Create an aggregation rule.

Request string

An argument string must include the following fields.

Field	Required	Type	Description
rule	required	JSON object	This contains the main body of the aggregation rule, with 'name', and 'group' as top level keys. In 'group' each key is a CEF field which will be checked for matches, within this there is method and the may-be-required regex. If method is set to "Exact" then no regex value is required, and the aggregation will be done on exact match. If method is set to "Regex" the 'regex' value will be required to specify the regex pattern to be matched on, please see https://pypi.org/project/regex/ for more information on allowed regex patterns.
label	required	string	Only artifacts coming in with this label will be checked for aggregation rule matches. This field must be different than the destination label.
destination_label	required	string	Once a match has been found the artifact will be added to a container with this label. This field must be different than label.
tenants	optional	JSON array of integers	If applicable, the list of tenant ids which should use this rule to aggregate incoming data.

Example request

You can add an exact method by supplying a JSON formatted body.

curl -k -u user:password https://localhost/rest/aggregation_rule \
-d '{
	"rule": {
		"name": "test rule exact",
		"group": {
			"destinationAddress": {
				"method": "Exact"
			}
		}
	},
	"label": "phishing",
	"destination_label": "spear_phishing"
}'

Example request

You can add a regex method by supplying a JSON formatted body.

curl -k -u user:password https://localhost/rest/aggregation_rule \
-d '{
	"rule": {
		"name": "test rule regex",
		"group": {
			"sourceAddress": {
				"method": "Exact"
			},
			"destinationAddress": {
				"method": "Regex",
				"regex": "10\.10\.6.*"
			}
		}
	},
	"label": "phishing",
	"destination_label": "spear_phishing",
	"tenants": [12, 43]
}'

Update an existing aggregation rule.

Request string

An argument string must include the following fields.

Field	Required	Type	Description
add_tenants	optional	JSON array of integers	Used in the same way as the 'tenants' field, however this will not remove any tenants which do not appear in the list.
remove_tenants	optional	JSON array of integers	The opposite of the 'add_tenants' field listed above, instead of replacing tenants with the tenant list, this will only remove those in the list.

Example request

Update tenant Ids 6 and 34.

curl -k -u user:password https://localhost/rest/aggregation_rule \
-d '{
  "id": 100,
  "add_tenants": [6, 34]
}'

Example request

Remove tenant Ids 6 and 201

curl -k -u user:password  https://localhost/rest/aggregation_rule \
-d '{
  "id": 100,
  "remove_tenants": [6, 201]
}'

Example response

A successful POST will return back a success indicator and the ID of the newly created rule.

{
    "id": 100,
    "success": true
}