> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/unified-rules/models.md). # Models ## The Severity object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"}}}} ``` ## The CloudProvider object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CloudProvider":{"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","ORACLE","OTHER"],"type":"string"}}}} ``` ## The Category object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Category":{"description":"The security category of an AppSec rule. Categories classify the type of security issue the rule detects.","enum":["AI_ML","API_KEYS","API_SECURITY","ACCESS_AUTH","ARTIFACT_INTEGRITY_VALIDATION","BUFFER","SUPPLY_CHAIN","CLOUD_SERVICE_PROVIDER_KEYS","COMPUTE","CONFIGURATION_DEPLOYMENT","CREDENTIAL_HYGIENE","CREDENTIALS_MGMT","CRYPTOGRAPHIC","DATA_EXPOSURE","DATA_PROTECTION","DATABASE_CREDENTIALS","DEPENDENCY_CHAINS","DESERIALIZATION","DRIFT","ENCRYPTION","ENCRYPTION_KEYS","ENVIRONMENT_VARIABLES","FLOW_CONTROL_MECHANISM","GENERAL","IAM","IDENTIFY_ACCESS_MANAGEMENT","IDENTITY_ACCESS_MANAGEMENT","INJECTION","INPUT_VALIDATION","KUBERNETES","LICENSES","LOGGING","LOGGING_AND_VISIBILITY","MONITORING","NETWORK_RISKS","NETWORKING","NON_PERMISSIVE","OTHER_SAST","PIPELINE_BASED_ACCESS_CONTROLS","PIPELINE_CONFIGURATION","PIPELINE_FLOW_CONTROL","POLICY3D","PPE","PUBLIC","PUBLIC_EXPOSURE","RESOURCE_MGMT","SCM_SYSTEM_CONFIGURATION","SSH_KEYS","SAST","SCA","SECRETS","SECURE_CODING","SENSITIVE_TOKENS","SESSION_MGMT","STORAGE","STRONG_COPYLEFT","SUPPLY CHAIN","SYSTEM_CONFIGURATION","THIRD_PARTY_SERVICES","TOOLS_OPERATIONAL_RISKS","VULNERABILITIES","WEAK_COPYLEFT"],"type":"string"}}}} ``` ## The Scanner object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Scanner":{"description":"The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["CICD","IAC","SAST","SCA","SECRETS"],"type":"string"}}}} ``` ## The CustomRuleScanner object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CustomRuleScanner":{"description":"The scanner type supported for custom AppSec rules. Only IaC and Secrets scanners support custom rule creation.\n- `IAC` — Infrastructure as Code security scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["IAC","SECRETS"],"type":"string"}}}} ``` ## The FrameworkName object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"FrameworkName":{"description":"The IaC framework or language that a rule definition applies to.","enum":["ANSIBLE","ARM","BICEP","CI_CD_AZURE_ORG","CI_CD_AZURE_REPO","CI_CD_BITBUCKET_ORG","CI_CD_BITBUCKET_REPO","CI_CD_CIMATCH","CI_CD_CIRCLE_CI","CI_CD_CROSS_SYSTEM","CI_CD_DEPPY","CI_CD_GITHUB_ORG","CI_CD_GITHUB_REPO","CI_CD_GITLAB_ORG","CI_CD_GITLAB_REPO","CI_CD_JENKINS_CI","CI_CD_SUPPLY_CHAIN_TOOLS","CLOUDFORMATION","DOCKERFILE","GIT","HELM","KUBERNETES","KUSTOMIZE","OPENAPI","SECRETS","SERVERLESS","TERRAFORM","TERRAFORMPLAN"],"type":"string"}}}} ``` ## The FindingCategory object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"FindingCategory":{"description":"The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.","enum":["Code","Configuration","Data","Vulnerability"],"type":"string"}}}} ``` ## The LocationInDeliveryChain object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"LocationInDeliveryChain":{"description":"Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.","enum":["BUILD","DEPENDENCIES","DEPLOY","DEV_SOURCE","DEVELOPMENT","Runtime","SOURCE"],"type":"string"}}}} ``` ## The CustomRuleIacCategory object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CustomRuleIacCategory":{"description":"The security category for a custom IaC rule.\n- `AI_ML` — AI and machine learning resource security.\n- `COMPUTE` — Compute resource security.\n- `IAM` — Identity and access management.\n- `KUBERNETES` — Kubernetes cluster security.\n- `LOGGING` — Logging and audit trail configuration.\n- `MONITORING` — Monitoring and alerting configuration.\n- `NETWORKING` — Network security and exposure.\n- `PUBLIC` — Public exposure of resources.\n- `STORAGE` — Storage resource security.","enum":["AI_ML","COMPUTE","IAM","KUBERNETES","LOGGING","MONITORING","NETWORKING","PUBLIC","STORAGE"],"type":"string"}}}} ``` ## The CustomRuleSecretsCategory object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CustomRuleSecretsCategory":{"description":"The security category for a custom Secrets rule.\n- `API_KEYS` — API key secrets.\n- `DATABASE_CREDENTIALS` — Database credential secrets.\n- `ENCRYPTION_KEYS` — Encryption key secrets.\n- `CLOUD_SERVICE_PROVIDER_KEYS` — Cloud provider access key secrets.\n- `SSH_KEYS` — SSH private key secrets.\n- `ENVIRONMENT_VARIABLES` — Secrets exposed in environment variables.\n- `SENSITIVE_TOKENS` — Sensitive authentication tokens.\n- `THIRD_PARTY_SERVICES` — Credentials for third-party services.","enum":["API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"],"type":"string"}}}} ``` ## The CustomRuleCategory object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CustomRuleCategory":{"description":"The security category for a custom AppSec rule. The accepted values depend on the scanner type: use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.","anyOf":[{"$ref":"#/components/schemas/CustomRuleIacCategory"},{"$ref":"#/components/schemas/CustomRuleSecretsCategory"}]},"CustomRuleIacCategory":{"description":"The security category for a custom IaC rule.\n- `AI_ML` — AI and machine learning resource security.\n- `COMPUTE` — Compute resource security.\n- `IAM` — Identity and access management.\n- `KUBERNETES` — Kubernetes cluster security.\n- `LOGGING` — Logging and audit trail configuration.\n- `MONITORING` — Monitoring and alerting configuration.\n- `NETWORKING` — Network security and exposure.\n- `PUBLIC` — Public exposure of resources.\n- `STORAGE` — Storage resource security.","enum":["AI_ML","COMPUTE","IAM","KUBERNETES","LOGGING","MONITORING","NETWORKING","PUBLIC","STORAGE"],"type":"string"},"CustomRuleSecretsCategory":{"description":"The security category for a custom Secrets rule.\n- `API_KEYS` — API key secrets.\n- `DATABASE_CREDENTIALS` — Database credential secrets.\n- `ENCRYPTION_KEYS` — Encryption key secrets.\n- `CLOUD_SERVICE_PROVIDER_KEYS` — Cloud provider access key secrets.\n- `SSH_KEYS` — SSH private key secrets.\n- `ENVIRONMENT_VARIABLES` — Secrets exposed in environment variables.\n- `SENSITIVE_TOKENS` — Sensitive authentication tokens.\n- `THIRD_PARTY_SERVICES` — Credentials for third-party services.","enum":["API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"],"type":"string"}}}} ``` ## The CustomRuleIacSubCategory object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CustomRuleIacSubCategory":{"description":"The subcategory that further classifies the type of security issue within an IaC rule category. Subcategories are only applicable to `IAC` scanner rules.","enum":["ACCESS_CONTROL","ADMIN_INTERFACES","ALERTING","ALERTING_AND_NOTIFICATIONS","APIS","AUTHENTICATION_POLICIES","BACKUPS","CREDENTIAL_EXPOSURE","DATABASE_ENDPOINTS","DEFAULT_CREDENTIALS_OR_AUTH","DISABLED_OR_MISSING","EGRESS_CONTROLS","ENCRYPTION","ENCRYPTION_AND_PROTOCOLS","EXPIRED_KEY_CONTROLS","FLOW_LOGS","FORMATS","GUARDRAILS","INGRESS_CONTROLS","LOAD_BALANCING","LOGGING_AND_MONITORING","MANAGEMENT_SERVICES_EXPOSURE","MFA","NATIVE_SECURITY_CONTROLS","NETWORK_POLICIES","OVERPROVISIONED","OVERLY_PERMISSIVE","PERFORMANCE_MONITORING","PERMISSIONS","PUBLIC_EXPOSURE","REDUNDANCY","REPLICATION","RESOURCE_HEALTH","RESOURCE_MANAGEMENT","RETENTION","RISKY_MODELS","ROLE_SEPARATION","SENSITIVE_PORTS","SHARED","STARTUP_SCRIPT_LEAKS","STORAGE","STORAGE_BUCKETS","TAGS_AND_METADATA","UNDER_USE","UNINTEGRATED","UNSANCTIONED_RESOURCE_OR_TYPE","UNUSED","VERSIONING","VPC_VCN_VNET"],"type":"string"}}}} ``` ## The Record\_string.unknown\_ object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The Control object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false}}}} ``` ## The ComplianceStandard object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"ComplianceStandard":{"description":"Represents a compliance standard and its associated controls that a rule maps to.","properties":{"controls":{"items":{"$ref":"#/components/schemas/Control"},"type":"array","description":"The list of compliance controls within this standard that the rule satisfies."},"standardName":{"type":"string","description":"The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)."}},"required":["controls","standardName"],"type":"object","additionalProperties":false},"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false}}}} ``` ## The RuleFramework object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"RuleFramework":{"description":"Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`)."},"definition":{"type":"string","nullable":true,"description":"The YAML or structured rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to the external definition or documentation for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."},"remediationIds":{"items":{"type":"string"},"type":"array","nullable":true,"description":"A list of remediation identifiers that link to automated fix actions for this framework."},"resourceTypes":{"items":{"type":"string"},"type":"array","nullable":true,"description":"The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)."}},"required":["name"],"type":"object","additionalProperties":false}}}} ``` ## The FrameworkRequestParams object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"FrameworkRequestParams":{"description":"The framework-specific definition for a custom AppSec rule, including the detection logic and remediation guidance.","properties":{"name":{"description":"The IaC framework or language this definition applies to.","allOf":[{"$ref":"#/components/schemas/FrameworkName"}]},"definition":{"type":"string","nullable":true,"description":"The YAML rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to an external definition for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."}},"required":["name"],"type":"object","additionalProperties":false},"FrameworkName":{"description":"The IaC framework or language that a rule definition applies to.","enum":["ANSIBLE","ARM","BICEP","CI_CD_AZURE_ORG","CI_CD_AZURE_REPO","CI_CD_BITBUCKET_ORG","CI_CD_BITBUCKET_REPO","CI_CD_CIMATCH","CI_CD_CIRCLE_CI","CI_CD_CROSS_SYSTEM","CI_CD_DEPPY","CI_CD_GITHUB_ORG","CI_CD_GITHUB_REPO","CI_CD_GITLAB_ORG","CI_CD_GITLAB_REPO","CI_CD_JENKINS_CI","CI_CD_SUPPLY_CHAIN_TOOLS","CLOUDFORMATION","DOCKERFILE","GIT","HELM","KUBERNETES","KUSTOMIZE","OPENAPI","SECRETS","SERVERLESS","TERRAFORM","TERRAFORMPLAN"],"type":"string"}}}} ``` ## The CspmQuery object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CspmQuery":{"description":"The query definition used by a CSPM rule to evaluate cloud resources. Supports multiple query formats — provide at least one.","properties":{"type":{"type":"string","description":"The query type that determines how the query is evaluated (for example, `Config`, `Network`, `Event`)."