Managing Rules

The following methods search, retrieve, and edit rules.

Retrieving a List of a Device's Rules

The get_rules_by_device method retrieves a list of rules for a device.

Note: The list of parameters in the rules element depends on the device.

Request Type: GetRulesByDeviceRequest

Element

Type

Description

SessionID

Mandatory

String

SessionID returned by connect method.

DeviceID

Mandatory

String

Tree name of the device.

Response Type: GetRulesByDeviceResponse

Element

Type

Description

Rules Rules

Returned rules for device. For details, see Rules type .

Note: The response includes RuleID, which is a request parameter in get_rule_documentation. For details, see Retrieving a Rule's Documentation.

Searching for Rules

The search_rule method searches for rules.

Request Type: SearchRuleRequest

Element

Type

Description

SessionID

Mandatory

String

Session ID obtained from the connect method.

EntityID

Optional

String

ID of the entity to search. If not provided, search is for all devices.

EntityType

Optional

String

Entity type to search for. If not provided, search is for all devices.

Possible values include:

  • device
  • group
  • matrix

SearchFor

Mandatory

SearchParam

Criteria to search for. For details, see SearchParam type.

Response Type: SearchRuleResponse

Element

Type

Description

Rules

Mandatory

List of Rule objects

Returned rules. For details, see Rules type .

Note: The response includes RuleID, which is a request parameter in get_rule_documentation. For details, see Retrieving a Rule's Documentation.

Retrieving a Rule's Documentation

The get_rule_documentation method retrieves data from a specified column.

Request Type: GetRuleDocumentationRequest

Element

Type

Description

SessionID

Mandatory

String

SessionID obtained from the connect method.

DeviceID

Mandatory

String

Tree name of the device.

RuleUid

Mandatory

String

Internal AlgoSec Rule ID. To retrieve the rule ID, call one of the rule APIs, such as get_rules_by_device or search_rule. For details, see Retrieving a List of a Device's Rules or Searching for Rules.

DocumentationColumn

Mandatory

String

The name of the column from which you want to retrieve data.

Note: By default, AFA adds a field called Documentation to each device policy. For information on adding other columns, see Customizing Device Policy Documentation Fields.

Response Type: GetRuleDocumentationResponse

Element

Type

Description

GetRuleDocumentationResponse

String

The content in the specified column.

Editing a Rule's Documentation

The edit_rule_documentation method edits data in a specified column.

Request Type: EditRuleDocumentationRequest

Element

Type

Description

SessionID

Mandatory

String

SessionID obtained from the connect method.

DeviceID

Mandatory

String

Tree name of the device.

RuleUid

Mandatory

String

Rule ID. To get the rule ID, call one of the rule APIs, such as get_rules_by_device. For details, see Retrieving a List of a Device's Rules.

DocumentationColumn

Mandatory

String

Name of the column you want to edit.

Note: By default, AFA adds a field called Documentation to each device policy. For information on adding other columns, see Customizing Device Policy Documentation Fields.

DocumentationData

Mandatory

String

Content to put in the specified column.

Existing data will be overwritten.

Response Type: EditRuleDocumentationResponse

Element

Type

Description

EditRuleDocumentationResponse

Integer

On success, returns 1.

On failure, returns 0.

Retrieving a List of Unused Rules

The get_unused_rules method retrieves the list of unused rules detected in the last successful report of a device or a group of devices.

Request Type: GetRulesByDeviceRequest

Element

Type

Description

SessionID

Mandatory

String

SessionID returned by connect method.

EntityID

Mandatory

String

Tree name of the device.

EntityType

Mandatory

String

Device, group, or matrix.

Response Type: GetRulesByDeviceResponse

Element

Type

Description

Rules Rules

Returns unused rules of the given EntityID based on its last report.