diff --git a/.apigentools-info b/.apigentools-info index 6c12e0aab33c4..4af95642126d4 100644 --- a/.apigentools-info +++ b/.apigentools-info @@ -4,13 +4,13 @@ "spec_versions": { "v1": { "apigentools_version": "1.6.6", - "regenerated": "2025-05-14 15:46:38.896407", - "spec_repo_commit": "64f5e7ee" + "regenerated": "2025-05-16 19:13:35.676057", + "spec_repo_commit": "31b66a21" }, "v2": { "apigentools_version": "1.6.6", - "regenerated": "2025-05-14 15:46:48.228708", - "spec_repo_commit": "64f5e7ee" + "regenerated": "2025-05-16 19:13:44.753345", + "spec_repo_commit": "31b66a21" } } } \ No newline at end of file diff --git a/content/en/api/v2/csm-threats/examples.json b/content/en/api/v2/csm-threats/examples.json index ee0d0fe8c6652..7e07f40d56817 100644 --- a/content/en/api/v2/csm-threats/examples.json +++ b/content/en/api/v2/csm-threats/examples.json @@ -11,10 +11,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -24,9 +39,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -43,7 +60,7 @@ } ] }, - "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -79,10 +96,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -92,9 +124,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -110,7 +144,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -158,10 +192,35 @@ "json": { "data": { "attributes": { + "actions": [ + { + "filter": "string", + "kill": { + "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" + } + } + ], + "blocking": [], "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "policy_id": "a8c8e364-6556-434d-b798-a4c23de29c0b", "product_tags": [] @@ -169,7 +228,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } }, "DeleteCSMThreatsAgentRule": { @@ -216,10 +275,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -229,9 +303,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -247,7 +323,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -291,10 +367,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -304,9 +395,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -322,7 +415,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -375,9 +468,12 @@ "json": { "data": { "attributes": { + "blocking": [], "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", + "monitoring": [], "policy_id": "a8c8e364-6556-434d-b798-a4c23de29c0b", "product_tags": [] }, @@ -385,7 +481,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } }, "ListCSMThreatsAgentPolicies": { @@ -520,6 +616,28 @@ "json": { "data": { "attributes": { + "actions": [ + { + "filter": "string", + "kill": { + "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" + } + } + ], "description": "My agent policy", "enabled": true, "hostTags": [], @@ -529,7 +647,7 @@ "type": "policy" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent policy

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the policy

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the policy is enabled

\n
\n \n
\n
\n
\n
\n
\n

hostTags

\n
\n

[string]

\n

The host tags defining where this policy is deployed

\n
\n \n
\n
\n
\n
\n
\n

hostTagsLists

\n
\n

[array]

\n

The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the policy

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be policy \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent policy

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the policy

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the policy is enabled

\n
\n \n
\n
\n
\n
\n
\n

hostTags

\n
\n

[string]

\n

The host tags defining where this policy is deployed

\n
\n \n
\n
\n
\n
\n
\n

hostTagsLists

\n
\n

[array]

\n

The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the policy

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be policy \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" } }, "DownloadCSMThreatsPolicy": { @@ -738,6 +856,28 @@ "json": { "data": { "attributes": { + "actions": [ + { + "filter": "string", + "kill": { + "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" + } + } + ], "description": "My agent policy", "enabled": true, "hostTags": [], @@ -748,7 +888,7 @@ "type": "policy" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent policy

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent policy

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the policy

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the policy is enabled

\n
\n \n
\n
\n
\n
\n
\n

hostTags

\n
\n

[string]

\n

The host tags defining where this policy is deployed

\n
\n \n
\n
\n
\n
\n
\n

hostTagsLists

\n
\n

[array]

\n

The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the policy

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent policy

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be policy \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent policy

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent policy

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the policy

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the policy is enabled

\n
\n \n
\n
\n
\n
\n
\n

hostTags

\n
\n

[string]

\n

The host tags defining where this policy is deployed

\n
\n \n
\n
\n
\n
\n
\n

hostTagsLists

\n
\n

[array]

\n

The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the policy

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent policy

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be policy \nAllowed enum values: policy

default: policy

\n
\n \n
\n
\n
\n
" } }, "DownloadCloudWorkloadPolicyFile": { @@ -792,10 +932,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -805,9 +960,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -824,7 +981,7 @@ } ] }, - "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

[object]

\n

A list of Agent rules objects

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -860,10 +1017,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -873,9 +1045,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -891,7 +1065,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -939,10 +1113,35 @@ "json": { "data": { "attributes": { + "actions": [ + { + "filter": "string", + "kill": { + "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" + } + } + ], + "blocking": [], "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "policy_id": "a8c8e364-6556-434d-b798-a4c23de29c0b", "product_tags": [] @@ -950,7 +1149,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Create a new Cloud Workload Security Agent rule.