},"rql":{"type":"string","description":"The RQL (Resource Query Language) query string used to evaluate cloud resources in Prisma Cloud (for example, `config where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-encryption'`)."},"xql":{"type":"string","description":"The XQL (Cortex Query Language) query string used to evaluate cloud resources."},"json":{"description":"The query expressed as a structured JSON object.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"prisma_json":{"description":"The query expressed as a structured JSON object in Prisma Cloud format.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]}},"type":"object","additionalProperties":{}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The CspmRule object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CspmRule":{"description":"Represents Cloud Security rule that detects misconfigurations in deployed cloud infrastructure at runtime.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule."},"type":{"type":"string","description":"The type classification of the CSPM rule (for example, `Config` or `Network`)."},"name":{"type":"string","description":"Human-readable display name of the CSPM rule."},"severity":{"type":"string","description":"The priority level assigned to findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The team or system that owns and maintains this CSPM rule."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"enabled":{"type":"boolean","description":"Indicates whether the CSPM rule is currently active. When `true`, the rule is enabled."},"deleted":{"type":"boolean","description":"Indicates whether the CSPM rule has been soft-deleted. When `true`, the rule is no longer active but its record is retained."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided out-of-the-box rule (`true`) or a custom user-created rule (`false`)."},"assetTypes":{"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`).","items":{"type":"string"}},"providers":{"type":"array","description":"The cloud providers associated with this CSPM rule (for example, `AWS`, `Azure`, `GCP`).","items":{"type":"string"}},"labels":{"type":"array","description":"User-defined labels assigned to the CSPM rule for organization and filtering.","items":{"type":"string"}},"complianceMetadata":{"type":"array","description":"Compliance framework metadata associated with this rule, such as control IDs and standard names.","items":{"$ref":"#/components/schemas/Record_string.unknown_"}},"metadata":{"description":"Additional key-value metadata associated with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The query definition used by the CSPM rule to evaluate cloud resources.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username or identifier of the user who last modified this CSPM rule."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The PublicDetectionRule object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"PublicDetectionRule":{"description":"Represents an AppSec detection rule that identifies security issues in code, IaC configurations, secrets, or CI/CD pipelines.","type":"object","additionalProperties":false,"properties":{"category":{"type":"string","description":"The security category of the rule."},"cloudProvider":{"allOf":[{"$ref":"#/components/schemas/CloudProvider"}],"nullable":true,"description":"The cloud provider associated with this rule."},"createdAt":{"type":"string","format":"date-time","description":"The date and time when the rule was created, in ISO 8601 format."},"cspmRuleId":{"type":"string","description":"The unique identifier of the linked CSPM rule. Present when this AppSec rule is part of a unified rule pair.","nullable":true},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"detectionMethod":{"type":"string","description":"The detection method used by the rule (for example, `IaC Security`, `Secrets Security`)."},"domain":{"type":"string","description":"The security domain the rule belongs to (for example, `POSTURE`, `APPLICATION`)."},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule."},"frameworks":{"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions.","nullable":true,"items":{"$ref":"#/components/schemas/RuleFramework"}},"id":{"type":"string","description":"Unique identifier of the AppSec detection rule."},"isCustom":{"type":"boolean","description":"Indicates whether this is a custom user-created rule (`true`) or a system-provided out-of-the-box rule (`false`)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active. When `true`, the rule is enabled."},"labels":{"type":"array","description":"User-defined labels assigned to the rule for organization and filtering.","items":{"type":"string"}},"name":{"type":"string","description":"Name of the AppSec rule."},"owner":{"type":"string","description":"The team or system that owns and maintains this rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"The subcategory that further classifies the type of security issue within the rule's category."},"updatedAt":{"type":"string","format":"date-time","description":"The date and time when the rule was last updated, in ISO 8601 format."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string","description":"A URL or reference to documentation describing the finding type and remediation guidance."},"cspmTypeId":{"type":"number","format":"double","description":"The numeric type identifier of the linked CSPM rule.","nullable":true},"complianceStandards":{"type":"array","description":"The compliance standards and controls that this rule maps to.","items":{"$ref":"#/components/schemas/ComplianceStandard"}},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactics associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK techniques associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"shortDescription":{"type":"string","description":"A brief one-line summary of what the rule detects.","nullable":true},"locationInDeliveryChain":{"allOf":[{"$ref":"#/components/schemas/LocationInDeliveryChain"}],"nullable":true,"description":"The SDLC stage where this rule applies."},"clonedFrom":{"type":"string","description":"The name of the original rule that this rule was cloned from, if applicable."},"scannerRuleId":{"type":"string","description":"The unique identifier of the rule within the scanner system."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the original rule that this rule was cloned from, if applicable."},"docLink":{"type":"string","deprecated":true,"description":"Deprecated. A URL linking to the rule's documentation. Use `findingDocs` instead.","nullable":true}}},"CloudProvider":{"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","ORACLE","OTHER"],"type":"string"},"RuleFramework":{"description":"Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`)."},"definition":{"type":"string","nullable":true,"description":"The YAML or structured rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to the external definition or documentation for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."},"remediationIds":{"items":{"type":"string"},"type":"array","nullable":true,"description":"A list of remediation identifiers that link to automated fix actions for this framework."},"resourceTypes":{"items":{"type":"string"},"type":"array","nullable":true,"description":"The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)."}},"required":["name"],"type":"object","additionalProperties":false},"Scanner":{"description":"The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["CICD","IAC","SAST","SCA","SECRETS"],"type":"string"},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"FindingCategory":{"description":"The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.","enum":["Code","Configuration","Data","Vulnerability"],"type":"string"},"ComplianceStandard":{"description":"Represents a compliance standard and its associated controls that a rule maps to.","properties":{"controls":{"items":{"$ref":"#/components/schemas/Control"},"type":"array","description":"The list of compliance controls within this standard that the rule satisfies."},"standardName":{"type":"string","description":"The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)."}},"required":["controls","standardName"],"type":"object","additionalProperties":false},"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false},"LocationInDeliveryChain":{"description":"Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.","enum":["BUILD","DEPENDENCIES","DEPLOY","DEV_SOURCE","DEVELOPMENT","Runtime","SOURCE"],"type":"string"}}}} ``` ## The PublicUnifiedRuleResponse object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"PublicUnifiedRuleResponse":{"description":"Represents a unified rule pair containing both the linked AppSec and CSPM rule objects.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"The primary identifier of the unified rule pair. This is always the **AppSec rule ID**. Use this value for all subsequent GET, PUT, and DELETE operations on this unified rule."},"appsec":{"$ref":"#/components/schemas/PublicDetectionRule"},"cspm":{"$ref":"#/components/schemas/CspmRule"},"warnings":{"type":"array","description":"A list of non-fatal warning messages generated during the operation (for example, partial data availability from a downstream service).","items":{"type":"string"}}}},"PublicDetectionRule":{"description":"Represents an AppSec detection rule that identifies security issues in code, IaC configurations, secrets, or CI/CD pipelines.","type":"object","additionalProperties":false,"properties":{"category":{"type":"string","description":"The security category of the rule."},"cloudProvider":{"allOf":[{"$ref":"#/components/schemas/CloudProvider"}],"nullable":true,"description":"The cloud provider associated with this rule."},"createdAt":{"type":"string","format":"date-time","description":"The date and time when the rule was created, in ISO 8601 format."},"cspmRuleId":{"type":"string","description":"The unique identifier of the linked CSPM rule. Present when this AppSec rule is part of a unified rule pair.","nullable":true},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"detectionMethod":{"type":"string","description":"The detection method used by the rule (for example, `IaC Security`, `Secrets Security`)."},"domain":{"type":"string","description":"The security domain the rule belongs to (for example, `POSTURE`, `APPLICATION`)."},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule."},"frameworks":{"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions.","nullable":true,"items":{"$ref":"#/components/schemas/RuleFramework"}},"id":{"type":"string","description":"Unique identifier of the AppSec detection rule."},"isCustom":{"type":"boolean","description":"Indicates whether this is a custom user-created rule (`true`) or a system-provided out-of-the-box rule (`false`)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active. When `true`, the rule is enabled."},"labels":{"type":"array","description":"User-defined labels assigned to the rule for organization and filtering.","items":{"type":"string"}},"name":{"type":"string","description":"Name of the AppSec rule."