additionalProperties":true}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/alert-notification-rules/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.