Get Stream Rules

Gets a list of the stream rules that match the search keyword.

HTTP Request

GET /api/sonar/stream-rules
Request using cURL
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/stream-rules
Request Parameters
KeyRequiredTypeDescriptionNote
offsetX32-bit integerNumber of records to skipDefault: 0
limitX32-bit integerMaximum number of records to loadIf not specified, load all records
keywordsXStringKeywordSearch available by name, description, query target

Success Response

Below is a portion of the full list of stream rules.

{
  "total_count": 52,
  "rules": [
    {
      "priority": "LOW",
      "guid": "3b05608f-8dd0-4218-9d6d-391515b6280d",
      "name": "Disabling Windows Firewall",
      "description": "(T1089) Disabling Security Tools\n(T1047) Windows Management Instrumentation ",
      "msg": "Disabling Windows Firewall: $primary_ip",
      "enabled": false,
      "category_guid": "aedc65d6-25ee-4d9e-9040-e21ebe823f8d",
      "category_name": "Evasion",
      "schema_code": "edr-process",
      "schema_name": "EDR Processs",
      "logger_guids": [],
      "commands": [
        {
          "template_id": 1,
          "field_name": "",
          "args": {},
          "query": "search (lower(image) == \"*\\\\netsh.exe\" and lower(cmd_line) == \"*advfirewall*\" and lower(cmd_line) == \"*off*\") or (lower(image) == \"*\\\\netsh.exe\" and lower(cmd_line) == \"*firewall*\" and lower(cmd_line) == \"*disable*\")",
          "invert": false,
          "ordinal": 0
        }
      ],
      "address_group_guid": null,
      "address_field": null,
      "ticket_repo_guid": null,
      "ticket_assignee_guid": null,
      "ticket_assignee_name": null,
      "ticket_suppress_interval": 3600,
      "event_suppress_interval": 0,
      "suppress_key": null,
      "keep_alive": false,
      "audit_category_guid": null,
      "audit_category_name": null,
      "auditor_guid": null,
      "auditor_name": null,
      "audit_days": 14,
      "employee_key_field": null,
      "alarm_group_guid": null,
      "alarm_group_name": null,
      "field_order": "cmd_line, image",
      "company_guid": "6fbe27b7-f1ae-4d7a-a1a5-76d8fa9aa311",
      "company_name": "Logpresso",
      "user_guid": "ffaf431b-653a-4329-8f83-913cbb00342d",
      "user_name": "Admin",
      "created": "2022-09-01 00:31:15+0900",
      "updated": "2022-09-01 00:31:15+0900"
    }
  ]
}
  • total_count (32-bit integer): Total number of stream rules that match the search keyword
  • rules (Array): Paged list of stream rules
    • priority (String): One of the following: LOW, MEDIUM, HIGH.
    • guid (String): Stream rule GUID
    • name (String): Stream rule name
    • description (String): Stream rule description
    • msg (String): Message template. Macro in the $field format available.
    • enabled (Boolean): Whether the rule is enabled or not
    • category_guid (String): Stream rule category GUID
    • category_name (String): Stream rule category name
    • schema_code (String): Log schema code
    • schema_name (String): Log schema name
    • logger_guids (Array): Logger GUID list
    • commands (Array): List of stream rule commands
      • template_id (32-bit integer): Stream rule command template ID
      • field_name (String): Target field name
      • args (Map): Argument key/value pairs
      • query (String): Query string with arguments
      • invert (Boolean): NOT condition when invert = true
      • ordinal (32-bit integer): Order
    • address_group_guid (String): Address group GUID
    • address_field (String): Target fields to add to the address group
    • ticket_repo_guid (String): Ticket repository GUID
    • ticket_assignee_guid (String): Ticket assignee GUID
    • ticket_assignee_name (String): Ticket assignee name
    • ticket_suppress_interval (32-bit integer): Suppression period for duplicated ticket in seconds (in seconds)
    • event_suppress_interval (32-bit integer): Suppression period for duplicated event in seconds (in seconds)
    • suppress_key (String): Suppress key field. Macro in the $field format available.
    • keep_alive (Boolean): true to keep the timer alive, false to reset it.
      Note
      When keeping the suppression timer, even if a user completes the ticket, the event will be merged into the existing ticket until the expiration time is reached.
    • audit_category_guid (String): Audit category GUID
    • audit_category_name (String): Audit category name
    • auditor_guid (String): Auditor GUID. If not specified, the department head is assigned as default.
    • auditor_name (String): Auditor name. If not specified, the department head is assigned as default.
    • audit_days (32-bit integer): Audit due date (days)
    • employee_key_field (String): Employee number field. Typically using a normalized emp_key field.
    • alarm_group_guid (String): Alarm group GUID
    • alarm_group_name (String): Alarm group name
    • field_order (String): Evidence file output order. Comma-separated list of field names.
    • company_guid (String): GUID of the company (tenant) to which the stream rule belongs
    • company_name (String): Name of the company (tenant) to which the stream rule belongs
    • user_guid (String): GUID of the user who creates the stream rule
    • user_name (String): Name of the user who creates the stream rule
    • created (String): Date and time of creation (yyyy-MM-dd HH:mm:ssZ)
    • updated (String): Date and time of last modification (yyyy-MM-dd HH:mm:ssZ)

Error Responses

offset or limit value is not an integer

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'offset' parameter should be int type"
}
offset or limit value is negative

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'offset' must be greater than or equal to 0."
}