},"owner":{"type":"string","description":"The team or system that owns and maintains this rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"The subcategory that further classifies the type of security issue within the rule's category."},"updatedAt":{"type":"string","format":"date-time","description":"The date and time when the rule was last updated, in ISO 8601 format."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string","description":"A URL or reference to documentation describing the finding type and remediation guidance."},"cspmTypeId":{"type":"number","format":"double","description":"The numeric type identifier of the linked CSPM rule.","nullable":true},"complianceStandards":{"type":"array","description":"The compliance standards and controls that this rule maps to.","items":{"$ref":"#/components/schemas/ComplianceStandard"}},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactics associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK techniques associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"shortDescription":{"type":"string","description":"A brief one-line summary of what the rule detects.","nullable":true},"locationInDeliveryChain":{"allOf":[{"$ref":"#/components/schemas/LocationInDeliveryChain"}],"nullable":true,"description":"The SDLC stage where this rule applies."},"clonedFrom":{"type":"string","description":"The name of the original rule that this rule was cloned from, if applicable."},"scannerRuleId":{"type":"string","description":"The unique identifier of the rule within the scanner system."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the original rule that this rule was cloned from, if applicable."},"docLink":{"type":"string","deprecated":true,"description":"Deprecated. A URL linking to the rule's documentation. Use `findingDocs` instead.","nullable":true}}},"CloudProvider":{"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","ORACLE","OTHER"],"type":"string"},"RuleFramework":{"description":"Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`)."},"definition":{"type":"string","nullable":true,"description":"The YAML or structured rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to the external definition or documentation for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."},"remediationIds":{"items":{"type":"string"},"type":"array","nullable":true,"description":"A list of remediation identifiers that link to automated fix actions for this framework."},"resourceTypes":{"items":{"type":"string"},"type":"array","nullable":true,"description":"The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)."}},"required":["name"],"type":"object","additionalProperties":false},"Scanner":{"description":"The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["CICD","IAC","SAST","SCA","SECRETS"],"type":"string"},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"FindingCategory":{"description":"The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.","enum":["Code","Configuration","Data","Vulnerability"],"type":"string"},"ComplianceStandard":{"description":"Represents a compliance standard and its associated controls that a rule maps to.","properties":{"controls":{"items":{"$ref":"#/components/schemas/Control"},"type":"array","description":"The list of compliance controls within this standard that the rule satisfies."},"standardName":{"type":"string","description":"The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)."}},"required":["controls","standardName"],"type":"object","additionalProperties":false},"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false},"LocationInDeliveryChain":{"description":"Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.","enum":["BUILD","DEPENDENCIES","DEPLOY","DEV_SOURCE","DEVELOPMENT","Runtime","SOURCE"],"type":"string"},"CspmRule":{"description":"Represents Cloud Security rule that detects misconfigurations in deployed cloud infrastructure at runtime.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule."},"type":{"type":"string","description":"The type classification of the CSPM rule (for example, `Config` or `Network`)."},"name":{"type":"string","description":"Human-readable display name of the CSPM rule."},"severity":{"type":"string","description":"The priority level assigned to findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The team or system that owns and maintains this CSPM rule."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"enabled":{"type":"boolean","description":"Indicates whether the CSPM rule is currently active. When `true`, the rule is enabled."},"deleted":{"type":"boolean","description":"Indicates whether the CSPM rule has been soft-deleted. When `true`, the rule is no longer active but its record is retained."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided out-of-the-box rule (`true`) or a custom user-created rule (`false`)."},"assetTypes":{"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`).","items":{"type":"string"}},"providers":{"type":"array","description":"The cloud providers associated with this CSPM rule (for example, `AWS`, `Azure`, `GCP`).","items":{"type":"string"}},"labels":{"type":"array","description":"User-defined labels assigned to the CSPM rule for organization and filtering.","items":{"type":"string"}},"complianceMetadata":{"type":"array","description":"Compliance framework metadata associated with this rule, such as control IDs and standard names.","items":{"$ref":"#/components/schemas/Record_string.unknown_"}},"metadata":{"description":"Additional key-value metadata associated with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The query definition used by the CSPM rule to evaluate cloud resources.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username or identifier of the user who last modified this CSPM rule."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The PublicUnifiedRuleListResponse object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"PublicUnifiedRuleListResponse":{"description":"A paginated list of unified rule pairs.","type":"object","additionalProperties":false,"properties":{"offset":{"type":"number","format":"double","description":"The number of unified rules skipped before the current page of results. Reflects the `offset` value from the request."},"nextOffset":{"type":"number","format":"double","description":"The offset value to use in the next request to retrieve the next page of results. Returns `null` when there are no more results.","nullable":true},"items":{"type":"array","description":"The list of unified rule pairs returned for the current page.","items":{"$ref":"#/components/schemas/PublicUnifiedRuleResponse"}},"warnings":{"type":"array","description":"A list of non-fatal warning messages generated during the list operation (for example, partial data availability from a downstream service).","items":{"type":"string"}}}},"PublicUnifiedRuleResponse":{"description":"Represents a unified rule pair containing both the linked AppSec and CSPM rule objects.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"The primary identifier of the unified rule pair. This is always the **AppSec rule ID**. Use this value for all subsequent GET, PUT, and DELETE operations on this unified rule."},"appsec":{"$ref":"#/components/schemas/PublicDetectionRule"},"cspm":{"$ref":"#/components/schemas/CspmRule"},"warnings":{"type":"array","description":"A list of non-fatal warning messages generated during the operation (for example, partial data availability from a downstream service).","items":{"type":"string"}}}},"PublicDetectionRule":{"description":"Represents an AppSec detection rule that identifies security issues in code, IaC configurations, secrets, or CI/CD pipelines.","type":"object","additionalProperties":false,"properties":{"category":{"type":"string","description":"The security category of the rule."},"cloudProvider":{"allOf":[{"$ref":"#/components/schemas/CloudProvider"}],"nullable":true,"description":"The cloud provider associated with this rule."},"createdAt":{"type":"string","format":"date-time","description":"The date and time when the rule was created, in ISO 8601 format."},"cspmRuleId":{"type":"string","description":"The unique identifier of the linked CSPM rule. Present when this AppSec rule is part of a unified rule pair.","nullable":true},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"detectionMethod":{"type":"string","description":"The detection method used by the rule (for example, `IaC Security`, `Secrets Security`)."},"domain":{"type":"string","description":"The security domain the rule belongs to (for example, `POSTURE`, `APPLICATION`)."},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule."},"frameworks":{"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions.","nullable":true,"items":{"$ref":"#/components/schemas/RuleFramework"}},"id":{"type":"string","description":"Unique identifier of the AppSec detection rule."},"isCustom":{"type":"boolean","description":"Indicates whether this is a custom user-created rule (`true`) or a system-provided out-of-the-box rule (`false`)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active. When `true`, the rule is enabled."},"labels":{"type":"array","description":"User-defined labels assigned to the rule for organization and filtering.","items":{"type":"string"}},"name":{"type":"string","description":"Name of the AppSec rule."},"owner":{"type":"string","description":"The team or system that owns and maintains this rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"The subcategory that further classifies the type of security issue within the rule's category."},"updatedAt":{"type":"string","format":"date-time","description":"The date and time when the rule was last updated, in ISO 8601 format."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string","description":"A URL or reference to documentation describing the finding type and remediation guidance."},"cspmTypeId":{"type":"number","format":"double","description":"The numeric type identifier of the linked CSPM rule.","nullable":true},"complianceStandards":{"type":"array","description":"The compliance standards and controls that this rule maps to.","items":{"$ref":"#/components/schemas/ComplianceStandard"}},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactics associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK techniques associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"shortDescription":{"type":"string","description":"A brief one-line summary of what the rule detects.","nullable":true},"locationInDeliveryChain":{"allOf":[{"$ref":"#/components/schemas/LocationInDeliveryChain"}],"nullable":true,"description":"The SDLC stage where this rule applies."},"clonedFrom":{"type":"string","description":"The name of the original rule that this rule was cloned from, if applicable."},"scannerRuleId":{"type":"string","description":"The unique identifier of the rule within the scanner system."