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression [required]

\n
\n

string

\n

The SECL expression of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name [required]

\n
\n

string

\n

The name of the Agent rule.

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } }, "DeleteCloudWorkloadSecurityAgentRule": { @@ -997,10 +1196,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -1010,9 +1224,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -1028,7 +1244,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "403": { "json": { @@ -1072,10 +1288,25 @@ "filter": "string", "kill": { "signal": "string" + }, + "metadata": { + "image_tag": "string", + "service": "string", + "short_image": "string" + }, + "set": { + "append": false, + "field": "string", + "name": "string", + "scope": "string", + "size": "integer", + "ttl": "integer", + "value": "string" } } ], "agentConstraint": "string", + "blocking": [], "category": "Process Activity", "creationAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", "creationDate": 1624366480320, @@ -1085,9 +1316,11 @@ }, "defaultRule": false, "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", "filters": [], + "monitoring": [], "name": "my_agent_rule", "product_tags": [], "updateAuthorUuId": "e51c9744-d158-11ec-ad23-da7ad0900002", @@ -1103,7 +1336,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes

\n
\n

object

\n

A Cloud Workload Security Agent rule returned by the API

\n
\n
\n
\n
\n
\n

actions

\n
\n

[object]

\n

The array of actions the rule can perform if triggered

\n
\n
\n
\n
\n
\n

filter

\n
\n

string

\n

SECL expression used to target the container to apply the action on

\n
\n \n
\n
\n
\n
\n
\n

kill

\n
\n

object

\n

Kill system call applied on the container matching the rule

\n
\n
\n
\n
\n
\n

signal

\n
\n

string

\n

Supported signals for the kill system call

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

metadata

\n
\n

object

\n

The metadata action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

image_tag

\n
\n

string

\n

The image tag of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

service

\n
\n

string

\n

The service of the metadata action

\n
\n \n
\n
\n
\n
\n
\n

short_image

\n
\n

string

\n

The short image of the metadata action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

set

\n
\n

object

\n

The set action applied on the scope matching the rule

\n
\n
\n
\n
\n
\n

append

\n
\n

boolean

\n

Whether the value should be appended to the field

\n
\n \n
\n
\n
\n
\n
\n

field

\n
\n

string

\n

The field of the set action

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the set action

\n
\n \n
\n
\n
\n
\n
\n

scope

\n
\n

string

\n

The scope of the set action

\n
\n \n
\n
\n
\n
\n
\n

size

\n
\n

int64

\n

The size of the set action

\n
\n \n
\n
\n
\n
\n
\n

ttl

\n
\n

int64

\n

The time to live of the set action

\n
\n \n
\n
\n
\n
\n
\n

value

\n
\n

string

\n

The value of the set action

\n
\n \n
\n
\n
\n
\n
\n
\n
\n
\n
\n

agentConstraint

\n
\n

string

\n

The version of the Agent

\n
\n \n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

category

\n
\n

string

\n

The category of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

creationAuthorUuId

\n
\n

string

\n

The ID of the user who created the rule

\n
\n \n
\n
\n
\n
\n
\n

creationDate

\n
\n

int64

\n

When the Agent rule was created, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

creator

\n
\n

object

\n

The attributes of the user who created the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

defaultRule

\n
\n

boolean

\n

Whether the rule is included by default

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

filters

\n
\n

[string]

