Update an existing Cloud Workload Security Agent rule
\n
\n
\n
\n
\n
\n
description
\n
\n
string
\n
The description of the Agent rule
\n
\n \n
\n
\n
\n
\n
\n
enabled
\n
\n
boolean
\n
Whether the Agent rule is enabled
\n
\n \n
\n
\n
\n
\n
\n
expression
\n
\n
string
\n
The SECL expression of the Agent rule
\n
\n \n
\n
\n
\n
\n
\n
policy_id
\n
\n
string
\n
The ID of the policy where the Agent rule is saved
\n
\n \n
\n
\n
\n
\n
\n
product_tags
\n
\n
[string]
\n
The list of product tags associated with the rule
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
id
\n
\n
string
\n
The ID of the Agent rule
\n
\n \n
\n
\n
\n
\n
\n
type [required]
\n
\n
enum
\n
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
\n
\n \n
\n
\n
\n
"
+ "html": "
\n
\n
\n
\n
data [required]
\n
\n
object
\n
Object for a single Agent rule
\n
\n
\n
\n
\n
\n
attributes [required]
\n
\n
object
\n
Update an existing Cloud Workload Security Agent rule
\n
\n
\n
\n
\n
\n
blocking
\n
\n
[string]
\n
The blocking policies that the rule belongs to
\n
\n \n
\n
\n
\n
\n
\n
description
\n
\n
string
\n
The description of the Agent rule
\n
\n \n
\n
\n
\n
\n
\n
disabled
\n
\n
[string]
\n
The disabled policies that the rule belongs to
\n
\n \n
\n
\n
\n
\n
\n
enabled
\n
\n
boolean
\n
Whether the Agent rule is enabled
\n
\n \n
\n
\n
\n
\n
\n
expression
\n
\n
string
\n
The SECL expression of the Agent rule
\n
\n \n
\n
\n
\n
\n
\n
monitoring
\n
\n
[string]
\n
The monitoring policies that the rule belongs to
\n
\n \n
\n
\n
\n
\n
\n
policy_id
\n
\n
string
\n
The ID of the policy where the Agent rule is saved
\n
\n \n
\n
\n
\n
\n
\n
product_tags
\n
\n
[string]
\n
The list of product tags associated with the rule
\n
\n \n
\n
\n
\n
\n
\n
\n
\n
id
\n
\n
string
\n
The ID of the Agent rule
\n
\n \n
\n
\n
\n
\n
\n
type [required]
\n
\n
enum
\n
The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule
default: agent_rule
\n
\n \n
\n
\n
\n
"
}
}
}
\ No newline at end of file
diff --git a/content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1176049761.json b/content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1176049761.json
new file mode 100644
index 0000000000000..4b2457526e908
--- /dev/null
+++ b/content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1176049761.json
@@ -0,0 +1,23 @@
+{
+ "data": {
+ "attributes": {
+ "description": "My Agent rule with set action",
+ "enabled": true,
+ "expression": "exec.file.name == \"sh\"",
+ "filters": [],
+ "name": "examplecsmthreat",
+ "policy_id": "6517fcc1-cec7-4394-a655-8d6e9d085255",
+ "product_tags": [],
+ "actions": [
+ {
+ "set": {
+ "name": "test_set",
+ "value": "test_value",
+ "scope": "process"
+ }
+ }
+ ]
+ },
+ "type": "agent_rule"
+ }
+}
\ No newline at end of file
diff --git a/data/api/v2/CodeExamples.json b/data/api/v2/CodeExamples.json
index 06834c141262a..73a4a0041814e 100644
--- a/data/api/v2/CodeExamples.json
+++ b/data/api/v2/CodeExamples.json
@@ -212,6 +212,11 @@
"group": "csm_threats",
"suffix": "",
"description": "Create a CSM Threats Agent rule returns \"OK\" response"
+ },
+ {
+ "group": "csm_threats",
+ "suffix": "_1176049761",
+ "description": "Create a CSM Threats Agent rule with set action returns \"OK\" response"
}
],
"CreateCloudWorkloadSecurityAgentRule": [
diff --git a/data/api/v2/full_spec.yaml b/data/api/v2/full_spec.yaml
index 299b55863ff2d..996b6d3c316a9 100644
--- a/data/api/v2/full_spec.yaml
+++ b/data/api/v2/full_spec.yaml
@@ -7373,6 +7373,8 @@ components:
CloudWorkloadSecurityAgentPolicyCreateAttributes:
description: Create a new Cloud Workload Security Agent policy
properties:
+ actions:
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
description:
description: The description of the policy
example: My agent policy
@@ -7454,6 +7456,8 @@ components:
CloudWorkloadSecurityAgentPolicyUpdateAttributes:
description: Update an existing Cloud Workload Security Agent policy
properties:
+ actions:
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
description:
description: The description of the policy
example: My agent policy
@@ -7524,6 +7528,50 @@ components:
type: string
kill:
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
+ metadata:
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
+ set:
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
+ type: object
+ CloudWorkloadSecurityAgentRuleActionMetadata:
+ description: The metadata action applied on the scope matching the rule
+ properties:
+ image_tag:
+ description: The image tag of the metadata action
+ type: string
+ service:
+ description: The service of the metadata action
+ type: string
+ short_image:
+ description: The short image of the metadata action
+ type: string
+ type: object
+ CloudWorkloadSecurityAgentRuleActionSet:
+ description: The set action applied on the scope matching the rule
+ properties:
+ append:
+ description: Whether the value should be appended to the field
+ type: boolean
+ field:
+ description: The field of the set action
+ type: string
+ name:
+ description: The name of the set action
+ type: string
+ scope:
+ description: The scope of the set action
+ type: string
+ size:
+ description: The size of the set action
+ format: int64
+ type: integer
+ ttl:
+ description: The time to live of the set action
+ format: int64
+ type: integer
+ value:
+ description: The value of the set action
+ type: string
type: object
CloudWorkloadSecurityAgentRuleActions:
description: The array of actions the rule can perform if triggered
@@ -7539,6 +7587,11 @@ components:
agentConstraint:
description: The version of the Agent
type: string
+ blocking:
+ description: The blocking policies that the rule belongs to
+ items:
+ type: string
+ type: array
category:
description: The category of the Agent rule
example: Process Activity
@@ -7562,6 +7615,11 @@ components:
description: The description of the Agent rule
example: My Agent rule
type: string
+ disabled:
+ description: The disabled policies that the rule belongs to
+ items:
+ type: string
+ type: array
enabled:
description: Whether the Agent rule is enabled
example: true
@@ -7575,6 +7633,11 @@ components:
items:
type: string
type: array
+ monitoring:
+ description: The monitoring policies that the rule belongs to
+ items:
+ type: string
+ type: array
name:
description: The name of the Agent rule
example: my_agent_rule
@@ -7609,10 +7672,22 @@ components:
CloudWorkloadSecurityAgentRuleCreateAttributes:
description: Create a new Cloud Workload Security Agent rule.
properties:
+ actions:
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
+ blocking:
+ description: The blocking policies that the rule belongs to
+ items:
+ type: string
+ type: array
description:
description: The description of the Agent rule.
example: My Agent rule
type: string
+ disabled:
+ description: The disabled policies that the rule belongs to
+ items:
+ type: string
+ type: array
enabled:
description: Whether the Agent rule is enabled
example: true
@@ -7626,6 +7701,11 @@ components:
items:
type: string
type: array
+ monitoring:
+ description: The monitoring policies that the rule belongs to
+ items:
+ type: string
+ type: array
name:
description: The name of the Agent rule.
example: my_agent_rule
@@ -7716,10 +7796,20 @@ components:
CloudWorkloadSecurityAgentRuleUpdateAttributes:
description: Update an existing Cloud Workload Security Agent rule
properties:
+ blocking:
+ description: The blocking policies that the rule belongs to
+ items:
+ type: string
+ type: array
description:
description: The description of the Agent rule
example: My Agent rule
type: string
+ disabled:
+ description: The disabled policies that the rule belongs to
+ items:
+ type: string
+ type: array
enabled:
description: Whether the Agent rule is enabled
example: true
@@ -7728,6 +7818,11 @@ components:
description: The SECL expression of the Agent rule
example: exec.file.name == "sh"
type: string
+ monitoring:
+ description: The monitoring policies that the rule belongs to
+ items:
+ type: string
+ type: array
policy_id:
description: The ID of the policy where the Agent rule is saved
example: a8c8e364-6556-434d-b798-a4c23de29c0b
@@ -55622,8 +55717,9 @@ paths:
{\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\":
\"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n
\ \"enabled\": true,\n \"product_tags\": [\"security:attack\",
- \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n
- \ }\n }\n}"
+ \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\",
+ \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\":
+ \"{{ policy.data.id }}\"\n }\n }\n}"
step: there is a valid "agent_rule_rc" in the system
x-menu-order: 4
x-undo:
diff --git a/data/api/v2/full_spec_deref.json b/data/api/v2/full_spec_deref.json
index fed98235feaef..28c956eaf64b9 100644
--- a/data/api/v2/full_spec_deref.json
+++ b/data/api/v2/full_spec_deref.json
@@ -41933,6 +41933,85 @@
"CloudWorkloadSecurityAgentPolicyCreateAttributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -41977,6 +42056,85 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42043,6 +42201,85 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42400,6 +42637,85 @@
"CloudWorkloadSecurityAgentPolicyUpdateAttributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42441,6 +42757,85 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42509,6 +42904,85 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42607,6 +43081,114 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "CloudWorkloadSecurityAgentRuleActionMetadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "CloudWorkloadSecurityAgentRuleActionSet": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
}
},
"type": "object"
@@ -42629,6 +43211,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -42657,6 +43293,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -42668,6 +43358,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -42711,6 +43408,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42728,6 +43432,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -42786,11 +43497,104 @@
"CloudWorkloadSecurityAgentRuleCreateAttributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42808,6 +43612,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -42838,11 +43649,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42860,6 +43764,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -42912,11 +43823,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42934,6 +43938,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -43024,6 +44035,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -43035,6 +44100,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -43078,6 +44150,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43095,6 +44174,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -43212,6 +44298,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -43223,6 +44363,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -43266,6 +44413,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43283,6 +44437,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -43376,11 +44537,25 @@
"CloudWorkloadSecurityAgentRuleUpdateAttributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43391,6 +44566,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -43412,11 +44594,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43427,6 +44623,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -43475,11 +44678,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43490,6 +44707,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -43581,6 +44805,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -43592,6 +44870,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -43635,6 +44920,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43652,6 +44944,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -438254,6 +439553,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -438265,6 +439618,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -438308,6 +439668,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -438325,6 +439692,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -438490,11 +439864,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -438512,6 +439979,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -438597,6 +440071,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -438608,6 +440136,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -438651,6 +440186,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -438668,6 +440210,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -438873,7 +440422,7 @@