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the original rule that this rule was cloned from, if applicable."},"docLink":{"type":"string","deprecated":true,"description":"Deprecated. A URL linking to the rule's documentation. Use `findingDocs` instead.","nullable":true}}},"CloudProvider":{"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","ORACLE","OTHER"],"type":"string"},"RuleFramework":{"description":"Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`)."},"definition":{"type":"string","nullable":true,"description":"The YAML or structured rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to the external definition or documentation for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."},"remediationIds":{"items":{"type":"string"},"type":"array","nullable":true,"description":"A list of remediation identifiers that link to automated fix actions for this framework."},"resourceTypes":{"items":{"type":"string"},"type":"array","nullable":true,"description":"The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)."}},"required":["name"],"type":"object","additionalProperties":false},"Scanner":{"description":"The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["CICD","IAC","SAST","SCA","SECRETS"],"type":"string"},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"FindingCategory":{"description":"The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.","enum":["Code","Configuration","Data","Vulnerability"],"type":"string"},"ComplianceStandard":{"description":"Represents a compliance standard and its associated controls that a rule maps to.","properties":{"controls":{"items":{"$ref":"#/components/schemas/Control"},"type":"array","description":"The list of compliance controls within this standard that the rule satisfies."},"standardName":{"type":"string","description":"The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)."}},"required":["controls","standardName"],"type":"object","additionalProperties":false},"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false},"LocationInDeliveryChain":{"description":"Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.","enum":["BUILD","DEPENDENCIES","DEPLOY","DEV_SOURCE","DEVELOPMENT","Runtime","SOURCE"],"type":"string"},"CspmRule":{"description":"Represents Cloud Security rule that detects misconfigurations in deployed cloud infrastructure at runtime.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule."},"type":{"type":"string","description":"The type classification of the CSPM rule (for example, `Config` or `Network`)."},"name":{"type":"string","description":"Human-readable display name of the CSPM rule."},"severity":{"type":"string","description":"The priority level assigned to findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The team or system that owns and maintains this CSPM rule."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"enabled":{"type":"boolean","description":"Indicates whether the CSPM rule is currently active. When `true`, the rule is enabled."},"deleted":{"type":"boolean","description":"Indicates whether the CSPM rule has been soft-deleted. When `true`, the rule is no longer active but its record is retained."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided out-of-the-box rule (`true`) or a custom user-created rule (`false`)."},"assetTypes":{"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`).","items":{"type":"string"}},"providers":{"type":"array","description":"The cloud providers associated with this CSPM rule (for example, `AWS`, `Azure`, `GCP`).","items":{"type":"string"}},"labels":{"type":"array","description":"User-defined labels assigned to the CSPM rule for organization and filtering.","items":{"type":"string"}},"complianceMetadata":{"type":"array","description":"Compliance framework metadata associated with this rule, such as control IDs and standard names.","items":{"$ref":"#/components/schemas/Record_string.unknown_"}},"metadata":{"description":"Additional key-value metadata associated with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The query definition used by the CSPM rule to evaluate cloud resources.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username or identifier of the user who last modified this CSPM rule."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The UnifiedRuleErrorCode object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"UnifiedRuleErrorCode":{"type":"string","description":"A machine-readable error code indicating the specific failure that occurred during a unified rule operation.\n- `CSPM_CREATE_FAILED` — The CSPM rule creation failed. No rollback is needed.\n- `APPSEC_CREATE_FAILED` — The AppSec rule creation failed after the CSPM rule was created. An automatic rollback of the CSPM rule was attempted.\n- `APPSEC_VALIDATION_FAILED` — The AppSec rule request body failed validation. No rules were created.\n- `ROLLBACK_FAILED` — The automatic rollback of the CSPM rule failed after an AppSec creation error. The CSPM rule may be orphaned. Check `orphanedCspmRuleId` for the ID to clean up manually.\n- `ORPHANED_CSPM_RULE` — A CSPM rule exists without a linked AppSec rule.","enum":["CSPM_CREATE_FAILED","APPSEC_CREATE_FAILED","APPSEC_VALIDATION_FAILED","ROLLBACK_FAILED","ORPHANED_CSPM_RULE"]}}}} ``` ## The UnifiedRuleErrorPayload object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"UnifiedRuleErrorPayload":{"description":"The error response body returned when a unified rule operation fails.","properties":{"error":{"type":"string","description":"A human-readable message describing the error that occurred."},"code":{"description":"A machine-readable error code identifying the specific failure type.","allOf":[{"$ref":"#/components/schemas/UnifiedRuleErrorCode"}]},"orphanedCspmRuleId":{"type":"string","description":"The ID of the CSPM rule that was created but could not be rolled back. Present only when `code` is `ROLLBACK_FAILED` or `ORPHANED_CSPM_RULE`. Use this ID to manually delete the orphaned CSPM rule."},"details":{"description":"Additional structured details about the error, if available."},"retriable":{"type":"boolean","description":"Indicates whether the failed operation can be safely retried. When `true`, the error is transient and retrying the request may succeed."}},"required":["error","code"],"type":"object","additionalProperties":false},"UnifiedRuleErrorCode":{"type":"string","description":"A machine-readable error code indicating the specific failure that occurred during a unified rule operation.\n- `CSPM_CREATE_FAILED` — The CSPM rule creation failed. No rollback is needed.\n- `APPSEC_CREATE_FAILED` — The AppSec rule creation failed after the CSPM rule was created. An automatic rollback of the CSPM rule was attempted.\n- `APPSEC_VALIDATION_FAILED` — The AppSec rule request body failed validation. No rules were created.\n- `ROLLBACK_FAILED` — The automatic rollback of the CSPM rule failed after an AppSec creation error. The CSPM rule may be orphaned. Check `orphanedCspmRuleId` for the ID to clean up manually.\n- `ORPHANED_CSPM_RULE` — A CSPM rule exists without a linked AppSec rule.","enum":["CSPM_CREATE_FAILED","APPSEC_CREATE_FAILED","APPSEC_VALIDATION_FAILED","ROLLBACK_FAILED","ORPHANED_CSPM_RULE"]}}}} ``` ## The ModuleResult\_PublicDetectionRule\_ object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"ModuleResult_PublicDetectionRule_":{"description":"The per-rule result for the AppSec rule in a multi-status operation (such as a partial update or partial delete). Indicates whether the AppSec rule operation succeeded, failed, or was skipped.","anyOf":[{"description":"The AppSec rule operation completed successfully.","properties":{"status":{"type":"string","enum":["success"],"nullable":false,"description":"Indicates the AppSec rule operation completed successfully."},"rule":{"description":"The updated AppSec rule object. Present only when `status` is `success`.","allOf":[{"$ref":"#/components/schemas/PublicDetectionRule"}]}},"required":["status","rule"],"type":"object"},{"description":"The AppSec rule operation failed.","properties":{"status":{"type":"string","enum":["failed"],"nullable":false,"description":"Indicates the AppSec rule operation failed."},"error":{"type":"string","description":"A human-readable message describing why the AppSec rule operation failed."}},"required":["status","error"],"type":"object"},{"description":"The AppSec rule operation was skipped because no AppSec fields were included in the request.","properties":{"status":{"type":"string","enum":["skipped"],"nullable":false,"description":"Indicates the AppSec rule operation was skipped (for example, because no AppSec fields were included in the update request)."}},"required":["status"],"type":"object"}]},"PublicDetectionRule":{"description":"Represents an AppSec detection rule that identifies security issues in code, IaC configurations, secrets, or CI/CD pipelines.","type":"object","additionalProperties":false,"properties":{"category":{"type":"string","description":"The security category of the rule."},"cloudProvider":{"allOf":[{"$ref":"#/components/schemas/CloudProvider"}],"nullable":true,"description":"The cloud provider associated with this rule."},"createdAt":{"type":"string","format":"date-time","description":"The date and time when the rule was created, in ISO 8601 format."},"cspmRuleId":{"type":"string","description":"The unique identifier of the linked CSPM rule. Present when this AppSec rule is part of a unified rule pair.","nullable":true},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"detectionMethod":{"type":"string","description":"The detection method used by the rule (for example, `IaC Security`, `Secrets Security`)."},"domain":{"type":"string","description":"The security domain the rule belongs to (for example, `POSTURE`, `APPLICATION`)."},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule."},"frameworks":{"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions.","nullable":true,"items":{"$ref":"#/components/schemas/RuleFramework"}},"id":{"type":"string","description":"Unique identifier of the AppSec detection rule."},"isCustom":{"type":"boolean","description":"Indicates whether this is a custom user-created rule (`true`) or a system-provided out-of-the-box rule (`false`)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active. When `true`, the rule is enabled."},"labels":{"type":"array","description":"User-defined labels assigned to the rule for organization and filtering.","items":{"type":"string"}},"name":{"type":"string","description":"Name of the AppSec rule."},"owner":{"type":"string","description":"The team or system that owns and maintains this rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"The subcategory that further classifies the type of security issue within the rule's category."},"updatedAt":{"type":"string","format":"date-time","description":"The date and time when the rule was last updated, in ISO 8601 format."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string","description":"A URL or reference to documentation describing the finding type and remediation guidance."