Kaspersky Next XDR Expert
1.1.9
REST API  >  API operations  >  Creating an aggregation rule

Creating an aggregation rule

POST /xdr/api/v1/aggregator/<tenantID>/rules/

Creates a new aggregation rule and adds it to the specified tenant.

Query parameters

Name

Data type

Mandatory

Description

Value example

tenantID

string

Yes

The tenant id.

If the user does not have the Read right for the specified tenant, the query fails.

00000000-0000-0000-0000-000000000000

Request body

Format: JSON

A new rule to add.

{"TenantID":"{tenantID}", "ID":"2", "Name": "newRule1", "Priority": 1, ...}

Name

Data type

Mandatory

Description

Value example

id

string

No

Rule ID (UUID).

The identifier of the default rule is 8e5405a7-6740-471f-a15d-9f9414974060

00000000-0000-0000-0000-000000000000

name

string

Yes

Rule name.

Rule1

description

string

No

Rule description

Aggregate by rule id

tenantID

string

Yes

Tenant ID (UUID)

00000000-0000-0000-0000-000000000000

enabled

boolean

Yes

Specifies whether to enable the rule.

Yes

trigger

string

Yes

Rule trigger. A JQ expression that must return a boolean value.

any(.Observables[]? | select(.Type == "username") | .Value; . == "Alice" or . == "Bob")

aggregationID

string

Yes

Rule aggregation ID. A JQ expression that must return a string value.

PentestByUserName

alertName

string

Yes

The name of the alert. A JQ expression that must return a string value.

In the example on the right, the rule name is from the first aggregated event. Subsequently aggregated events do not affect the resulting alert name.

"[PentestByUserName] " + ([.Rules[]?.Name] | join(","))

aggregationInterval

object:

  • value, int32, minimum is 1
  • unit: seconds, minutes

No

The searching interval (30 seconds by default).

45

maxAlertsInAggregate

integer

No

Maximum number of alerts for aggregation. Minimum is 1. Maximum is 100.

10

priority

integer

No

Rule priority.

2

Response

HTTP code: 200

Format: JSON

Returns the ID of the created rule.

Possible errors

HTTP code

Description

message field value

details field value

400

A rule with the specified name already exists.

variable

variable

Article ID: 293028, Last review: Dec 9, 2024
Page top