"parameters": [
{
"name": "body",
- "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
+ "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
}
],
"step": "there is a valid \"agent_rule_rc\" in the system"
@@ -439072,6 +440621,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -439083,6 +440686,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -439126,6 +440736,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -439143,6 +440760,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -439356,11 +440980,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -439371,6 +441009,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -439452,6 +441097,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -439463,6 +441162,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -439506,6 +441212,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -439523,6 +441236,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -439994,6 +441714,85 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -440836,6 +442635,85 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -492751,6 +494629,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -492762,6 +494694,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -492805,6 +494744,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -492822,6 +494768,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -492993,11 +494946,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493015,6 +495061,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -493100,6 +495153,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -493111,6 +495218,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -493154,6 +495268,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493171,6 +495292,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -493567,6 +495695,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -493578,6 +495760,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -493621,6 +495810,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493638,6 +495834,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -493847,11 +496050,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493862,6 +496079,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -493943,6 +496167,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -493954,6 +496232,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -493997,6 +496282,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -494014,6 +496306,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
diff --git a/static/resources/json/full_spec_v2.json b/static/resources/json/full_spec_v2.json
index fed98235feaef..28c956eaf64b9 100644
--- a/static/resources/json/full_spec_v2.json
+++ b/static/resources/json/full_spec_v2.json
@@ -41933,6 +41933,85 @@
"CloudWorkloadSecurityAgentPolicyCreateAttributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -41977,6 +42056,85 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42043,6 +42201,85 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42400,6 +42637,85 @@
"CloudWorkloadSecurityAgentPolicyUpdateAttributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42441,6 +42757,85 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42509,6 +42904,85 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -42607,6 +43081,114 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "CloudWorkloadSecurityAgentRuleActionMetadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "CloudWorkloadSecurityAgentRuleActionSet": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
}
},
"type": "object"
@@ -42629,6 +43211,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -42657,6 +43293,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -42668,6 +43358,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -42711,6 +43408,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42728,6 +43432,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -42786,11 +43497,104 @@
"CloudWorkloadSecurityAgentRuleCreateAttributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42808,6 +43612,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -42838,11 +43649,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42860,6 +43764,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -42912,11 +43823,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -42934,6 +43938,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -43024,6 +44035,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -43035,6 +44100,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -43078,6 +44150,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43095,6 +44174,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -43212,6 +44298,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -43223,6 +44363,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -43266,6 +44413,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43283,6 +44437,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -43376,11 +44537,25 @@
"CloudWorkloadSecurityAgentRuleUpdateAttributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43391,6 +44566,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -43412,11 +44594,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43427,6 +44623,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -43475,11 +44678,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43490,6 +44707,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -43581,6 +44805,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -43592,6 +44870,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -43635,6 +44920,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -43652,6 +44944,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -438254,6 +439553,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -438265,6 +439618,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -438308,6 +439668,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -438325,6 +439692,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -438490,11 +439864,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -438512,6 +439979,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -438597,6 +440071,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -438608,6 +440136,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -438651,6 +440186,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -438668,6 +440210,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -438873,7 +440422,7 @@