},"cspmTypeId":{"type":"number","format":"double","description":"The numeric type identifier of the linked CSPM rule.","nullable":true},"complianceStandards":{"type":"array","description":"The compliance standards and controls that this rule maps to.","items":{"$ref":"#/components/schemas/ComplianceStandard"}},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactics associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK techniques associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"shortDescription":{"type":"string","description":"A brief one-line summary of what the rule detects.","nullable":true},"locationInDeliveryChain":{"allOf":[{"$ref":"#/components/schemas/LocationInDeliveryChain"}],"nullable":true,"description":"The SDLC stage where this rule applies."},"clonedFrom":{"type":"string","description":"The name of the original rule that this rule was cloned from, if applicable."},"scannerRuleId":{"type":"string","description":"The unique identifier of the rule within the scanner system."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the original rule that this rule was cloned from, if applicable."},"docLink":{"type":"string","deprecated":true,"description":"Deprecated. A URL linking to the rule's documentation. Use `findingDocs` instead.","nullable":true}}},"CloudProvider":{"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","ORACLE","OTHER"],"type":"string"},"RuleFramework":{"description":"Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`)."},"definition":{"type":"string","nullable":true,"description":"The YAML or structured rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to the external definition or documentation for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."},"remediationIds":{"items":{"type":"string"},"type":"array","nullable":true,"description":"A list of remediation identifiers that link to automated fix actions for this framework."},"resourceTypes":{"items":{"type":"string"},"type":"array","nullable":true,"description":"The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)."}},"required":["name"],"type":"object","additionalProperties":false},"Scanner":{"description":"The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["CICD","IAC","SAST","SCA","SECRETS"],"type":"string"},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"FindingCategory":{"description":"The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.","enum":["Code","Configuration","Data","Vulnerability"],"type":"string"},"ComplianceStandard":{"description":"Represents a compliance standard and its associated controls that a rule maps to.","properties":{"controls":{"items":{"$ref":"#/components/schemas/Control"},"type":"array","description":"The list of compliance controls within this standard that the rule satisfies."},"standardName":{"type":"string","description":"The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)."}},"required":["controls","standardName"],"type":"object","additionalProperties":false},"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false},"LocationInDeliveryChain":{"description":"Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.","enum":["BUILD","DEPENDENCIES","DEPLOY","DEV_SOURCE","DEVELOPMENT","Runtime","SOURCE"],"type":"string"}}}} ``` ## The ModuleResult\_CspmRule\_ object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"ModuleResult_CspmRule_":{"description":"The per-rule result for the CSPM rule in a multi-status operation (such as a partial update or partial delete). Indicates whether the CSPM rule operation succeeded, failed, or was skipped.","anyOf":[{"description":"The CSPM rule operation completed successfully.","properties":{"status":{"type":"string","enum":["success"],"nullable":false,"description":"Indicates the CSPM rule operation completed successfully."},"rule":{"description":"The updated CSPM rule object. Present only when `status` is `success`.","allOf":[{"$ref":"#/components/schemas/CspmRule"}]}},"required":["status","rule"],"type":"object"},{"description":"The CSPM rule operation failed.","properties":{"status":{"type":"string","enum":["failed"],"nullable":false,"description":"Indicates the CSPM rule operation failed."},"error":{"type":"string","description":"A human-readable message describing why the CSPM rule operation failed."}},"required":["status","error"],"type":"object"},{"description":"The CSPM rule operation was skipped because no CSPM fields were included in the request.","properties":{"status":{"type":"string","enum":["skipped"],"nullable":false,"description":"Indicates the CSPM rule operation was skipped (for example, because no CSPM fields were included in the update request)."}},"required":["status"],"type":"object"}]},"CspmRule":{"description":"Represents Cloud Security rule that detects misconfigurations in deployed cloud infrastructure at runtime.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule."},"type":{"type":"string","description":"The type classification of the CSPM rule (for example, `Config` or `Network`)."},"name":{"type":"string","description":"Human-readable display name of the CSPM rule."},"severity":{"type":"string","description":"The priority level assigned to findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The team or system that owns and maintains this CSPM rule."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"enabled":{"type":"boolean","description":"Indicates whether the CSPM rule is currently active. When `true`, the rule is enabled."},"deleted":{"type":"boolean","description":"Indicates whether the CSPM rule has been soft-deleted. When `true`, the rule is no longer active but its record is retained."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided out-of-the-box rule (`true`) or a custom user-created rule (`false`)."},"assetTypes":{"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`).","items":{"type":"string"}},"providers":{"type":"array","description":"The cloud providers associated with this CSPM rule (for example, `AWS`, `Azure`, `GCP`).","items":{"type":"string"}},"labels":{"type":"array","description":"User-defined labels assigned to the CSPM rule for organization and filtering.","items":{"type":"string"}},"complianceMetadata":{"type":"array","description":"Compliance framework metadata associated with this rule, such as control IDs and standard names.","items":{"$ref":"#/components/schemas/Record_string.unknown_"}},"metadata":{"description":"Additional key-value metadata associated with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The query definition used by the CSPM rule to evaluate cloud resources.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username or identifier of the user who last modified this CSPM rule."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The PublicUnifiedRuleMultiStatusResponse object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"PublicUnifiedRuleMultiStatusResponse":{"description":"The response body returned when a unified rule operation partially succeeds (HTTP 207). Contains per-rule status details for both the AppSec and CSPM rule operations.","properties":{"id":{"type":"string","description":"The primary identifier of the unified rule pair. This is always the AppSec rule ID."},"appsec":{"description":"The result of the AppSec rule operation, indicating whether it succeeded, failed, or was skipped.","allOf":[{"$ref":"#/components/schemas/ModuleResult_PublicDetectionRule_"}]},"cspm":{"allOf":[{"$ref":"#/components/schemas/ModuleResult_CspmRule_"},{"properties":{"cspmRuleId":{"type":"string","description":"The unique identifier of the CSPM rule involved in the operation."}},"type":"object"}],"description":"The result of the CSPM rule operation, indicating whether it succeeded, failed, or was skipped."},"warnings":{"items":{"type":"string"},"type":"array","description":"A list of non-fatal warning messages generated during the operation."}},"required":["id","appsec","cspm"],"type":"object","additionalProperties":false},"ModuleResult_PublicDetectionRule_":{"description":"The per-rule result for the AppSec rule in a multi-status operation (such as a partial update or partial delete). Indicates whether the AppSec rule operation succeeded, failed, or was skipped.","anyOf":[{"description":"The AppSec rule operation completed successfully.","properties":{"status":{"type":"string","enum":["success"],"nullable":false,"description":"Indicates the AppSec rule operation completed successfully."},"rule":{"description":"The updated AppSec rule object. Present only when `status` is `success`.","allOf":[{"$ref":"#/components/schemas/PublicDetectionRule"}]}},"required":["status","rule"],"type":"object"},{"description":"The AppSec rule operation failed.","properties":{"status":{"type":"string","enum":["failed"],"nullable":false,"description":"Indicates the AppSec rule operation failed."},"error":{"type":"string","description":"A human-readable message describing why the AppSec rule operation failed."}},"required":["status","error"],"type":"object"},{"description":"The AppSec rule operation was skipped because no AppSec fields were included in the request.","properties":{"status":{"type":"string","enum":["skipped"],"nullable":false,"description":"Indicates the AppSec rule operation was skipped (for example, because no AppSec fields were included in the update request)."}},"required":["status"],"type":"object"}]},"PublicDetectionRule":{"description":"Represents an AppSec detection rule that identifies security issues in code, IaC configurations, secrets, or CI/CD pipelines.","type":"object","additionalProperties":false,"properties":{"category":{"type":"string","description":"The security category of the rule."},"cloudProvider":{"allOf":[{"$ref":"#/components/schemas/CloudProvider"}],"nullable":true,"description":"The cloud provider associated with this rule."},"createdAt":{"type":"string","format":"date-time","description":"The date and time when the rule was created, in ISO 8601 format."},"cspmRuleId":{"type":"string","description":"The unique identifier of the linked CSPM rule. Present when this AppSec rule is part of a unified rule pair.","nullable":true},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"detectionMethod":{"type":"string","description":"The detection method used by the rule (for example, `IaC Security`, `Secrets Security`)."},"domain":{"type":"string","description":"The security domain the rule belongs to (for example, `POSTURE`, `APPLICATION`)."},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule."},"frameworks":{"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions.","nullable":true,"items":{"$ref":"#/components/schemas/RuleFramework"}},"id":{"type":"string","description":"Unique identifier of the AppSec detection rule."},"isCustom":{"type":"boolean","description":"Indicates whether this is a custom user-created rule (`true`) or a system-provided out-of-the-box rule (`false`)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active. When `true`, the rule is enabled."