Manage or list the custom rules like adding, updating, deleting, and batch updating.
Service | rules |
Permission | Object XML API |
Version | list — 4.4.9 or later add, update, delete — 4.6.3 or later batchupdate — 4.6.5 or later |
Parameter | Definition |
|---|---|
HH$Id | ID of the selected rule. Valid for the operations; list, update, delete |
HH$Name | Select a rule by name or give the rule a name during add action |
HH$NewName | The new rule name when updating the rule. Valid only for the update operation. Optional but cannot be empty. |
HH$RuleType | Filter rules by type: custom/predefined, default=custom (optional parameter) Predefined rules cannot be added or deleted. Predefined rules can be updated, however, these fields are protected: Rule Name, Rule Expression, Send Alert Action, and Advanced Rule Options. |
HH$Severity | Filter rules by send alert severity The severities are namely, INFO, NOTICE, LOW, MEDIUM, and HIGH |
HH$SortOrder | The sort order number representing the new location of the new or updated rule The sort number starts at 1 and can be seen on the Custom Rules list, under the column no. |
HH$Operation | The operation to perform list, add, delete, and update Default value is list. All rule types (custom, predefined) can be listed, but only custom rules can be managed. Delete requires RuleType parameter. |
HH$Expression | The rule expression that is sent to the sensor |
HH$Exceptions | List of exception expressions separated by a logical operator that can be either $OR$ (OR operator) or $AND$ (AND operator). An example of three expressions: object = '888-888' OR action CONTAINS '8888' $OR$ cmdtype NOT IN ('update') $AND$ client_ip = 1.2.3.4 AND client_host_name LIKE 'host' |
HH$InstallOnDBs | Install this rule on a list of databases by ID |
HH$InstallOnDBGroups | Install this rule on a list of database groups by name |
HH$InstallOnDBsExclude | Exclude installation of this rule on a list of databases by ID |
HH$Tags | A list of tags |
HH$Comment | The comment field |
HH$Enable | Enable rule true or false The default value is true |
HH$RuleAction | The action to perform when a rule is matched The send_alert action parameter requires to_archive or console to be included. 4.8.6 or later also accept log_file. |
The format of HH$RuleAction parameter is JSON-like as follows:
{
allow_rule : {
global_allow,
}
|
send_alert :
{
severity: INFO|NOTICE|LOW|MEDIUM|HIGH¹,
to_archive | log_file |
console : {
snmp_trap, terminate_session:{quarantine_user_for:10}
},
syslog: TRACE|DEBUG|INFO|WARN|ERROR|FATAL,
event_log:TRACE|DEBUG|INFO|WARN|ERROR|FATAL,
log_file: TRACE|DEBUG|INFO|WARN|ERROR|FATAL,
email:
{
severity: INFO|NOTICE|LOW|MEDIUM|HIGH,
addresses: “list_of_email_addresses”²
},
stop_processing_rules
}
}¹ Action Severities (INFO, NOTICE, LOW, MEDIUM, HIGH) and Log Levels (TRACE, DEBUG, INFO, WARN, ERROR, and FATAL) should be in upper case
² list_of_email_addresses is a list of email addresses separated by a semicolon. The entire list should be enclosed in double quotes.
Parameter | Definition |
|---|---|
HH$EditRoles | The roles that are granted edit permission for this rule |
HH$AdvancedOptions | Advanced rule options currently contain just the monitoring source The format is JSON-like, for example: |
HH$AdvActionScript | Action script |
HH$AdvSensitiveRegex | Mask sensitive data regular expression |
HH$AdvLimitAlertsSec | Limit alerts per second, value can be one of 1,5,10,100,1000 or -1 which mean unlimited The default value is 1000 |
HH$AdvLimitAlertsSession | Limit alerts per session, value can be one of 1,5,10,100,1000 or -1 which means unlimited The default value is -1 |
HH$AdvMinRowsForAlert | Minimum rows for alert |
HH$AdvApplyActionsRuleTrigger | A list of 2 numbers N, S that means you can apply actions when rule triggers N times in S seconds |
HH$AdvAutoResolve | Automatically resolve to one of the values: False Alarm, Resolved |
HH$AdvIgnoreSigned | True or false The default value is false |
HH$AddTerminateSession | True or false The parameter is used for batch updates |
HH$AddQuarantineUserFor | A number that is used for batch updates When specified and the value is > 0, then this rule action will be added/updated. When the value is 0, then the rule action will be removed from the filtered rules |
Note
You can use the HH$Id parameter and specify the rule ID. However, note that the rules use revisions and the ID might change with a new revision. The best option to identify a rule is by its name.
Examples | |||||||||||||||||||||||||||||||||||||||||||
List | List all custom rules:
List all predefined rules: Get specific rule with ID=210: Get specific rule with name=MyRule: | ||||||||||||||||||||||||||||||||||||||||||
Add | Add a new rule with:
For the sake of simplicity, the parameters and their values are listed. Parameters needs to be https://www.urlencoder.org/.
| ||||||||||||||||||||||||||||||||||||||||||
Sort order | The custom rule Monitor Credit Table has a sort order of 8, and it needs to be moved to the end of the list which has 65 rules.
| ||||||||||||||||||||||||||||||||||||||||||
Delete | Delete the rule with the name: big-rule | ||||||||||||||||||||||||||||||||||||||||||
Update | Update the rule with the name: Big-rule and set new values. Note that the Exclude DBs value is erased
| ||||||||||||||||||||||||||||||||||||||||||
Batch update | Batch update all the vPatch rules with Severity=HIGH by adding Terminate action and Quarantine = 12.
| ||||||||||||||||||||||||||||||||||||||||||
Note
When updating the rule, if you want to reset the value of a specific parameter, then the value of that parameter should be left empty.