\n

The platforms the Agent rule is supported on

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n

updateAuthorUuId

\n
\n

string

\n

The ID of the user who updated the rule

\n
\n \n
\n
\n
\n
\n
\n

updateDate

\n
\n

int64

\n

Timestamp in milliseconds when the Agent rule was last updated

\n
\n \n
\n
\n
\n
\n
\n

updatedAt

\n
\n

int64

\n

When the Agent rule was last updated, timestamp in milliseconds

\n
\n \n
\n
\n
\n
\n
\n

updater

\n
\n

object

\n

The attributes of the user who last updated the Agent rule

\n
\n
\n
\n
\n
\n

handle

\n
\n

string

\n

The handle of the user

\n
\n \n
\n
\n
\n
\n
\n

name

\n
\n

string

\n

The name of the user

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

version

\n
\n

int64

\n

The version of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" }, "400": { "json": { @@ -1156,9 +1389,12 @@ "json": { "data": { "attributes": { + "blocking": [], "description": "My Agent rule", + "disabled": [], "enabled": true, "expression": "exec.file.name == \"sh\"", + "monitoring": [], "policy_id": "a8c8e364-6556-434d-b798-a4c23de29c0b", "product_tags": [] }, @@ -1166,7 +1402,7 @@ "type": "agent_rule" } }, - "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" + "html": "
\n
\n
\n
\n

data [required]

\n
\n

object

\n

Object for a single Agent rule

\n
\n
\n
\n
\n
\n

attributes [required]

\n
\n

object

\n

Update an existing Cloud Workload Security Agent rule

\n
\n
\n
\n
\n
\n

blocking

\n
\n

[string]

\n

The blocking policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

description

\n
\n

string

\n

The description of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

disabled

\n
\n

[string]

\n

The disabled policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

enabled

\n
\n

boolean

\n

Whether the Agent rule is enabled

\n
\n \n
\n
\n
\n
\n
\n

expression

\n
\n

string

\n

The SECL expression of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

monitoring

\n
\n

[string]

\n

The monitoring policies that the rule belongs to

\n
\n \n
\n
\n
\n
\n
\n

policy_id

\n
\n

string

\n

The ID of the policy where the Agent rule is saved

\n
\n \n
\n
\n
\n
\n
\n

product_tags

\n
\n

[string]

\n

The list of product tags associated with the rule

\n
\n \n
\n
\n
\n
\n
\n
\n
\n

id

\n
\n

string

\n

The ID of the Agent rule

\n
\n \n
\n
\n
\n
\n
\n

type [required]

\n
\n

enum

\n

The type of the resource, must always be agent_rule \nAllowed enum values: agent_rule

