Sign in

v1

latestOpenAPI 3.0.12026-07-2491247233.8 KB
Rules

Retrieve rule

Retrieve a rule

get/v0/rules/{id}

Path parameters

idstring uuid required

Rule ID

Rule ID

Response

OK

action_idsstring[]

IDs of actions to run when the rule is triggered

activeboolean

Indicates whether or not the rule is active and will flag matching messages

attack_typesstring[]

Rule attack types

auto_review_auto_shareboolean

Whether auto-reviewed messages will be shared

auto_review_classification'malicious' | 'benign' | 'spam' | 'graymail' | 'simulation' | 'unwanted' | 'violation' | 'non-violation'

The classification auto-reviewed messages will have, when an auto-review action is associated with the rule

created_atstring date-time

Rule creation time

descriptionstring required

Description of rule

detection_methodsstring[]

Rule detection technologies

false_positivesstring[]

Descriptions of known false positives that could occur

idstring uuid

Rule ID

labelstring

Rule label

last_activated_atstring date-time

When the rule was last activated

maturitystring

Rule maturity

namestring required

Rule name

passiveboolean

Indicates whether or not the rule is in passive mode

referencesstring[]

URLs of reference resources for this rule

run_triage_on_excluded_messagesboolean

For Triage rules only, whether this rule will run even if the message matched a global exclusion.

severity'informational' | 'low' | 'medium' | 'high' | 'critical'

Rule severity

sourcestring required

Rule MQL (Message Query Language) source

tactics_and_techniquesstring[]

Rule tactics and techniques

tagsstring[]

Freeform tags for this rule (for example, "Executive Impersonation")

triage_abuse_reportsboolean

For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.

triage_classification_changesboolean

For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.

triage_dlp_rule_matchedboolean

For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.

triage_flagged_messagesboolean

For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.

typestring

Rule type

updated_atstring date-time

Rule last updated time