Create rule

Adds a rule to the policy's rule set. All rules in a policy must share the same domain (network or filesystem); mixing domains is rejected.

Network actions: connect:tcp, connect:udp. Resources are hostnames (for example, example.com), wildcard subdomains (*.example.com for one level, **.example.com for any depth), hostnames with an optional port (for example, example.com:443), or CIDRs in IPv4 or IPv6 notation (for example, 10.0.0.0/8 or 2001:db8::/32).

Filesystem actions: read, write. Resources are paths (for example, /data). Use * to match within a single path segment and ** to match recursively across segments (for example, /data/**).

Changes may take up to five minutes to reach developer machines.

Request body

namestring required

Human-readable label for the rule.

actionsstring[] required

Network actions: connect:tcp, connect:udp. Filesystem actions: read, write. All actions in a rule must belong to the same domain; mixing network and filesystem actions in one rule is rejected.

resourcesstring[] required

Network domain: hostnames (for example, example.com), wildcard subdomains (*.example.com or **.example.com), hostnames with port (for example, example.com:443), or CIDRs in IPv4 or IPv6 notation (for example, 10.0.0.0/8 or 2001:db8::/32). Filesystem domain: paths (for example, /data); * matches within one path segment, ** matches recursively (for example, /data/**).

decision'allow' | 'deny' required

Outcome applied when this rule matches a request. deny always wins: if any rule in the policy matches with decision: deny, the request is denied even if other rules match with decision: allow.

Example request

{
  "name": "allow research mirrors",
  "actions": [
    "connect:tcp",
    "connect:udp"
  ],
  "resources": [
    "research.mitre.org",
    "cve.mitre.org"
  ],
  "decision": "allow"
}

Response

Rule created and added to the policy's rule set.

idstring required