Create Batch Rule

Creates a new batch rule.

Required Permissions

Requires the ADMIN role or higher.

HTTP Request

POST /api/sonar/batch-rules

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     -d priority="LOW" \
     -d name="Scan web vulnerabilities" \
     -d schedule="*/30 * * * *"
     -d msg="Scan web vulnerabilities: $dst_ip" \
     -d query="table duration=30m weblog | search status >= 400 | stats count as error_count, dc(path) as page_count, values(concat(method, " ", path)) as request by src_ip | eval request = strjoin("\n", request) | lof eps=0.1 error_count, page_count | search _lof > 1.5 | sort -_lof" \
     -X POST \
     https://HOSTNAME/api/sonar/batch-rules

Request Parameters

Key	Required	Type	Description	Note
priority	Yes	String	Priority	`LOW` or `MEDIUM` or `HIGH`
guid	No	String	Batch rule GUID	36 characters
name	Yes	String	Batch rule name	Minimum 1 to maximum 255 characters
description	No	String	Batch rule description	Maximum 2,000 characters
msg	Yes	String	Message template	Minimum 1 to maximum 2,000 characters
enabled	No	Boolean	Whether the batch rule is enabled	`true` or `false`
category_guid	No	String	Batch rule category GUID	36 characters
schedule	Yes	String	Execution cycle	CRON schedule format
duration	No	32-bit integer	Time window of the data to be analyzed, based on the current time	Up to `31536000` seconds (365 days)
datetrunc	No	32-bit integer	Date truncation unit	`1` or `60` or `3600` or `86400` (seconds)
dataset_guid	No	String	Dataset GUID	36 character. At least one of `dataset_guid` and `query` must be provided.
query	No	String	Detection query	Maximum 65,535 characters. At least one of `dataset_guid` and `query` must be provided.
address_group_guid	No	String	Address group GUID	36 characters
address_field	No	String	Address field name	Address group field name. Maximum 50 characters.
ticket_repo_guid	No	String	Ticket repository GUID	36 characters. If not specified, a ticket is not generated.
ticket_assignee_guid	No	String	Ticket assignee GUID	If specified, a ticket is assigned automatically.
ticket_suppress_interval	No	32-bit integer	Suppression period for duplicate ticket (in seconds)	If set to `0` or not specified, duplicate tickets are not merged.
event_suppress_interval	No	32-bit integer	Suppression period for duplicated event (in seconds)	If set to `0` or not specified, duplicate events are not merged.
suppress_key	No	String	Suppress key field	Maximum 2,000 characters. Macro in `$field` format available.
keep_alive	No	Boolean	Whether to keep the suppression timer alive	`true` to keep the timer alive, `false` to reset it.
audit_category_guid	No	String	Audit category GUID	36 characters. If not specified, an auto audit request is not sent.
auditor_guid	No	String	Auditor GUID	36 characters. If not specified, the department head is assigned as default.
audit_days	No	32-bit integer	Audit due date	Minimum 1 to maximum 365 days
employee_key_field	No	String	Employee number field	Maximum 50 characters. If not specified, an auto audit request is not sent.
alarm_group_guid	No	String	Alarm group GUID	36 characters
field_order	No	String	Evidence field output order	Maximum 2,000 characters
reviewer_guid	No	String	Reviewer account GUID	36 characters
user_note	No	String	Scenario summary

Success Response

{
  "guid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

Error Responses

Required argument is missing

HTTP status code 400

{
  "error_code": "null-argument",
  "error_msg": "name should be not null"
}

Invalid argument length

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'address_field' must be shorter than or equal to 50 characters."
}

Invalid priority value

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "priority should be one of 'LOW', 'MEDIUM', 'HIGH'."
}

Identifier is not in valid GUID format

HTTP status code 400

{
  "error_code": "invalid-param-type",
  "error_msg": "category_guid should be guid type."
}

CRON expression is not valid

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "schedule has wrong cron expression format: * * * * * *"
}

Both dataset and query are not specified

HTTP status code 400

{
  "error_code": "null-argument",
  "error_msg": "query should be not null"
}

Invalid date truncation unit value

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "datetrunc should be one of 1 (1 second), 60 (1 minute), 3600 (1 hour), 86400 (1 day)."
}

field_order contains a pipe character

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "field_order doesn't allow pipe characters."
}

Name is duplicated

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "duplicated batch rule name: Scan web vulnerabilities"
}

No privilege to create a batch rule

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "no-permission"
}