{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"rule_id": {
"type": "string",
"description": "The ID of the rule."
},
"calculatedFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"expression": {
"type": "string",
"description": "Expression."
},
"name": {
"type": "string",
"description": "Field name."
}
},
"required": [
"name",
"expression"
]
},
"description": "Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined."
},
"cases": {
"type": "array",
"items": {
"type": "object",
"properties": {
"actions": {
"type": "array",
"items": {
"type": "object",
"properties": {
"options": {
"type": "object",
"description": "Options for the rule action"
},
"type": {
"type": "string",
"description": "The action type."
}
}
},
"description": "Action to perform for each rule case."
},
"condition": {
"type": "string",
"description": "A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries."
},
"customStatus": {
"type": "string",
"enum": [
"info",
"low",
"medium",
"high",
"critical"
],
"description": "Severity of the Security Signal."
},
"name": {
"type": "string",
"description": "Name of the case."
},
"notifications": {
"type": "array",
"items": {
"type": "string"
},
"description": "Notification targets for each rule case."
},
"status": {
"type": "string",
"enum": [
"info",
"low",
"medium",
"high",
"critical"
],
"description": "Severity of the Security Signal."
}
}
},
"description": "Cases for generating signals."
},
"complianceSignalOptions": {
"type": "object",
"description": "How to generate compliance signals. Useful for cloud_configuration rules only.",
"properties": {
"defaultActivationStatus": {
"type": "boolean",
"description": "The default activation status."
},
"defaultGroupByFields": {
"type": "array",
"items": {
"type": "string"
},
"description": "The default group by fields."
},
"userActivationStatus": {
"type": "boolean",
"description": "Whether signals will be sent."
},
"userGroupByFields": {
"type": "array",
"items": {
"type": "string"
},
"description": "Fields to use to group findings by when sending signals."
}
}
},
"customMessage": {
"type": "string",
"description": "Custom/Overridden Message for generated signals (used in case of Default rule update)."
},
"customName": {
"type": "string",
"description": "Custom/Overridden name (used in case of Default rule update)."
},
"filters": {
"type": "array",
"items": {
"type": "object",
"properties": {
"action": {
"type": "string",
"enum": [
"require",
"suppress"
],
"description": "The type of filtering action."
},
"query": {
"type": "string",
"description": "Query for selecting logs to apply the filtering action."
}
}
},
"description": "Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules."
},
"groupSignalsBy": {
"type": "array",
"items": {
"type": "string"
},
"description": "Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups."
},
"hasExtendedTitle": {
"type": "boolean",
"description": "Whether the notifications include the triggering group-by values in their title."
},
"isEnabled": {
"type": "boolean",
"description": "Whether the rule is enabled."
},
"message": {
"type": "string",
"description": "Message for generated signals."
},
"name": {
"type": "string",
"description": "Name of the rule."
},
"options": {
"type": "object",
"description": "Options.",
"properties": {
"anomalyDetectionOptions": {
"type": "object",
"description": "Options on anomaly detection method."
},
"complianceRuleOptions": {
"type": "object",
"description": "Options for cloud_configuration rules. Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules."
},
"decreaseCriticalityBasedOnEnv": {
"type": "boolean",
"description": "If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`. The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`."
},
"detectionMethod": {
"type": "string",
"description": "The detection method.",
"enum": [
"threshold",
"new_value",
"anomaly_detection",
"impossible_travel",
"hardcoded",
"third_party",
"anomaly_threshold",
"sequence_detection"
]
},
"evaluationWindow": {
"type": "integer",
"description": "A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.",
"enum": [
0,
60,
300,
600,
900,
1800,
3600,
7200,
10800,
21600,
43200,
86400
]
},
"hardcodedEvaluatorType": {
"type": "string",
"description": "Hardcoded evaluator type.",
"enum": [
"log4shell"
]
},
"impossibleTravelOptions": {
"type": "object",
"description": "Options on impossible travel detection method."
},
"keepAlive": {
"type": "integer",
"description": "Once a signal is generated, the signal will remain \"open\" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.",
"enum": [
0,
60,
300,
600,
900,
1800,
3600,
7200,
10800,
21600,
43200,
86400
]
},
"maxSignalDuration": {
"type": "integer",
"description": "A signal will \"close\" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.",
"enum": [
0,
60,
300,
600,
900,
1800,
3600,
7200,
10800,
21600,
43200,
86400
]
},
"newValueOptions": {
"type": "object",
"description": "Options on new value detection method."
},
"sequenceDetectionOptions": {
"type": "object",
"description": "Options on sequence detection method."
},
"thirdPartyRuleOptions": {
"type": "object",
"description": "Options on third party detection method."
}
}
},
"queries": {
"type": "array",
"description": "Queries for selecting logs which are part of the rule."
},
"referenceTables": {
"type": "array",
"items": {
"type": "object",
"properties": {
"checkPresence": {
"type": "boolean",
"description": "Whether to include or exclude the matched values."
},
"columnName": {
"type": "string",
"description": "The name of the column in the reference table."
},
"logFieldPath": {
"type": "string",
"description": "The field in the log to match against the reference table."
},
"ruleQueryName": {
"type": "string",
"description": "The name of the query to apply the reference table to."
},
"tableName": {
"type": "string",
"description": "The name of the reference table."
}
}
},
"description": "Reference tables for the rule."
},
"schedulingOptions": {
"type": "object",
"description": "Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs.",
"properties": {
"rrule": {
"type": "string",
"description": "Schedule for the rule queries, written in RRULE syntax. See [RFC](https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html) for syntax reference."
},
"start": {
"type": "string",
"description": "Start date for the schedule, in ISO 8601 format without timezone."
},
"timezone": {
"type": "string",
"description": "Time zone of the start date, in the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) format."
}
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags for generated signals."
},
"thirdPartyCases": {
"type": "array",
"items": {
"type": "object",
"properties": {
"customStatus": {
"type": "string",
"enum": [
"info",
"low",
"medium",
"high",
"critical"
],
"description": "Severity of the Security Signal."
},
"name": {
"type": "string",
"description": "Name of the case."
},
"notifications": {
"type": "array",
"items": {
"type": "string"
},
"description": "Notification targets for each rule case."
},
"query": {
"type": "string",
"description": "A query to map a third party event to this case."
},
"status": {
"type": "string",
"enum": [
"info",
"low",
"medium",
"high",
"critical"
],
"description": "Severity of the Security Signal."
}
}
},
"description": "Cases for generating signals from third-party rules. Only available for third-party rules."
},
"version": {
"type": "integer",
"description": "The version of the rule being updated."
}
},
"required": [
"PCID",
"rule_id"
]
}
