---
title: "Create Report Rule"
method: POST
path: "/api/v2/ReportRules"
tags: ["ReportRules"]
---

# Create Report Rule

`POST /api/v2/ReportRules`

Create a report rule in your FortiCNAPP instance by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/ReportRules`

 Get the unique identifiers for the alert channels (`intGuidList`) array by invoking the `GET /api/v2/ReportRules` endpoint.

 In addition, the severity field is required if you create report rules for any of the following report types: `awsCloudtrailEvents`, `awsComplianceEvents`, `azureActivityLogEvents`, `azureComplianceEvents`, `gcpAuditTrailEvents`, `gcpComplianceEvents`, `platformEvents`, `agentEvents`.

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- ReportRulesCreateSchema
  - `filters` object, required — When sending a request, use this object to define the new report rule. When included in a response, this object contains details of a report rule. You can use these attributes when searching for existing report rules by invoking a GET request.
    - `name` string, required — The report rule's name.
    - `description` string — Summary of the report rule.
    - `enabled` unknown, required
    - `resourceGroups` string[] — The resource groups that you want the rule to apply to.
    - `severity` unknown[] — The severities that you want the rule to apply to. 1=Critical 2=High 3=Medium 4=Low 5=Info
      - unknown
  - `intgGuidList` string[], required — The alert channels for the rule to access.
  - `reportNotificationTypes` object, required — The report types that you want the rule to apply to.
    - `agentEvents` boolean
    - `awsCis14` boolean
    - `awsCis401` boolean
    - `awsCisS3` boolean
    - `awsCloudtrailEvents` boolean
    - `awsComplianceEvents` boolean
    - `awsCis14IsoIec270022022` boolean
    - `awsCyberEssentials22` boolean
    - `awsCsaCcm405` boolean
    - `azureActivityLogEvents` boolean
    - `azureCis` boolean
    - `azureCis131` boolean
    - `azureComplianceEvents` boolean
    - `azurePci` boolean
    - `azurePciRev2` boolean
    - `azureSoc` boolean
    - `azureSocRev2` boolean
    - `azureIso27001` boolean
    - `azureHipaa` boolean
    - `azureNistCsf` boolean
    - `azureNist80053Rev5` boolean
    - `azureNist800171Rev2` boolean
    - `gcpAuditTrailEvents` boolean
    - `gcpCis` boolean
    - `gcpComplianceEvents` boolean
    - `gcpHipaa` boolean
    - `gcpHipaaRev2` boolean
    - `gcpIso27001` boolean
    - `gcpCis12` boolean
    - `gcpCis13` boolean
    - `gcpK8s` boolean
    - `gcpPci` boolean
    - `gcpPciRev2` boolean
    - `gcpSoc` boolean
    - `gcpSocRev2` boolean
    - `gcpNistCsf` boolean
    - `gcpNist80053Rev4` boolean
    - `gcpNist800171Rev2` boolean
    - `hipaa` boolean
    - `iso2700` boolean
    - `k8sAuditLogEvents` boolean
    - `nist800-53Rev4` boolean
    - `nist800-171Rev2` boolean
    - `openShiftCompliance` boolean
    - `pci` boolean
    - `platformEvents` boolean
    - `soc` boolean
    - `awsSocRev2` boolean
    - `trendReport` boolean
    - `awsPciDss321` boolean
    - `awsNist80053Rev5` boolean
    - `awsSoc2` boolean
    - `awsNist800171Rev2` boolean
    - `awsNistCsf` boolean
    - `awsCmmc102` boolean
    - `awsHipaa` boolean
    - `awsIso270012013` boolean
    - `incidentEvents` boolean
  - `type` 'Report', required — The data type as `Report`.

## Response `201`

No Error

- object
  - `data` ReportRulesResponseSchema
    - `filters` object, required — When sending a request, use this object to define the new report rule. When included in a response, this object contains details of a report rule. You can use these attributes when searching for existing report rules by invoking a GET request.
      - `name` string, required — The report rule's name.
      - `description` string — Summary of the report rule.
      - `enabled` unknown, required
      - `resourceGroups` string[] — The resource groups that you want the rule to apply to.
      - `severity` unknown[] — The severities that you want the rule to apply to. 1=Critical 2=High 3=Medium 4=Low 5=Info
        - unknown
    - `intgGuidList` string[], required — The alert channels for the rule to access.
    - `reportNotificationTypes` object, required — The report types that you want the rule to apply to.
      - `agentEvents` boolean
      - `awsCis14` boolean
      - `awsCis401` boolean
      - `awsCisS3` boolean
      - `awsCloudtrailEvents` boolean
      - `awsComplianceEvents` boolean
      - `awsCis14IsoIec270022022` boolean
      - `awsCyberEssentials22` boolean
      - `awsCsaCcm405` boolean
      - `azureActivityLogEvents` boolean
      - `azureCis` boolean
      - `azureCis131` boolean
      - `azureComplianceEvents` boolean
      - `azurePci` boolean
      - `azurePciRev2` boolean
      - `azureSoc` boolean
      - `azureSocRev2` boolean
      - `azureIso27001` boolean
      - `azureHipaa` boolean
      - `azureNistCsf` boolean
      - `azureNist80053Rev5` boolean
      - `azureNist800171Rev2` boolean
      - `gcpAuditTrailEvents` boolean
      - `gcpCis` boolean
      - `gcpComplianceEvents` boolean
      - `gcpHipaa` boolean
      - `gcpHipaaRev2` boolean
      - `gcpIso27001` boolean
      - `gcpCis12` boolean
      - `gcpCis13` boolean
      - `gcpK8s` boolean
      - `gcpPci` boolean
      - `gcpPciRev2` boolean
      - `gcpSoc` boolean
      - `gcpSocRev2` boolean
      - `gcpNistCsf` boolean
      - `gcpNist80053Rev4` boolean
      - `gcpNist800171Rev2` boolean
      - `hipaa` boolean
      - `iso2700` boolean
      - `k8sAuditLogEvents` boolean
      - `nist800-53Rev4` boolean
      - `nist800-171Rev2` boolean
      - `openShiftCompliance` boolean
      - `pci` boolean
      - `platformEvents` boolean
      - `soc` boolean
      - `awsSocRev2` boolean
      - `trendReport` boolean
      - `awsPciDss321` boolean
      - `awsNist80053Rev5` boolean
      - `awsSoc2` boolean
      - `awsNist800171Rev2` boolean
      - `awsNistCsf` boolean
      - `awsCmmc102` boolean
      - `awsHipaa` boolean
      - `awsIso270012013` boolean
      - `incidentEvents` boolean
    - `type` 'Report', required — The data type as `Report`.
    - `mcGuid` string — Report Rule ID.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)