Detect and Respond Response Policies

List Response Policies

get

Returns an array of Response Policies.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

List of Requested Response Policies

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

get

/api/v1/rule-engine/rules

HTTPcURLJavaScriptPython

GET /api/v1/rule-engine/rules HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "id": "0443258d-3217-49a3-8f2a-21ed5aef4bee",
      "plugins": [
        {
          "adapter": "syslog",
          "description": "My Plugin",
          "id": "a8899a17-2e34-4d76-a765-57dda8604d06",
          "name": "My Plugin",
          "type": "block"
        }
      ],
      "config": {
        "alerttypes": [
          [
            "start",
            "end"
          ]
        ],
        "severities": [
          [
            "low",
            "medium"
          ]
        ],
        "algorithms": [
          "all"
        ],
        "categories": [
          "all"
        ],
        "tracks": [
          [
            "dstip",
            "srcip"
          ]
        ]
      },
      "description": "this detects things",
      "name": "my-rule",
      "enabled": true,
      "type": "alert"
    }
  ]
}

Create Response Policy

post

Creates a response policy from the data that's been supplied.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

Response Policy Create or Update Config

descriptionstringOptionalExample: this detects things

namestringRequiredExample: my-rule

enabledbooleanOptionalExample: true

typestring · enumOptionalExample: alertPossible values:

pluginsstring[]Optional

Plugin ID to be used in the response policy

Example: 214365f7-ac9a-45bc-9795-95958bdfa694

Responses

201

Requested Response Policy

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

post

/api/v1/rule-engine/rule

HTTPcURLJavaScriptPython

POST /api/v1/rule-engine/rule HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 280

{
  "plugins": [
    "214365f7-ac9a-45bc-9795-95958bdfa694"
  ],
  "config": {
    "alerttypes": [
      [
        "start",
        "end"
      ]
    ],
    "severities": [
      [
        "low",
        "medium"
      ]
    ],
    "algorithms": [
      "all"
    ],
    "categories": [
      "all"
    ],
    "tracks": [
      [
        "dstip",
        "srcip"
      ]
    ]
  },
  "description": "this detects things",
  "name": "my-rule",
  "enabled": true,
  "type": "alert"
}

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "id": "0443258d-3217-49a3-8f2a-21ed5aef4bee",
      "plugins": [
        {
          "adapter": "syslog",
          "description": "My Plugin",
          "id": "a8899a17-2e34-4d76-a765-57dda8604d06",
          "name": "My Plugin",
          "type": "block"
        }
      ],
      "config": {
        "alerttypes": [
          [
            "start",
            "end"
          ]
        ],
        "severities": [
          [
            "low",
            "medium"
          ]
        ],
        "algorithms": [
          "all"
        ],
        "categories": [
          "all"
        ],
        "tracks": [
          [
            "dstip",
            "srcip"
          ]
        ]
      },
      "description": "this detects things",
      "name": "my-rule",
      "enabled": true,
      "type": "alert"
    }
  ]
}

Fetch Response Policy

get

Fetches a specific response policy from the ID supplied in the path.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the response policy to be returned.

Responses

200

Requested Response Policy

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

get

/api/v1/rule-engine/rule/{id}

HTTPcURLJavaScriptPython

GET /api/v1/rule-engine/rule/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "id": "0443258d-3217-49a3-8f2a-21ed5aef4bee",
      "plugins": [
        {
          "adapter": "syslog",
          "description": "My Plugin",
          "id": "a8899a17-2e34-4d76-a765-57dda8604d06",
          "name": "My Plugin",
          "type": "block"
        }
      ],
      "config": {
        "alerttypes": [
          [
            "start",
            "end"
          ]
        ],
        "severities": [
          [
            "low",
            "medium"
          ]
        ],
        "algorithms": [
          "all"
        ],
        "categories": [
          "all"
        ],
        "tracks": [
          [
            "dstip",
            "srcip"
          ]
        ]
      },
      "description": "this detects things",
      "name": "my-rule",
      "enabled": true,
      "type": "alert"
    }
  ]
}

Update Response Policy

put

Update a response policy given the provided object. This does not do a diff. You must send the complete object.