default: agent_rule

\n
\n \n
\n
\n
\n
" } } } \ No newline at end of file diff --git a/content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1176049761.json b/content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1176049761.json new file mode 100644 index 0000000000000..4b2457526e908 --- /dev/null +++ b/content/en/api/v2/csm-threats/request.CreateCSMThreatsAgentRule_1176049761.json @@ -0,0 +1,23 @@ +{ + "data": { + "attributes": { + "description": "My Agent rule with set action", + "enabled": true, + "expression": "exec.file.name == \"sh\"", + "filters": [], + "name": "examplecsmthreat", + "policy_id": "6517fcc1-cec7-4394-a655-8d6e9d085255", + "product_tags": [], + "actions": [ + { + "set": { + "name": "test_set", + "value": "test_value", + "scope": "process" + } + } + ] + }, + "type": "agent_rule" + } +} \ No newline at end of file diff --git a/data/api/v2/CodeExamples.json b/data/api/v2/CodeExamples.json index 06834c141262a..73a4a0041814e 100644 --- a/data/api/v2/CodeExamples.json +++ b/data/api/v2/CodeExamples.json @@ -212,6 +212,11 @@ "group": "csm_threats", "suffix": "", "description": "Create a CSM Threats Agent rule returns \"OK\" response" + }, + { + "group": "csm_threats", + "suffix": "_1176049761", + "description": "Create a CSM Threats Agent rule with set action returns \"OK\" response" } ], "CreateCloudWorkloadSecurityAgentRule": [ diff --git a/data/api/v2/full_spec.yaml b/data/api/v2/full_spec.yaml index 299b55863ff2d..996b6d3c316a9 100644 --- a/data/api/v2/full_spec.yaml +++ b/data/api/v2/full_spec.yaml @@ -7373,6 +7373,8 @@ components: CloudWorkloadSecurityAgentPolicyCreateAttributes: description: Create a new Cloud Workload Security Agent policy properties: + actions: + $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions' description: description: The description of the policy example: My agent policy @@ -7454,6 +7456,8 @@ components: CloudWorkloadSecurityAgentPolicyUpdateAttributes: description: Update an existing Cloud Workload Security Agent policy properties: + actions: + $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions' description: description: The description of the policy example: My agent policy @@ -7524,6 +7528,50 @@ components: type: string kill: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill' + metadata: + $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata' + set: + $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet' + type: object + CloudWorkloadSecurityAgentRuleActionMetadata: + description: The metadata action applied on the scope matching the rule + properties: + image_tag: + description: The image tag of the metadata action + type: string + service: + description: The service of the metadata action + type: string + short_image: + description: The short image of the metadata action + type: string + type: object + CloudWorkloadSecurityAgentRuleActionSet: + description: The set action applied on the scope matching the rule + properties: + append: + description: Whether the value should be appended to the field + type: boolean + field: + description: The field of the set action + type: string + name: + description: The name of the set action + type: string + scope: + description: The scope of the set action + type: string + size: + description: The size of the set action + format: int64 + type: integer + ttl: + description: The time to live of the set action + format: int64 + type: integer + value: + description: The value of the set action + type: string type: object CloudWorkloadSecurityAgentRuleActions: description: The array of actions the rule can perform if triggered @@ -7539,6 +7587,11 @@ components: agentConstraint: description: The version of the Agent type: string + blocking: + description: The blocking policies that the rule belongs to + items: + type: string + type: array category: description: The category of the Agent rule example: Process Activity @@ -7562,6 +7615,11 @@ components: description: The description of the Agent rule example: My Agent rule type: string + disabled: + description: The disabled policies that the rule belongs to + items: + type: string + type: array enabled: description: Whether the Agent rule is enabled example: true @@ -7575,6 +7633,11 @@ components: items: type: string type: array + monitoring: + description: The monitoring policies that the rule belongs to + items: + type: string + type: array name: description: The name of the Agent rule example: my_agent_rule @@ -7609,10 +7672,22 @@ components: CloudWorkloadSecurityAgentRuleCreateAttributes: description: Create a new Cloud Workload Security Agent rule. properties: + actions: + $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions' + blocking: + description: The blocking policies that the rule belongs to + items: + type: string + type: array description: description: The description of the Agent rule. example: My Agent rule type: string + disabled: + description: The disabled policies that the rule belongs to + items: + type: string + type: array enabled: description: Whether the Agent rule is enabled example: true @@ -7626,6 +7701,11 @@ components: items: type: string type: array + monitoring: + description: The monitoring policies that the rule belongs to + items: + type: string + type: array name: description: The name of the Agent rule. example: my_agent_rule @@ -7716,10 +7796,20 @@ components: CloudWorkloadSecurityAgentRuleUpdateAttributes: description: Update an existing Cloud Workload Security Agent rule properties: + blocking: + description: The blocking policies that the rule belongs to + items: + type: string + type: array description: description: The description of the Agent rule example: My Agent rule type: string + disabled: + description: The disabled policies that the rule belongs to + items: + type: string + type: array enabled: description: Whether the Agent rule is enabled example: true @@ -7728,6 +7818,11 @@ components: description: The SECL expression of the Agent rule example: exec.file.name == "sh" type: string + monitoring: + description: The monitoring policies that the rule belongs to + items: + type: string + type: array policy_id: description: The ID of the policy where the Agent rule is saved example: a8c8e364-6556-434d-b798-a4c23de29c0b @@ -55622,8 +55717,9 @@ paths: {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \ \"enabled\": true,\n \"product_tags\": [\"security:attack\", - \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n - \ }\n }\n}" + \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", + \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": + \"{{ policy.data.id }}\"\n }\n }\n}" step: there is a valid "agent_rule_rc" in the system x-menu-order: 4 x-undo: diff --git a/data/api/v2/full_spec_deref.json b/data/api/v2/full_spec_deref.json index fed98235feaef..28c956eaf64b9 100644 --- a/data/api/v2/full_spec_deref.json +++ b/data/api/v2/full_spec_deref.json @@ -41933,6 +41933,85 @@ "CloudWorkloadSecurityAgentPolicyCreateAttributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -41977,6 +42056,85 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42043,6 +42201,85 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42400,6 +42637,85 @@ "CloudWorkloadSecurityAgentPolicyUpdateAttributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42441,6 +42757,85 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42509,6 +42904,85 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42607,6 +43081,114 