@@ -7373,6 +7373,8 @@ components:
7373
7373
CloudWorkloadSecurityAgentPolicyCreateAttributes:
7374
7374
description: Create a new Cloud Workload Security Agent policy
7375
7375
properties:
7376
+ actions:
7377
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
7376
7378
description:
7377
7379
description: The description of the policy
7378
7380
example: My agent policy
@@ -7454,6 +7456,8 @@ components:
7454
7456
CloudWorkloadSecurityAgentPolicyUpdateAttributes:
7455
7457
description: Update an existing Cloud Workload Security Agent policy
7456
7458
properties:
7459
+ actions:
7460
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
7457
7461
description:
7458
7462
description: The description of the policy
7459
7463
example: My agent policy
@@ -7524,6 +7528,50 @@ components:
7524
7528
type: string
7525
7529
kill:
7526
7530
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
7531
+ metadata:
7532
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
7533
+ set:
7534
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
7535
+ type: object
7536
+ CloudWorkloadSecurityAgentRuleActionMetadata:
7537
+ description: The metadata action applied on the scope matching the rule
7538
+ properties:
7539
+ image_tag:
7540
+ description: The image tag of the metadata action
7541
+ type: string
7542
+ service:
7543
+ description: The service of the metadata action
7544
+ type: string
7545
+ short_image:
7546
+ description: The short image of the metadata action
7547
+ type: string
7548
+ type: object
7549
+ CloudWorkloadSecurityAgentRuleActionSet:
7550
+ description: The set action applied on the scope matching the rule
7551
+ properties:
7552
+ append:
7553
+ description: Whether the value should be appended to the field
7554
+ type: boolean
7555
+ field:
7556
+ description: The field of the set action
7557
+ type: string
7558
+ name:
7559
+ description: The name of the set action
7560
+ type: string
7561
+ scope:
7562
+ description: The scope of the set action
7563
+ type: string
7564
+ size:
7565
+ description: The size of the set action
7566
+ format: int64
7567
+ type: integer
7568
+ ttl:
7569
+ description: The time to live of the set action
7570
+ format: int64
7571
+ type: integer
7572
+ value:
7573
+ description: The value of the set action
7574
+ type: string
7527
7575
type: object
7528
7576
CloudWorkloadSecurityAgentRuleActions:
7529
7577
description: The array of actions the rule can perform if triggered
@@ -7539,6 +7587,11 @@ components:
7539
7587
agentConstraint:
7540
7588
description: The version of the Agent
7541
7589
type: string
7590
+ blocking:
7591
+ description: The blocking policies that the rule belongs to
7592
+ items:
7593
+ type: string
7594
+ type: array
7542
7595
category:
7543
7596
description: The category of the Agent rule
7544
7597
example: Process Activity
@@ -7562,6 +7615,11 @@ components:
7562
7615
description: The description of the Agent rule
7563
7616
example: My Agent rule
7564
7617
type: string
7618
+ disabled:
7619
+ description: The disabled policies that the rule belongs to
7620
+ items:
7621
+ type: string
7622
+ type: array
7565
7623
enabled:
7566
7624
description: Whether the Agent rule is enabled
7567
7625
example: true
@@ -7575,6 +7633,11 @@ components:
7575
7633
items:
7576
7634
type: string
7577
7635
type: array
7636
+ monitoring:
7637
+ description: The monitoring policies that the rule belongs to
7638
+ items:
7639
+ type: string
7640
+ type: array
7578
7641
name:
7579
7642
description: The name of the Agent rule
7580
7643
example: my_agent_rule
@@ -7609,10 +7672,22 @@ components:
7609
7672
CloudWorkloadSecurityAgentRuleCreateAttributes:
7610
7673
description: Create a new Cloud Workload Security Agent rule.
7611
7674
properties:
7675
+ actions:
7676
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
7677
+ blocking:
7678
+ description: The blocking policies that the rule belongs to
7679
+ items:
7680
+ type: string
7681
+ type: array
7612
7682
description:
7613
7683
description: The description of the Agent rule.
7614
7684
example: My Agent rule
7615
7685
type: string
7686
+ disabled:
7687
+ description: The disabled policies that the rule belongs to
7688
+ items:
7689
+ type: string
7690
+ type: array
7616
7691
enabled:
7617
7692
description: Whether the Agent rule is enabled
7618
7693
example: true
@@ -7626,6 +7701,11 @@ components:
7626
7701
items:
7627
7702
type: string
7628
7703
type: array
7704
+ monitoring:
7705
+ description: The monitoring policies that the rule belongs to
7706
+ items:
7707
+ type: string
7708
+ type: array
7629
7709
name:
7630
7710
description: The name of the Agent rule.
7631
7711
example: my_agent_rule
@@ -7716,10 +7796,20 @@ components:
7716
7796
CloudWorkloadSecurityAgentRuleUpdateAttributes:
7717
7797
description: Update an existing Cloud Workload Security Agent rule
7718
7798
properties:
7799
+ blocking:
7800
+ description: The blocking policies that the rule belongs to
7801
+ items:
7802
+ type: string
7803
+ type: array
7719
7804
description:
7720
7805
description: The description of the Agent rule
7721
7806
example: My Agent rule
7722
7807
type: string
7808
+ disabled:
7809
+ description: The disabled policies that the rule belongs to
7810
+ items:
7811
+ type: string
7812
+ type: array
7723
7813
enabled:
7724
7814
description: Whether the Agent rule is enabled
7725
7815
example: true
@@ -7728,6 +7818,11 @@ components:
7728
7818
description: The SECL expression of the Agent rule
7729
7819
example: exec.file.name == "sh"
7730
7820
type: string
7821
+ monitoring:
7822
+ description: The monitoring policies that the rule belongs to
7823
+ items:
7824
+ type: string
7825
+ type: array
7731
7826
policy_id:
7732
7827
description: The ID of the policy where the Agent rule is saved
7733
7828
example: a8c8e364-6556-434d-b798-a4c23de29c0b
@@ -55622,8 +55717,9 @@ paths:
55622
55717
{\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\":
55623
55718
\"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n
55624
55719
\ \"enabled\": true,\n \"product_tags\": [\"security:attack\",
55625
- \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n
55626
- \ }\n }\n}"
55720
+ \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\",
55721
+ \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\":
55722
+ \"{{ policy.data.id }}\"\n }\n }\n}"
55627
55723
step: there is a valid "agent_rule_rc" in the system
55628
55724
x-menu-order: 4
55629
55725
x-undo:
0 commit comments