},"labels":{"type":"array","description":"User-defined labels assigned to the rule for organization and filtering.","items":{"type":"string"}},"name":{"type":"string","description":"Name of the AppSec rule."},"owner":{"type":"string","description":"The team or system that owns and maintains this rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"The subcategory that further classifies the type of security issue within the rule's category."},"updatedAt":{"type":"string","format":"date-time","description":"The date and time when the rule was last updated, in ISO 8601 format."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string","description":"A URL or reference to documentation describing the finding type and remediation guidance."},"cspmTypeId":{"type":"number","format":"double","description":"The numeric type identifier of the linked CSPM rule.","nullable":true},"complianceStandards":{"type":"array","description":"The compliance standards and controls that this rule maps to.","items":{"$ref":"#/components/schemas/ComplianceStandard"}},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactics associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK techniques associated with the threat this rule detects.","nullable":true,"items":{"type":"string"}},"shortDescription":{"type":"string","description":"A brief one-line summary of what the rule detects.","nullable":true},"locationInDeliveryChain":{"allOf":[{"$ref":"#/components/schemas/LocationInDeliveryChain"}],"nullable":true,"description":"The SDLC stage where this rule applies."},"clonedFrom":{"type":"string","description":"The name of the original rule that this rule was cloned from, if applicable."},"scannerRuleId":{"type":"string","description":"The unique identifier of the rule within the scanner system."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the original rule that this rule was cloned from, if applicable."},"docLink":{"type":"string","deprecated":true,"description":"Deprecated. A URL linking to the rule's documentation. Use `findingDocs` instead.","nullable":true}}},"CloudProvider":{"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","ORACLE","OTHER"],"type":"string"},"RuleFramework":{"description":"Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`)."},"definition":{"type":"string","nullable":true,"description":"The YAML or structured rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to the external definition or documentation for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."},"remediationIds":{"items":{"type":"string"},"type":"array","nullable":true,"description":"A list of remediation identifiers that link to automated fix actions for this framework."},"resourceTypes":{"items":{"type":"string"},"type":"array","nullable":true,"description":"The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)."}},"required":["name"],"type":"object","additionalProperties":false},"Scanner":{"description":"The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["CICD","IAC","SAST","SCA","SECRETS"],"type":"string"},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"FindingCategory":{"description":"The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.","enum":["Code","Configuration","Data","Vulnerability"],"type":"string"},"ComplianceStandard":{"description":"Represents a compliance standard and its associated controls that a rule maps to.","properties":{"controls":{"items":{"$ref":"#/components/schemas/Control"},"type":"array","description":"The list of compliance controls within this standard that the rule satisfies."},"standardName":{"type":"string","description":"The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)."}},"required":["controls","standardName"],"type":"object","additionalProperties":false},"Control":{"description":"Represents a single compliance control within a compliance standard.","properties":{"controlDefinition":{"type":"string","description":"The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)."},"controlName":{"type":"string","description":"The human-readable name of the compliance control."}},"required":["controlDefinition","controlName"],"type":"object","additionalProperties":false},"LocationInDeliveryChain":{"description":"Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.","enum":["BUILD","DEPENDENCIES","DEPLOY","DEV_SOURCE","DEVELOPMENT","Runtime","SOURCE"],"type":"string"},"ModuleResult_CspmRule_":{"description":"The per-rule result for the CSPM rule in a multi-status operation (such as a partial update or partial delete). Indicates whether the CSPM rule operation succeeded, failed, or was skipped.","anyOf":[{"description":"The CSPM rule operation completed successfully.","properties":{"status":{"type":"string","enum":["success"],"nullable":false,"description":"Indicates the CSPM rule operation completed successfully."},"rule":{"description":"The updated CSPM rule object. Present only when `status` is `success`.","allOf":[{"$ref":"#/components/schemas/CspmRule"}]}},"required":["status","rule"],"type":"object"},{"description":"The CSPM rule operation failed.","properties":{"status":{"type":"string","enum":["failed"],"nullable":false,"description":"Indicates the CSPM rule operation failed."},"error":{"type":"string","description":"A human-readable message describing why the CSPM rule operation failed."}},"required":["status","error"],"type":"object"},{"description":"The CSPM rule operation was skipped because no CSPM fields were included in the request.","properties":{"status":{"type":"string","enum":["skipped"],"nullable":false,"description":"Indicates the CSPM rule operation was skipped (for example, because no CSPM fields were included in the update request)."}},"required":["status"],"type":"object"}]},"CspmRule":{"description":"Represents Cloud Security rule that detects misconfigurations in deployed cloud infrastructure at runtime.","type":"object","additionalProperties":false,"properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule."},"type":{"type":"string","description":"The type classification of the CSPM rule (for example, `Config` or `Network`)."},"name":{"type":"string","description":"Human-readable display name of the CSPM rule."},"severity":{"type":"string","description":"The priority level assigned to findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The team or system that owns and maintains this CSPM rule."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"enabled":{"type":"boolean","description":"Indicates whether the CSPM rule is currently active. When `true`, the rule is enabled."},"deleted":{"type":"boolean","description":"Indicates whether the CSPM rule has been soft-deleted. When `true`, the rule is no longer active but its record is retained."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided out-of-the-box rule (`true`) or a custom user-created rule (`false`)."},"assetTypes":{"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`).","items":{"type":"string"}},"providers":{"type":"array","description":"The cloud providers associated with this CSPM rule (for example, `AWS`, `Azure`, `GCP`).","items":{"type":"string"}},"labels":{"type":"array","description":"User-defined labels assigned to the CSPM rule for organization and filtering.","items":{"type":"string"}},"complianceMetadata":{"type":"array","description":"Compliance framework metadata associated with this rule, such as control IDs and standard names.","items":{"$ref":"#/components/schemas/Record_string.unknown_"}},"metadata":{"description":"Additional key-value metadata associated with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The query definition used by the CSPM rule to evaluate cloud resources.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username or identifier of the user who last modified this CSPM rule."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The CreateCspmRuleParams object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CreateCspmRuleParams":{"description":"The request parameters for creating a new CSPM rule as part of a unified rule pair.","properties":{"name":{"type":"string","description":"The display name for the new CSPM rule. Must be unique within your tenant."},"query":{"description":"The query definition that the CSPM rule uses to evaluate cloud resources. Provide at least one query format (`rql`, `xql`, or `json`).","allOf":[{"$ref":"#/components/schemas/CspmQuery"}]},"severity":{"type":"string","description":"The priority level for findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"type":{"type":"string","description":"The rule type classification (for example, `Config`, `Network`)."},"class":{"type":"string","description":"The rule class used for internal categorization."},"assetTypes":{"items":{"type":"string"},"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`)."},"metadata":{"description":"Additional key-value metadata to associate with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"complianceMetadata":{"anyOf":[{"$ref":"#/components/schemas/Record_string.unknown_"},{"items":{"$ref":"#/components/schemas/Record_string.unknown_"},"type":"array"}],"description":"Compliance framework metadata to associate with the CSPM rule, such as control IDs and standard names. Accepts either a single object or an array of objects."},"labels":{"items":{"type":"string"},"type":"array","description":"User-defined labels to assign to the CSPM rule for organization and filtering."},"enabled":{"type":"boolean","description":"Whether the CSPM rule should be active immediately after creation. Defaults to `true`."}},"required":["name","query","severity"],"type":"object","additionalProperties":false},"CspmQuery":{"description":"The query definition used by a CSPM rule to evaluate cloud resources. Supports multiple query formats — provide at least one.","properties":{"type":{"type":"string","description":"The query type that determines how the query is evaluated (for example, `Config`, `Network`, `Event`)."},"rql":{"type":"string","description":"The RQL (Resource Query Language) query string used to evaluate cloud resources in Prisma Cloud (for example, `config where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-encryption'`)."},"xql":{"type":"string","description":"The XQL (Cortex Query Language) query string used to evaluate cloud resources."},"json":{"description":"The query expressed as a structured JSON object.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"prisma_json":{"description":"The query expressed as a structured JSON object in Prisma Cloud format.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]}},"type":"object","additionalProperties":{}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The CreateAppsecRuleParams object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CreateAppsecRuleParams":{"description":"The request parameters for creating the AppSec rule portion of a unified rule pair. The `cspmRuleId`, `cspmTypeId`, and `shouldConnectToCspm` fields are managed automatically by the unified rule endpoint and must not be included in the request.","properties":{"name":{"type":"string","description":"The display name for the new AppSec rule. Must be unique within your tenant."