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "CloudWorkloadSecurityAgentRuleActionMetadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "CloudWorkloadSecurityAgentRuleActionSet": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" } }, "type": "object" @@ -42629,6 +43211,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -42657,6 +43293,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -42668,6 +43358,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -42711,6 +43408,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42728,6 +43432,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -42786,11 +43497,104 @@ "CloudWorkloadSecurityAgentRuleCreateAttributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42808,6 +43612,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -42838,11 +43649,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42860,6 +43764,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -42912,11 +43823,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42934,6 +43938,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -43024,6 +44035,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -43035,6 +44100,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -43078,6 +44150,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43095,6 +44174,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -43212,6 +44298,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -43223,6 +44363,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -43266,6 +44413,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43283,6 +44437,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -43376,11 +44537,25 @@ "CloudWorkloadSecurityAgentRuleUpdateAttributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43391,6 +44566,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -43412,11 +44594,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43427,6 +44623,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -43475,11 +44678,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43490,6 +44707,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -43581,6 +44805,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -43592,6 +44870,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -43635,6 +44920,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43652,6 +44944,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -438254,6 +439553,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -438265,6 +439618,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -438308,6 +439668,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -438325,6 +439692,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -438490,11 +439864,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -438512,6 +439979,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -438597,6 +440071,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -438608,6 +440136,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -438651,6 +440186,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -438668,6 +440210,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -438873,7 +440422,7 @@ "parameters": [ { "name": "body", - "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}" + "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}" } ], "step": "there is a valid \"agent_rule_rc\" in the system" @@ -439072,6 +440621,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -439083,6 +440686,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -439126,6 +440736,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -439143,6 +440760,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -439356,11 +440980,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -439371,6 +441009,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -439452,6 +441097,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -439463,6 +441162,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -439506,6 +441212,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -439523,6 +441236,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -439994,6 +441714,85 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -440836,6 +442635,85 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -492751,6 +494629,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -492762,6 +494694,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -492805,6 +494744,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -492822,6 +494768,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -492993,11 +494946,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493015,6 +495061,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -493100,6 +495153,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -493111,6 +495218,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -493154,6 +495268,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493171,6 +495292,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -493567,6 +495695,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -493578,6 +495760,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -493621,6 +495810,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493638,6 +495834,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -493847,11 +496050,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493862,6 +496079,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -493943,6 +496167,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -493954,6 +496232,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -493997,6 +496282,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -494014,6 +496306,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", diff --git a/static/resources/json/full_spec_v2.json b/static/resources/json/full_spec_v2.json index fed98235feaef..28c956eaf64b9 100644 --- a/static/resources/json/full_spec_v2.json +++ b/static/resources/json/full_spec_v2.json @@ -41933,6 +41933,85 @@ "CloudWorkloadSecurityAgentPolicyCreateAttributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -41977,6 +42056,85 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42043,6 +42201,85 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42400,6 +42637,85 @@ "CloudWorkloadSecurityAgentPolicyUpdateAttributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42441,6 +42757,85 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42509,6 +42904,85 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -42607,6 +43081,114 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "CloudWorkloadSecurityAgentRuleActionMetadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "CloudWorkloadSecurityAgentRuleActionSet": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" } }, "type": "object" @@ -42629,6 +43211,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -42657,6 +43293,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -42668,6 +43358,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -42711,6 +43408,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42728,6 +43432,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -42786,11 +43497,104 @@ "CloudWorkloadSecurityAgentRuleCreateAttributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42808,6 +43612,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -42838,11 +43649,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42860,6 +43764,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -42912,11 +43823,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -42934,6 +43938,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -43024,6 +44035,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -43035,6 +44100,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -43078,6 +44150,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43095,6 +44174,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -43212,6 +44298,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -43223,6 +44363,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -43266,6 +44413,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43283,6 +44437,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -43376,11 +44537,25 @@ "CloudWorkloadSecurityAgentRuleUpdateAttributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43391,6 +44566,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -43412,11 +44594,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43427,6 +44623,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -43475,11 +44678,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43490,6 +44707,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -43581,6 +44805,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -43592,6 +44870,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -43635,6 +44920,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -43652,6 +44944,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -438254,6 +439553,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -438265,6 +439618,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -438308,6 +439668,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -438325,6 +439692,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -438490,11 +439864,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -438512,6 +439979,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -438597,6 +440071,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -438608,6 +440136,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -438651,6 +440186,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -438668,6 +440210,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -438873,7 +440422,7 @@ "parameters": [ { "name": "body", - "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}" + "value": "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}" } ], "step": "there is a valid \"agent_rule_rc\" in the system" @@ -439072,6 +440621,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -439083,6 +440686,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -439126,6 +440736,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -439143,6 +440760,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -439356,11 +440980,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -439371,6 +441009,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -439452,6 +441097,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -439463,6 +441162,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -439506,6 +441212,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -439523,6 +441236,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -439994,6 +441714,85 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -440836,6 +442635,85 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent policy", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, "description": { "description": "The description of the policy", "example": "My agent policy", @@ -492751,6 +494629,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -492762,6 +494694,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -492805,6 +494744,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -492822,6 +494768,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -492993,11 +494946,104 @@ "attributes": { "description": "Create a new Cloud Workload Security Agent rule.", "properties": { + "actions": { + "description": "The array of actions the rule can perform if triggered", + "items": { + "description": "The action the rule can perform if triggered", + "properties": { + "filter": { + "description": "SECL expression used to target the container to apply the action on", + "type": "string" + }, + "kill": { + "description": "Kill system call applied on the container matching the rule", + "properties": { + "signal": { + "description": "Supported signals for the kill system call", + "type": "string" + } + }, + "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "nullable": true, + "type": "array" + }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule.", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493015,6 +495061,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule.", "example": "my_agent_rule", @@ -493100,6 +495153,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -493111,6 +495218,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -493154,6 +495268,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493171,6 +495292,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -493567,6 +495695,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -493578,6 +495760,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -493621,6 +495810,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493638,6 +495834,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule", @@ -493847,11 +496050,25 @@ "attributes": { "description": "Update an existing Cloud Workload Security Agent rule", "properties": { + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "description": { "description": "The description of the Agent rule", "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -493862,6 +496079,13 @@ "example": "exec.file.name == \"sh\"", "type": "string" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "policy_id": { "description": "The ID of the policy where the Agent rule is saved", "example": "a8c8e364-6556-434d-b798-a4c23de29c0b", @@ -493943,6 +496167,60 @@ } }, "type": "object" + }, + "metadata": { + "description": "The metadata action applied on the scope matching the rule", + "properties": { + "image_tag": { + "description": "The image tag of the metadata action", + "type": "string" + }, + "service": { + "description": "The service of the metadata action", + "type": "string" + }, + "short_image": { + "description": "The short image of the metadata action", + "type": "string" + } + }, + "type": "object" + }, + "set": { + "description": "The set action applied on the scope matching the rule", + "properties": { + "append": { + "description": "Whether the value should be appended to the field", + "type": "boolean" + }, + "field": { + "description": "The field of the set action", + "type": "string" + }, + "name": { + "description": "The name of the set action", + "type": "string" + }, + "scope": { + "description": "The scope of the set action", + "type": "string" + }, + "size": { + "description": "The size of the set action", + "format": "int64", + "type": "integer" + }, + "ttl": { + "description": "The time to live of the set action", + "format": "int64", + "type": "integer" + }, + "value": { + "description": "The value of the set action", + "type": "string" + } + }, + "type": "object" } }, "type": "object" @@ -493954,6 +496232,13 @@ "description": "The version of the Agent", "type": "string" }, + "blocking": { + "description": "The blocking policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "category": { "description": "The category of the Agent rule", "example": "Process Activity", @@ -493997,6 +496282,13 @@ "example": "My Agent rule", "type": "string" }, + "disabled": { + "description": "The disabled policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "enabled": { "description": "Whether the Agent rule is enabled", "example": true, @@ -494014,6 +496306,13 @@ }, "type": "array" }, + "monitoring": { + "description": "The monitoring policies that the rule belongs to", + "items": { + "type": "string" + }, + "type": "array" + }, "name": { "description": "The name of the Agent rule", "example": "my_agent_rule",