Connect rule create

Create rules in a connect rule policy.

POST https://<API_HOST>/api/v1/policies/policy1_uuid/configuration/rules/connect/accept

POST https://<API_HOST>/api/v1/policies/policy1_uuid/configuration/rules/connect/deny

POST https://<API_HOST>/api/v1/policies/policy1_uuid/configuration/rules/connect/throttle

POST https://<API_HOST>/api/v1/policies/policy1_uuid/configuration/rules/connect/tls

POST https://<API_HOST>/api/v1/policies/policy1_uuid/configuration/rules/connect/trusted_sender

Note
If the rule is already configured, the POST call deletes all existing entries across all rule types (senders, reverse_domains, etc.) for the action specified in the POST call (accept, deny, etc.). It then adds the new entries for the rule types specified in the POST call for the specified action.
The maximum rule limit is 30000 per field. If the policy is associated to a domain/domain group, the combined aggregation of all policies associated to the domain/domain group is considered.
The maximum input limit is 5000 per field per request.
TLS rules accept sender_domains only.
Trusted Sender rules accept sender_domains and sender only.

Required headers:

If the domain you use to access the Trellix UI ends in fireeye.com:

x-fireeye-api-key: <key>—Specifies your personal API key.

If the domain you use to access the Trellix UI ends in trellix.com:

authorization: bearer <access_token>—Specifies your personal access token.

Content-Type: “application/json”—Content type of the request body.

Options

policy1_uuid—(String) Universally unique identifier (UUID) of the policy.

accept—Specifies rule type: accept.

deny—Specifies rule type: deny.

throttle—Specifies rule type: throttle.

tls—Specifies rule type: tls.

trusted_sender—Specifies rule type: trusted_sender.

Request body schema

The following table provides the request body schema:

Parameter	Mandatory field	Type	Value	Description
`reverse_domains`	No	[ ]string
`countries`	No	[ ]string	[ "uk", "us", "ca" ]	Maximum 2 characters.
`sender_domains`	No	[ ]string		Sender domain address
`recipients`	No	[ ]string		Email address of recipients.
`sender_ips`	No	[ ]string	[ "10.0.0.1/24"]	Only IPv4 ip addresses are allowed.
`sender`	No	[ ]string	["a@b.com", "c@d.com"]

Request body

{
    "configuration":
    {
        "rules":
        {
            "connect":
            {
                "accept":
                {
                    "sender_domains": ["d1.com", "d2.com"],
                    "countries": ["us"],
                    "sender_ips": ["10.0.0.1/24"],
                    "sender": ["a@b.com", "c@d.com"]
                }
            }
        }
    }
}

Example of the response

{
    "data":
    {
        "policy_master_uuid": "policy1_uuid",
        "accept": 
        {
            "countries": ["us"],
            "sender_domains": ["d1.com", "d2.com"],
            "sender_ips": ["10.0.0.1/24"],
            "sender": ["a@b.com", "c@d.com"]
        }
    },
    "meta":
    {
        "copyright": "xxxxxxxxxx",
        "type": "Connect Rules"
    }
}

cURL code sample: connect rule create

curl -k -X POST https://API_HOST/api/v1/policies/755defef-b30c-4ea5-a19c-dd97f8ed697c/configuration/rules/connect/accept -H 'Content-Type: application/json' -H 'x-fireeye-api-key: xxxxxxxxxxxxx' -d '{"sender": ["a@b.com", "c@d.com"]}

This cURL sample include the following options:

-X POST—This option changes the HTTP method to POST.
-H 'Content-Type: application/json'—This header specifies that the request body is sent to the server in JSON format.
-H 'x-fireeye-api-key: xxxxxxxxxxxxxxx'—This header specifies your personal API key.
https://API_HOST/api/v1/policies/755defef-b30c-4ea5-a19c-dd97f8ed697c/configuration/rules/connect/accept—The connect rule create URL. Replace API_HOST with the IP address of your Email Security - Cloud instance and 755defef-b30c-4ea5-a19c-dd97f8ed697c with the UUID of the connect rule policy.
-d '{"sender": ["a@b.com", "c@d.com"]}—Creates a connect rule to accept mail from senders "a@b.com" and "c@d.com".