"parameters": [
{
"name": "body",
- "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
+ "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}"
}
],
"step": "there is a valid \"agent_rule_rc\" in the system"
@@ -439072,6 +440621,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -439083,6 +440686,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -439126,6 +440736,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -439143,6 +440760,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -439356,11 +440980,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -439371,6 +441009,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -439452,6 +441097,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -439463,6 +441162,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -439506,6 +441212,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -439523,6 +441236,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -439994,6 +441714,85 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -440836,6 +442635,85 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent policy",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
"description": {
"description": "The description of the policy",
"example": "My agent policy",
@@ -492751,6 +494629,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -492762,6 +494694,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -492805,6 +494744,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -492822,6 +494768,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -492993,11 +494946,104 @@
"attributes": {
"description": "Create a new Cloud Workload Security Agent rule.",
"properties": {
+ "actions": {
+ "description": "The array of actions the rule can perform if triggered",
+ "items": {
+ "description": "The action the rule can perform if triggered",
+ "properties": {
+ "filter": {
+ "description": "SECL expression used to target the container to apply the action on",
+ "type": "string"
+ },
+ "kill": {
+ "description": "Kill system call applied on the container matching the rule",
+ "properties": {
+ "signal": {
+ "description": "Supported signals for the kill system call",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nullable": true,
+ "type": "array"
+ },
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule.",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493015,6 +495061,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule.",
"example": "my_agent_rule",
@@ -493100,6 +495153,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -493111,6 +495218,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -493154,6 +495268,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493171,6 +495292,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -493567,6 +495695,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -493578,6 +495760,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -493621,6 +495810,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493638,6 +495834,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",
@@ -493847,11 +496050,25 @@
"attributes": {
"description": "Update an existing Cloud Workload Security Agent rule",
"properties": {
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"description": {
"description": "The description of the Agent rule",
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -493862,6 +496079,13 @@
"example": "exec.file.name == \"sh\"",
"type": "string"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"policy_id": {
"description": "The ID of the policy where the Agent rule is saved",
"example": "a8c8e364-6556-434d-b798-a4c23de29c0b",
@@ -493943,6 +496167,60 @@
}
},
"type": "object"
+ },
+ "metadata": {
+ "description": "The metadata action applied on the scope matching the rule",
+ "properties": {
+ "image_tag": {
+ "description": "The image tag of the metadata action",
+ "type": "string"
+ },
+ "service": {
+ "description": "The service of the metadata action",
+ "type": "string"
+ },
+ "short_image": {
+ "description": "The short image of the metadata action",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "set": {
+ "description": "The set action applied on the scope matching the rule",
+ "properties": {
+ "append": {
+ "description": "Whether the value should be appended to the field",
+ "type": "boolean"
+ },
+ "field": {
+ "description": "The field of the set action",
+ "type": "string"
+ },
+ "name": {
+ "description": "The name of the set action",
+ "type": "string"
+ },
+ "scope": {
+ "description": "The scope of the set action",
+ "type": "string"
+ },
+ "size": {
+ "description": "The size of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "ttl": {
+ "description": "The time to live of the set action",
+ "format": "int64",
+ "type": "integer"
+ },
+ "value": {
+ "description": "The value of the set action",
+ "type": "string"
+ }
+ },
+ "type": "object"
}
},
"type": "object"
@@ -493954,6 +496232,13 @@
"description": "The version of the Agent",
"type": "string"
},
+ "blocking": {
+ "description": "The blocking policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"category": {
"description": "The category of the Agent rule",
"example": "Process Activity",
@@ -493997,6 +496282,13 @@
"example": "My Agent rule",
"type": "string"
},
+ "disabled": {
+ "description": "The disabled policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"enabled": {
"description": "Whether the Agent rule is enabled",
"example": true,
@@ -494014,6 +496306,13 @@
},
"type": "array"
},
+ "monitoring": {
+ "description": "The monitoring policies that the rule belongs to",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
"name": {
"description": "The name of the Agent rule",
"example": "my_agent_rule",