---
title: "Search Report Rules"
method: POST
path: "/api/v2/ReportRules/search"
tags: ["ReportRules"]
---

# Search Report Rules

`POST /api/v2/ReportRules/search`

Search all report rules in your FortiCNAPP instance by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/ReportRules/search`

  To limit the returned result, optionally specify one or more filters in the request body. For more information about using filters, see the [Simple & Advanced Search section](/api/v2/docs/#tag/OVERVIEW).

  Here are some example `body` payloads:

  * `{ "filters": [ { "expression": "eq", "field": "name",  "value": " Jane" } ] } `

  * `{ "filters": [ { "field": "mcGuid", "expression": "rlike", "value": "123ABC" } ] } `

  * `{ "filters": [ { "field": "mcGuid", "expression": "between", "values": [ "ABC_123", "DEC_456" ] } ] }` 

  * `{ "filters": [ { "field": "intgGuidList", "expression": "eq", "value": "ABC_123" } ] } ` 

  * `{ "filters": [ { "field": "intgGuidList", "expression": "in", "values": [ "ABC_123", "DEF_456" ] } ] } ` 

  * `{ "filters": [ { "field": "filters.name", "expression": "ilike", "value": "slack" } ] } ` 

  * `{ "filters": [ { "field": "filters.resourceGroups", "expression": "eq", "value": "ABC_123" } ] } `

  * `{ "filters": [ { "field": "filters.severity", "expression": "eq", "value": "5" } ] } ` 

  * `{ "filters": [ { "field": "filters.eventCategory", "expression": "eq", "value": "App" } ] } `

  * `{ "filters": [ { "field": "reportNotificationTypes.agentEvents", "expression": "eq", "value": "false" } ] } `

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- GETDATAREQUESTBODYFILTERS
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Report Rules)

- object
  - `data` ReportRulesResponseSchema[]
    - `filters` object, required — When sending a request, use this object to define the new report rule. When included in a response, this object contains details of a report rule. You can use these attributes when searching for existing report rules by invoking a GET request.
      - `name` string, required — The report rule's name.
      - `description` string — Summary of the report rule.
      - `enabled` unknown, required
      - `resourceGroups` string[] — The resource groups that you want the rule to apply to.
      - `severity` unknown[] — The severities that you want the rule to apply to. 1=Critical 2=High 3=Medium 4=Low 5=Info
        - unknown
    - `intgGuidList` string[], required — The alert channels for the rule to access.
    - `reportNotificationTypes` object, required — The report types that you want the rule to apply to.
      - `agentEvents` boolean
      - `awsCis14` boolean
      - `awsCis401` boolean
      - `awsCisS3` boolean
      - `awsCloudtrailEvents` boolean
      - `awsComplianceEvents` boolean
      - `awsCis14IsoIec270022022` boolean
      - `awsCyberEssentials22` boolean
      - `awsCsaCcm405` boolean
      - `azureActivityLogEvents` boolean
      - `azureCis` boolean
      - `azureCis131` boolean
      - `azureComplianceEvents` boolean
      - `azurePci` boolean
      - `azurePciRev2` boolean
      - `azureSoc` boolean
      - `azureSocRev2` boolean
      - `azureIso27001` boolean
      - `azureHipaa` boolean
      - `azureNistCsf` boolean
      - `azureNist80053Rev5` boolean
      - `azureNist800171Rev2` boolean
      - `gcpAuditTrailEvents` boolean
      - `gcpCis` boolean
      - `gcpComplianceEvents` boolean
      - `gcpHipaa` boolean
      - `gcpHipaaRev2` boolean
      - `gcpIso27001` boolean
      - `gcpCis12` boolean
      - `gcpCis13` boolean
      - `gcpK8s` boolean
      - `gcpPci` boolean
      - `gcpPciRev2` boolean
      - `gcpSoc` boolean
      - `gcpSocRev2` boolean
      - `gcpNistCsf` boolean
      - `gcpNist80053Rev4` boolean
      - `gcpNist800171Rev2` boolean
      - `hipaa` boolean
      - `iso2700` boolean
      - `k8sAuditLogEvents` boolean
      - `nist800-53Rev4` boolean
      - `nist800-171Rev2` boolean
      - `openShiftCompliance` boolean
      - `pci` boolean
      - `platformEvents` boolean
      - `soc` boolean
      - `awsSocRev2` boolean
      - `trendReport` boolean
      - `awsPciDss321` boolean
      - `awsNist80053Rev5` boolean
      - `awsSoc2` boolean
      - `awsNist800171Rev2` boolean
      - `awsNistCsf` boolean
      - `awsCmmc102` boolean
      - `awsHipaa` boolean
      - `awsIso270012013` boolean
      - `incidentEvents` boolean
    - `type` 'Report', required — The data type as `Report`.
    - `mcGuid` string — Report Rule ID.

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)