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the response policy to be updated

Body

application/json

Response Policy Create or Update Config

descriptionstringOptionalExample: this detects things

namestringRequiredExample: my-rule

enabledbooleanOptionalExample: true

typestring · enumOptionalExample: alertPossible values:

pluginsstring[]Optional

Plugin ID to be used in the response policy

Example: 214365f7-ac9a-45bc-9795-95958bdfa694

Responses

200

Requested Response Policy

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/rule/{id}

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/rule/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 280

{
  "plugins": [
    "214365f7-ac9a-45bc-9795-95958bdfa694"
  ],
  "config": {
    "alerttypes": [
      [
        "start",
        "end"
      ]
    ],
    "severities": [
      [
        "low",
        "medium"
      ]
    ],
    "algorithms": [
      "all"
    ],
    "categories": [
      "all"
    ],
    "tracks": [
      [
        "dstip",
        "srcip"
      ]
    ]
  },
  "description": "this detects things",
  "name": "my-rule",
  "enabled": true,
  "type": "alert"
}

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "id": "0443258d-3217-49a3-8f2a-21ed5aef4bee",
      "plugins": [
        {
          "adapter": "syslog",
          "description": "My Plugin",
          "id": "a8899a17-2e34-4d76-a765-57dda8604d06",
          "name": "My Plugin",
          "type": "block"
        }
      ],
      "config": {
        "alerttypes": [
          [
            "start",
            "end"
          ]
        ],
        "severities": [
          [
            "low",
            "medium"
          ]
        ],
        "algorithms": [
          "all"
        ],
        "categories": [
          "all"
        ],
        "tracks": [
          [
            "dstip",
            "srcip"
          ]
        ]
      },
      "description": "this detects things",
      "name": "my-rule",
      "enabled": true,
      "type": "alert"
    }
  ]
}

Delete Response Policy

delete

Deletes a response policy

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the response policy to be deleted

Responses

204

An empty array

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

delete

/api/v1/rule-engine/rule/{id}

HTTPcURLJavaScriptPython

DELETE /api/v1/rule-engine/rule/{id} HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Enable Response Policy

put

Enables a response policy

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the response policy to be enabled

Responses

200

Requested Response Policy

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/rule/{id}/enable

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/rule/{id}/enable HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "id": "0443258d-3217-49a3-8f2a-21ed5aef4bee",
      "plugins": [
        {
          "adapter": "syslog",
          "description": "My Plugin",
          "id": "a8899a17-2e34-4d76-a765-57dda8604d06",
          "name": "My Plugin",
          "type": "block"
        }
      ],
      "config": {
        "alerttypes": [
          [
            "start",
            "end"
          ]
        ],
        "severities": [
          [
            "low",
            "medium"
          ]
        ],
        "algorithms": [
          "all"
        ],
        "categories": [
          "all"
        ],
        "tracks": [
          [
            "dstip",
            "srcip"
          ]
        ]
      },
      "description": "this detects things",
      "name": "my-rule",
      "enabled": true,
      "type": "alert"
    }
  ]
}

Disable Response Policy

put

Disables a response policy

Authorizations

BearerAuth

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

The ID of the response policy to be disabled

Responses

200

Requested Response Policy

application/json

400

Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.

application/json

401

Access token is missing or invalid

application/json

403

Access is forbidden

application/json

default

Unknown Error Occurred

application/json

put

/api/v1/rule-engine/rule/{id}/disable

HTTPcURLJavaScriptPython

PUT /api/v1/rule-engine/rule/{id}/disable HTTP/1.1
Host: api.netography.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "code": 200,
    "count": 1
  },
  "data": [
    {
      "id": "0443258d-3217-49a3-8f2a-21ed5aef4bee",
      "plugins": [
        {
          "adapter": "syslog",
          "description": "My Plugin",
          "id": "a8899a17-2e34-4d76-a765-57dda8604d06",
          "name": "My Plugin",
          "type": "block"
        }
      ],
      "config": {
        "alerttypes": [
          [
            "start",
            "end"
          ]
        ],
        "severities": [
          [
            "low",
            "medium"
          ]
        ],
        "algorithms": [
          "all"
        ],
        "categories": [
          "all"
        ],
        "tracks": [
          [
            "dstip",
            "srcip"
          ]
        ]
      },
      "description": "this detects things",
      "name": "my-rule",
      "enabled": true,
      "type": "alert"
    }
  ]
}