},"severity":{"description":"The priority level for findings detected by this AppSec rule.","allOf":[{"$ref":"#/components/schemas/Severity"}]},"scanner":{"description":"The scanner type for this custom rule. Only `IAC` and `SECRETS` are supported for custom rule creation.","allOf":[{"$ref":"#/components/schemas/CustomRuleScanner"}]},"frameworks":{"items":{"$ref":"#/components/schemas/FrameworkRequestParams"},"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions. At least one framework is required."},"category":{"description":"The security category for this rule. Use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.","allOf":[{"$ref":"#/components/schemas/CustomRuleCategory"}]},"subCategory":{"description":"The subcategory that further classifies the security issue. Applicable to `IAC` rules only.","allOf":[{"$ref":"#/components/schemas/CustomRuleIacSubCategory"}]},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"labels":{"items":{"type":"string"},"type":"array","description":"User-defined labels to assign to the rule for organization and filtering."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the rule this rule was cloned from, if applicable."}},"required":["name","severity","scanner","frameworks","category"],"type":"object","additionalProperties":false},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"CustomRuleScanner":{"description":"The scanner type supported for custom AppSec rules. Only IaC and Secrets scanners support custom rule creation.\n- `IAC` — Infrastructure as Code security scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["IAC","SECRETS"],"type":"string"},"FrameworkRequestParams":{"description":"The framework-specific definition for a custom AppSec rule, including the detection logic and remediation guidance.","properties":{"name":{"description":"The IaC framework or language this definition applies to.","allOf":[{"$ref":"#/components/schemas/FrameworkName"}]},"definition":{"type":"string","nullable":true,"description":"The YAML rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to an external definition for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."}},"required":["name"],"type":"object","additionalProperties":false},"FrameworkName":{"description":"The IaC framework or language that a rule definition applies to.","enum":["ANSIBLE","ARM","BICEP","CI_CD_AZURE_ORG","CI_CD_AZURE_REPO","CI_CD_BITBUCKET_ORG","CI_CD_BITBUCKET_REPO","CI_CD_CIMATCH","CI_CD_CIRCLE_CI","CI_CD_CROSS_SYSTEM","CI_CD_DEPPY","CI_CD_GITHUB_ORG","CI_CD_GITHUB_REPO","CI_CD_GITLAB_ORG","CI_CD_GITLAB_REPO","CI_CD_JENKINS_CI","CI_CD_SUPPLY_CHAIN_TOOLS","CLOUDFORMATION","DOCKERFILE","GIT","HELM","KUBERNETES","KUSTOMIZE","OPENAPI","SECRETS","SERVERLESS","TERRAFORM","TERRAFORMPLAN"],"type":"string"},"CustomRuleCategory":{"description":"The security category for a custom AppSec rule. The accepted values depend on the scanner type: use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.","anyOf":[{"$ref":"#/components/schemas/CustomRuleIacCategory"},{"$ref":"#/components/schemas/CustomRuleSecretsCategory"}]},"CustomRuleIacCategory":{"description":"The security category for a custom IaC rule.\n- `AI_ML` — AI and machine learning resource security.\n- `COMPUTE` — Compute resource security.\n- `IAM` — Identity and access management.\n- `KUBERNETES` — Kubernetes cluster security.\n- `LOGGING` — Logging and audit trail configuration.\n- `MONITORING` — Monitoring and alerting configuration.\n- `NETWORKING` — Network security and exposure.\n- `PUBLIC` — Public exposure of resources.\n- `STORAGE` — Storage resource security.","enum":["AI_ML","COMPUTE","IAM","KUBERNETES","LOGGING","MONITORING","NETWORKING","PUBLIC","STORAGE"],"type":"string"},"CustomRuleSecretsCategory":{"description":"The security category for a custom Secrets rule.\n- `API_KEYS` — API key secrets.\n- `DATABASE_CREDENTIALS` — Database credential secrets.\n- `ENCRYPTION_KEYS` — Encryption key secrets.\n- `CLOUD_SERVICE_PROVIDER_KEYS` — Cloud provider access key secrets.\n- `SSH_KEYS` — SSH private key secrets.\n- `ENVIRONMENT_VARIABLES` — Secrets exposed in environment variables.\n- `SENSITIVE_TOKENS` — Sensitive authentication tokens.\n- `THIRD_PARTY_SERVICES` — Credentials for third-party services.","enum":["API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"],"type":"string"},"CustomRuleIacSubCategory":{"description":"The subcategory that further classifies the type of security issue within an IaC rule category. Subcategories are only applicable to `IAC` scanner rules.","enum":["ACCESS_CONTROL","ADMIN_INTERFACES","ALERTING","ALERTING_AND_NOTIFICATIONS","APIS","AUTHENTICATION_POLICIES","BACKUPS","CREDENTIAL_EXPOSURE","DATABASE_ENDPOINTS","DEFAULT_CREDENTIALS_OR_AUTH","DISABLED_OR_MISSING","EGRESS_CONTROLS","ENCRYPTION","ENCRYPTION_AND_PROTOCOLS","EXPIRED_KEY_CONTROLS","FLOW_LOGS","FORMATS","GUARDRAILS","INGRESS_CONTROLS","LOAD_BALANCING","LOGGING_AND_MONITORING","MANAGEMENT_SERVICES_EXPOSURE","MFA","NATIVE_SECURITY_CONTROLS","NETWORK_POLICIES","OVERPROVISIONED","OVERLY_PERMISSIVE","PERFORMANCE_MONITORING","PERMISSIONS","PUBLIC_EXPOSURE","REDUNDANCY","REPLICATION","RESOURCE_HEALTH","RESOURCE_MANAGEMENT","RETENTION","RISKY_MODELS","ROLE_SEPARATION","SENSITIVE_PORTS","SHARED","STARTUP_SCRIPT_LEAKS","STORAGE","STORAGE_BUCKETS","TAGS_AND_METADATA","UNDER_USE","UNINTEGRATED","UNSANCTIONED_RESOURCE_OR_TYPE","UNUSED","VERSIONING","VPC_VCN_VNET"],"type":"string"}}}} ``` ## The CreateUnifiedRuleRequest object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"CreateUnifiedRuleRequest":{"description":"The request body for creating a unified rule pair. Both the `cspm` and `appsec` rule definitions are required.\n\nThe endpoint creates the CSPM rule first, then creates the AppSec rule with the CSPM rule ID automatically injected to link the two rules. If the AppSec rule creation fails, the CSPM rule is automatically rolled back.","properties":{"cspm":{"description":"The definition for the CSPM rule to create. This rule evaluates deployed cloud infrastructure at runtime.","allOf":[{"$ref":"#/components/schemas/CreateCspmRuleParams"}]},"appsec":{"description":"The definition for the AppSec IaC rule to create. This rule evaluates IaC configurations in code repositories. The CSPM rule ID is automatically injected to link the two rules.","allOf":[{"$ref":"#/components/schemas/CreateAppsecRuleParams"}]}},"required":["cspm","appsec"],"type":"object","additionalProperties":false},"CreateCspmRuleParams":{"description":"The request parameters for creating a new CSPM rule as part of a unified rule pair.","properties":{"name":{"type":"string","description":"The display name for the new CSPM rule. Must be unique within your tenant."},"query":{"description":"The query definition that the CSPM rule uses to evaluate cloud resources. Provide at least one query format (`rql`, `xql`, or `json`).","allOf":[{"$ref":"#/components/schemas/CspmQuery"}]},"severity":{"type":"string","description":"The priority level for findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"description":{"type":"string","description":"A human-readable explanation of what the CSPM rule checks and why it matters."},"type":{"type":"string","description":"The rule type classification (for example, `Config`, `Network`)."},"class":{"type":"string","description":"The rule class used for internal categorization."},"assetTypes":{"items":{"type":"string"},"type":"array","description":"The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`)."},"metadata":{"description":"Additional key-value metadata to associate with the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"complianceMetadata":{"anyOf":[{"$ref":"#/components/schemas/Record_string.unknown_"},{"items":{"$ref":"#/components/schemas/Record_string.unknown_"},"type":"array"}],"description":"Compliance framework metadata to associate with the CSPM rule, such as control IDs and standard names. Accepts either a single object or an array of objects."},"labels":{"items":{"type":"string"},"type":"array","description":"User-defined labels to assign to the CSPM rule for organization and filtering."},"enabled":{"type":"boolean","description":"Whether the CSPM rule should be active immediately after creation. Defaults to `true`."}},"required":["name","query","severity"],"type":"object","additionalProperties":false},"CspmQuery":{"description":"The query definition used by a CSPM rule to evaluate cloud resources. Supports multiple query formats — provide at least one.","properties":{"type":{"type":"string","description":"The query type that determines how the query is evaluated (for example, `Config`, `Network`, `Event`)."},"rql":{"type":"string","description":"The RQL (Resource Query Language) query string used to evaluate cloud resources in Prisma Cloud (for example, `config where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-encryption'`)."},"xql":{"type":"string","description":"The XQL (Cortex Query Language) query string used to evaluate cloud resources."},"json":{"description":"The query expressed as a structured JSON object.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"prisma_json":{"description":"The query expressed as a structured JSON object in Prisma Cloud format.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]}},"type":"object","additionalProperties":{}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."},"CreateAppsecRuleParams":{"description":"The request parameters for creating the AppSec rule portion of a unified rule pair. The `cspmRuleId`, `cspmTypeId`, and `shouldConnectToCspm` fields are managed automatically by the unified rule endpoint and must not be included in the request.","properties":{"name":{"type":"string","description":"The display name for the new AppSec rule. Must be unique within your tenant."},"severity":{"description":"The priority level for findings detected by this AppSec rule.","allOf":[{"$ref":"#/components/schemas/Severity"}]},"scanner":{"description":"The scanner type for this custom rule. Only `IAC` and `SECRETS` are supported for custom rule creation.","allOf":[{"$ref":"#/components/schemas/CustomRuleScanner"}]},"frameworks":{"items":{"$ref":"#/components/schemas/FrameworkRequestParams"},"type":"array","description":"The list of IaC frameworks or languages this rule applies to, along with their detection definitions. At least one framework is required."},"category":{"description":"The security category for this rule. Use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.","allOf":[{"$ref":"#/components/schemas/CustomRuleCategory"}]},"subCategory":{"description":"The subcategory that further classifies the security issue. Applicable to `IAC` rules only.","allOf":[{"$ref":"#/components/schemas/CustomRuleIacSubCategory"}]},"description":{"type":"string","description":"A human-readable explanation of what the rule detects and why it matters."