@@ -7373,6 +7373,8 @@ components:
7373
7373
CloudWorkloadSecurityAgentPolicyCreateAttributes:
7374
7374
description: Create a new Cloud Workload Security Agent policy
7375
7375
properties:
7376
+ actions:
7377
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
7376
7378
description:
7377
7379
description: The description of the policy
7378
7380
example: My agent policy
@@ -7454,6 +7456,8 @@ components:
7454
7456
CloudWorkloadSecurityAgentPolicyUpdateAttributes:
7455
7457
description: Update an existing Cloud Workload Security Agent policy
7456
7458
properties:
7459
+ actions:
7460
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
7457
7461
description:
7458
7462
description: The description of the policy
7459
7463
example: My agent policy
@@ -7524,6 +7528,59 @@ components:
7524
7528
type: string
7525
7529
kill:
7526
7530
$ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill'
7531
+ metadata:
7532
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata'
7533
+ set:
7534
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet'
7535
+ type: object
7536
+ CloudWorkloadSecurityAgentRuleActionMetadata:
7537
+ description: The metadata action applied on the scope matching the rule
7538
+ properties:
7539
+ image_tag:
7540
+ description: The image tag of the metadata action
7541
+ type: string
7542
+ service:
7543
+ description: The service of the metadata action
7544
+ type: string
7545
+ short_image:
7546
+ description: The short image of the metadata action
7547
+ type: string
7548
+ type: object
7549
+ CloudWorkloadSecurityAgentRuleActionSet:
7550
+ description: The set action applied on the scope matching the rule
7551
+ properties:
7552
+ append:
7553
+ description: Whether the value should be appended to the field
7554
+ type: boolean
7555
+ field:
7556
+ description: The field of the set action
7557
+ type: string
7558
+ name:
7559
+ description: The name of the set action
7560
+ type: string
7561
+ scope:
7562
+ description: The scope of the set action
7563
+ type: string
7564
+ size:
7565
+ description: The size of the set action
7566
+ format: int64
7567
+ type: integer
7568
+ ttl:
7569
+ description: The time to live of the set action
7570
+ format: int64
7571
+ type: integer
7572
+ value:
7573
+ anyOf:
7574
+ - type: string
7575
+ - format: double
7576
+ type: number
7577
+ - format: int64
7578
+ type: integer
7579
+ - type: boolean
7580
+ - items: {}
7581
+ type: array
7582
+ - type: object
7583
+ description: The value of the set action
7527
7584
type: object
7528
7585
CloudWorkloadSecurityAgentRuleActions:
7529
7586
description: The array of actions the rule can perform if triggered
@@ -7539,6 +7596,11 @@ components:
7539
7596
agentConstraint:
7540
7597
description: The version of the Agent
7541
7598
type: string
7599
+ blocking:
7600
+ description: The blocking policies that the rule belongs to
7601
+ items:
7602
+ type: string
7603
+ type: array
7542
7604
category:
7543
7605
description: The category of the Agent rule
7544
7606
example: Process Activity
@@ -7562,6 +7624,11 @@ components:
7562
7624
description: The description of the Agent rule
7563
7625
example: My Agent rule
7564
7626
type: string
7627
+ disabled:
7628
+ description: The disabled policies that the rule belongs to
7629
+ items:
7630
+ type: string
7631
+ type: array
7565
7632
enabled:
7566
7633
description: Whether the Agent rule is enabled
7567
7634
example: true
@@ -7575,6 +7642,11 @@ components:
7575
7642
items:
7576
7643
type: string
7577
7644
type: array
7645
+ monitoring:
7646
+ description: The monitoring policies that the rule belongs to
7647
+ items:
7648
+ type: string
7649
+ type: array
7578
7650
name:
7579
7651
description: The name of the Agent rule
7580
7652
example: my_agent_rule
@@ -7609,10 +7681,22 @@ components:
7609
7681
CloudWorkloadSecurityAgentRuleCreateAttributes:
7610
7682
description: Create a new Cloud Workload Security Agent rule.
7611
7683
properties:
7684
+ actions:
7685
+ $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions'
7686
+ blocking:
7687
+ description: The blocking policies that the rule belongs to
7688
+ items:
7689
+ type: string
7690
+ type: array
7612
7691
description:
7613
7692
description: The description of the Agent rule.
7614
7693
example: My Agent rule
7615
7694
type: string
7695
+ disabled:
7696
+ description: The disabled policies that the rule belongs to
7697
+ items:
7698
+ type: string
7699
+ type: array
7616
7700
enabled:
7617
7701
description: Whether the Agent rule is enabled
7618
7702
example: true
@@ -7626,6 +7710,11 @@ components:
7626
7710
items:
7627
7711
type: string
7628
7712
type: array
7713
+ monitoring:
7714
+ description: The monitoring policies that the rule belongs to
7715
+ items:
7716
+ type: string
7717
+ type: array
7629
7718
name:
7630
7719
description: The name of the Agent rule.
7631
7720
example: my_agent_rule
@@ -7716,10 +7805,20 @@ components:
7716
7805
CloudWorkloadSecurityAgentRuleUpdateAttributes:
7717
7806
description: Update an existing Cloud Workload Security Agent rule
7718
7807
properties:
7808
+ blocking:
7809
+ description: The blocking policies that the rule belongs to
7810
+ items:
7811
+ type: string
7812
+ type: array
7719
7813
description:
7720
7814
description: The description of the Agent rule
7721
7815
example: My Agent rule
7722
7816
type: string
7817
+ disabled:
7818
+ description: The disabled policies that the rule belongs to
7819
+ items:
7820
+ type: string
7821
+ type: array
7723
7822
enabled:
7724
7823
description: Whether the Agent rule is enabled
7725
7824
example: true
@@ -7728,6 +7827,11 @@ components:
7728
7827
description: The SECL expression of the Agent rule
7729
7828
example: exec.file.name == "sh"
7730
7829
type: string
7830
+ monitoring:
7831
+ description: The monitoring policies that the rule belongs to
7832
+ items:
7833
+ type: string
7834
+ type: array
7731
7835
policy_id:
7732
7836
description: The ID of the policy where the Agent rule is saved
7733
7837
example: a8c8e364-6556-434d-b798-a4c23de29c0b
@@ -55653,9 +55757,10 @@ paths:
55653
55757
value: "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\":
55654
55758
{\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\":
55655
55759
\"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n
55656
- \ \"enabled\": true,\n \"product_tags\": [\"security:attack\",
55657
- \"technique:T1059\"],\n \"policy_id\": \"{{ policy.data.id }}\"\n
55658
- \ }\n }\n}"
55760
+ \ \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\",
55761
+ \"scope\": \"process\"}}],\n \"enabled\": true,\n \"product_tags\":
55762
+ [\"security:attack\", \"technique:T1059\"],\n \"policy_id\": \"{{
55763
+ policy.data.id }}\"\n }\n }\n}"
55659
55764
step: there is a valid "agent_rule_rc" in the system
55660
55765
x-menu-order: 4
55661
55766
x-undo:
0 commit comments