},"labels":{"items":{"type":"string"},"type":"array","description":"User-defined labels to assign to the rule for organization and filtering."},"clonedFromRuleId":{"type":"string","description":"The unique identifier of the rule this rule was cloned from, if applicable."}},"required":["name","severity","scanner","frameworks","category"],"type":"object","additionalProperties":false},"Severity":{"description":"The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFO"],"type":"string"},"CustomRuleScanner":{"description":"The scanner type supported for custom AppSec rules. Only IaC and Secrets scanners support custom rule creation.\n- `IAC` — Infrastructure as Code security scanner.\n- `SECRETS` — Secrets detection scanner.","enum":["IAC","SECRETS"],"type":"string"},"FrameworkRequestParams":{"description":"The framework-specific definition for a custom AppSec rule, including the detection logic and remediation guidance.","properties":{"name":{"description":"The IaC framework or language this definition applies to.","allOf":[{"$ref":"#/components/schemas/FrameworkName"}]},"definition":{"type":"string","nullable":true,"description":"The YAML rule definition used to detect the security issue within this framework."},"definitionLink":{"type":"string","nullable":true,"description":"A URL linking to an external definition for this framework rule."},"remediationDescription":{"type":"string","nullable":true,"description":"A human-readable description of how to remediate the detected issue within this framework."}},"required":["name"],"type":"object","additionalProperties":false},"FrameworkName":{"description":"The IaC framework or language that a rule definition applies to.","enum":["ANSIBLE","ARM","BICEP","CI_CD_AZURE_ORG","CI_CD_AZURE_REPO","CI_CD_BITBUCKET_ORG","CI_CD_BITBUCKET_REPO","CI_CD_CIMATCH","CI_CD_CIRCLE_CI","CI_CD_CROSS_SYSTEM","CI_CD_DEPPY","CI_CD_GITHUB_ORG","CI_CD_GITHUB_REPO","CI_CD_GITLAB_ORG","CI_CD_GITLAB_REPO","CI_CD_JENKINS_CI","CI_CD_SUPPLY_CHAIN_TOOLS","CLOUDFORMATION","DOCKERFILE","GIT","HELM","KUBERNETES","KUSTOMIZE","OPENAPI","SECRETS","SERVERLESS","TERRAFORM","TERRAFORMPLAN"],"type":"string"},"CustomRuleCategory":{"description":"The security category for a custom AppSec rule. The accepted values depend on the scanner type: use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.","anyOf":[{"$ref":"#/components/schemas/CustomRuleIacCategory"},{"$ref":"#/components/schemas/CustomRuleSecretsCategory"}]},"CustomRuleIacCategory":{"description":"The security category for a custom IaC rule.\n- `AI_ML` — AI and machine learning resource security.\n- `COMPUTE` — Compute resource security.\n- `IAM` — Identity and access management.\n- `KUBERNETES` — Kubernetes cluster security.\n- `LOGGING` — Logging and audit trail configuration.\n- `MONITORING` — Monitoring and alerting configuration.\n- `NETWORKING` — Network security and exposure.\n- `PUBLIC` — Public exposure of resources.\n- `STORAGE` — Storage resource security.","enum":["AI_ML","COMPUTE","IAM","KUBERNETES","LOGGING","MONITORING","NETWORKING","PUBLIC","STORAGE"],"type":"string"},"CustomRuleSecretsCategory":{"description":"The security category for a custom Secrets rule.\n- `API_KEYS` — API key secrets.\n- `DATABASE_CREDENTIALS` — Database credential secrets.\n- `ENCRYPTION_KEYS` — Encryption key secrets.\n- `CLOUD_SERVICE_PROVIDER_KEYS` — Cloud provider access key secrets.\n- `SSH_KEYS` — SSH private key secrets.\n- `ENVIRONMENT_VARIABLES` — Secrets exposed in environment variables.\n- `SENSITIVE_TOKENS` — Sensitive authentication tokens.\n- `THIRD_PARTY_SERVICES` — Credentials for third-party services.","enum":["API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"],"type":"string"},"CustomRuleIacSubCategory":{"description":"The subcategory that further classifies the type of security issue within an IaC rule category. Subcategories are only applicable to `IAC` scanner rules.","enum":["ACCESS_CONTROL","ADMIN_INTERFACES","ALERTING","ALERTING_AND_NOTIFICATIONS","APIS","AUTHENTICATION_POLICIES","BACKUPS","CREDENTIAL_EXPOSURE","DATABASE_ENDPOINTS","DEFAULT_CREDENTIALS_OR_AUTH","DISABLED_OR_MISSING","EGRESS_CONTROLS","ENCRYPTION","ENCRYPTION_AND_PROTOCOLS","EXPIRED_KEY_CONTROLS","FLOW_LOGS","FORMATS","GUARDRAILS","INGRESS_CONTROLS","LOAD_BALANCING","LOGGING_AND_MONITORING","MANAGEMENT_SERVICES_EXPOSURE","MFA","NATIVE_SECURITY_CONTROLS","NETWORK_POLICIES","OVERPROVISIONED","OVERLY_PERMISSIVE","PERFORMANCE_MONITORING","PERMISSIONS","PUBLIC_EXPOSURE","REDUNDANCY","REPLICATION","RESOURCE_HEALTH","RESOURCE_MANAGEMENT","RETENTION","RISKY_MODELS","ROLE_SEPARATION","SENSITIVE_PORTS","SHARED","STARTUP_SCRIPT_LEAKS","STORAGE","STORAGE_BUCKETS","TAGS_AND_METADATA","UNDER_USE","UNINTEGRATED","UNSANCTIONED_RESOURCE_OR_TYPE","UNUSED","VERSIONING","VPC_VCN_VNET"],"type":"string"}}}} ``` ## The Partial\_CspmRule\_ object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Partial_CspmRule_":{"description":"A partial update object for a CSPM rule. All fields are optional. Include only the fields you want to update.","properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule. Read-only in update requests."},"type":{"type":"string","description":"The type classification of the CSPM rule."},"name":{"type":"string","description":"The updated display name for the CSPM rule."},"severity":{"type":"string","description":"The updated priority level for findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The updated owner of the CSPM rule."},"description":{"type":"string","description":"The updated human-readable explanation of what the CSPM rule checks."},"enabled":{"type":"boolean","description":"Whether the CSPM rule should be active. Set to `true` to enable or `false` to disable."},"deleted":{"type":"boolean","description":"Whether the CSPM rule should be soft-deleted."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided rule. Read-only in update requests."},"assetTypes":{"items":{"type":"string"},"type":"array","description":"The updated list of cloud asset types that this CSPM rule evaluates."},"providers":{"items":{"type":"string"},"type":"array","description":"The updated list of cloud providers associated with this CSPM rule."},"labels":{"items":{"type":"string"},"type":"array","description":"The updated list of user-defined labels for the CSPM rule."},"complianceMetadata":{"items":{"$ref":"#/components/schemas/Record_string.unknown_"},"type":"array","description":"The updated compliance framework metadata for the CSPM rule."},"metadata":{"description":"The updated key-value metadata for the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The updated query definition for the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The updated version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username of the user who last modified this CSPM rule. Read-only in update requests."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."}}}} ``` ## The Partial\_Omit\_ModifyRuleParams.cspmRuleId\_\_ object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"Partial_Omit_ModifyRuleParams.cspmRuleId__":{"description":"A partial update object for an AppSec rule in a unified rule pair. Currently supports updating labels only.","properties":{"labels":{"items":{"type":"string"},"type":"array","description":"The updated list of user-defined labels for the AppSec rule."}}}}}} ``` ## The UpdateUnifiedRuleRequest object ```json {"openapi":"3.0.1","info":{"title":"Unified Rule APIs","version":"Cortex XSIAM 3.x"},"components":{"schemas":{"UpdateUnifiedRuleRequest":{"description":"The request body for updating a unified rule pair. Include only the rule object or fields you want to update. You can update the CSPM rule, the AppSec rule, or both in a single request.","properties":{"cspm":{"description":"The fields to update on the CSPM rule. Include only the fields you want to change.","allOf":[{"$ref":"#/components/schemas/Partial_CspmRule_"}]},"appsec":{"description":"The fields to update on the AppSec rule. Include only the fields you want to change.","allOf":[{"$ref":"#/components/schemas/Partial_Omit_ModifyRuleParams.cspmRuleId__"}]}},"type":"object","additionalProperties":false},"Partial_CspmRule_":{"description":"A partial update object for a CSPM rule. All fields are optional. Include only the fields you want to update.","properties":{"id":{"type":"string","description":"Unique identifier of the CSPM rule. Read-only in update requests."},"type":{"type":"string","description":"The type classification of the CSPM rule."},"name":{"type":"string","description":"The updated display name for the CSPM rule."},"severity":{"type":"string","description":"The updated priority level for findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`."},"owner":{"type":"string","description":"The updated owner of the CSPM rule."},"description":{"type":"string","description":"The updated human-readable explanation of what the CSPM rule checks."},"enabled":{"type":"boolean","description":"Whether the CSPM rule should be active. Set to `true` to enable or `false` to disable."},"deleted":{"type":"boolean","description":"Whether the CSPM rule should be soft-deleted."},"systemDefault":{"type":"boolean","description":"Indicates whether this is a system-provided rule. Read-only in update requests."},"assetTypes":{"items":{"type":"string"},"type":"array","description":"The updated list of cloud asset types that this CSPM rule evaluates."},"providers":{"items":{"type":"string"},"type":"array","description":"The updated list of cloud providers associated with this CSPM rule."},"labels":{"items":{"type":"string"},"type":"array","description":"The updated list of user-defined labels for the CSPM rule."},"complianceMetadata":{"items":{"$ref":"#/components/schemas/Record_string.unknown_"},"type":"array","description":"The updated compliance framework metadata for the CSPM rule."},"metadata":{"description":"The updated key-value metadata for the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"query":{"description":"The updated query definition for the CSPM rule.","allOf":[{"$ref":"#/components/schemas/Record_string.unknown_"}]},"version":{"type":"string","description":"The updated version identifier of the CSPM rule definition."},"lastModifiedBy":{"type":"string","description":"The username of the user who last modified this CSPM rule. Read-only in update requests."}}},"Record_string.unknown_":{"properties":{},"additionalProperties":{},"type":"object","description":"A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures."},"Partial_Omit_ModifyRuleParams.cspmRuleId__":{"description":"A partial update object for an AppSec rule in a unified rule pair. Currently supports updating labels only.","properties":{"labels":{"items":{"type":"string"},"type":"array","description":"The updated list of user-defined labels for the AppSec rule."}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsiam-api/unified-rules/models.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.