{ "openapi": "3.1.2", "x-hideTryItPanel": true, "info": { "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/p/" }, "title": "Cortex Cloud Alert Notification Rules REST APIs", "description": "This OpenAPI Specification provides documentation about new Alert Notification Rules APIs for Cortex Cloud. With these endpoints, you can create, read, update, disable, and delete alert notification rules. These APIs are intended to be accessed via API keys. Therefore, the key must have the RBAC permission ```alert_notifications``` for list & read operations and permission ```alert_notifications_action``` for create, edit, enable/disable, & delete operations.", "version": "Cortex Cloud" }, "servers": [ { "url": "https://api-{fqdn}", "variables": { "fqdn": { "default": "cortex.paloaltonetworks.com", "description": "The fully qualified domain name for your Cortex tenant" } } } ], "tags": [ { "name": "Alert Notification Rules", "description": "Manage alert notification rules for Cortex Cloud." } ], "paths": { "/platform/notifications/v1/list-rules": { "get": { "tags": [ "Alert Notification Rules" ], "summary": "List all rules", "description": "This endpoint retrieves a list of alert notification rules and returns their attributes. The meaning behind all attributes in this response could be found in the ```Rule``` schema. Please note that the field ```legacy_mail_format``` is set to False for all rules that were not created in legacy Xpanse environments.", "operationId": "listRules", "responses": { "200": { "description": "Successfully retrieved rules", "content": { "application/json": { "schema": { "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Rule" } }, "metadata": { "type": "object", "$ref": "#/components/schemas/Metadata" } } }, "example": { "data": [ { "rule_uuid": "5b0082c2-c0e3-4cad-b354-415d496ad995", "name": "Test Rule 1", "description": "This is a description placeholder", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } }, "applications": [ "1111-TeSt-1223-09ID-415305650" ], "forward_source": {}, "forward_type": "alert", "time_zone": "Pacific/Nauru", "slack_format": "issue", "syslog_format": "issue", "mail_format": "issue", "created_by": "testuser@paloaltonetworks.com", "created_at": 1764873308164, "modified_at": 1764873308164, "enabled": true }, { "rule_uuid": "5b0082c2-c0e3-4c2d-b354-415d496ad990", "name": "Test Rule 2", "description": "another test description", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "severity", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SEV_040_HIGH" } ] } }, "applications": [ "2222-TeSt-1223-09ID-415305650" ], "forward_source": { "email": { "aggregation": 1200, "distribution_list": [ "testuser@gmail.com" ], "legacy_mail_format": false } }, "forward_type": "alert", "time_zone": "Pacific/Nauru", "slack_format": "issue", "syslog_format": "standard_alert", "mail_format": "issue", "created_by": "testuser@paloaltonetworks.com", "created_at": 1764878761056, "modified_at": 1764878761056, "enabled": true } ], "metadata": { "total_count": 2 } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/UnauthorizedImproperPermissions" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/platform/notifications/v1/rule": { "post": { "tags": [ "Alert Notification Rules" ], "summary": "Create a new rule", "description": "This endpoint allows the user to create a new alert notification rule and specify its attributes. To see the possible ```forward_type``` values, please check the relevant enum named ```LogForwardType``` for additional information. The ```forward_source``` attribute is where a user would define email, Slack, and Syslog configurations; the required formats for these fields are documented in the ```RuleCreateRequest``` schema. The ```applications``` attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The ```mail_format```, ```syslog_format```, and ```slack_format``` attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the ```RuleCreateRequest``` schema.", "operationId": "createRule", "requestBody": { "description": "Rule creation request payload with required details for configuring alert notification rule", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleCreateRequest" } } } }, "responses": { "201": { "$ref": "#/components/responses/RuleCreatedSuccess" }, "400": { "$ref": "#/components/responses/RuleCreatedBadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/UnauthorizedImproperPermissions" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/platform/notifications/v1/rule/{rule_uuid}": { "get": { "tags": [ "Alert Notification Rules" ], "summary": "Retrieve a specific alert notification rule", "description": "This endpoint retrieves an alert notification rule and returns its attributes. The meaning behind all attributes in this response could be found in the ```Rule``` schema. Please note that the field ```legacy_mail_format``` is set to False for all rules that were not created in legacy Xpanse environments.", "operationId": "getRuleByUUID", "parameters": [ { "name": "rule_uuid", "in": "path", "required": true, "example": "3053ad1f-0efc-305d-90dd-a305ab4153a4", "description": "Full rule uuid of the Alert Notification Rule", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successfully retrieved rule", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/Rule" } } }, "example": { "data": { "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4", "name": "Test Rule 1", "description": "This is a description placeholder", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } }, "applications": [ "1111-TeSt-1223-09ID-415305650" ], "forward_source": {}, "forward_type": "alert", "time_zone": "Pacific/Nauru", "slack_format": "issue", "syslog_format": "issue", "mail_format": "issue", "created_by": "testuser@paloaltonetworks.com", "created_at": 1764873308164, "modified_at": 1764873308164, "enabled": true } } } } }, "400": { "$ref": "#/components/responses/GetRuleByUUIDBadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/UnauthorizedImproperPermissions" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "tags": [ "Alert Notification Rules" ], "description": "Allows the user to delete an existing Alert Notification Rule by its unique identifier.", "parameters": [ { "name": "rule_uuid", "in": "path", "required": true, "example": "3053ad1f-0efc-305d-90dd-a305ab4153a4", "description": "Full rule uuid of the Alert Notification Rule", "schema": { "type": "string" } } ], "summary": "Delete an existing Alert Notification Rule", "operationId": "deleteRule", "responses": { "204": { "$ref": "#/components/responses/RuleDeleteSuccess" }, "400": { "$ref": "#/components/responses/RuleDeleteBadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/UnauthorizedImproperPermissions" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "put": { "parameters": [ { "name": "rule_uuid", "in": "path", "required": true, "description": "Full rule uuid of the Alert Notification Rule", "schema": { "type": "string" } } ], "tags": [ "Alert Notification Rules" ], "summary": "Edit an existing Alert Notification Rule", "description": "This endpoint allows the user to edit an alert notification rule and specify its new attributes. To see the possible ```forward_type``` values, please check the relevant enum schema named ```LogForwardType```. The ```forward_source``` attribute is where a user would define email, Slack, and Syslog configurations; the required formats are specified in the ```RuleEditRequest```schema. The ```applications``` attribute is a list of external applications application IDs (webhook, AWS S3, AWS SQS, and Splunk). The ```mail_format```, ```syslog_format```, and ```slack_format``` attributes represent whether the user would like the notifications for these integrations to be issues or alerts formats; more information is provided in the ```RuleEditRequest``` schema. Please note that you can only edit a rule that is in an ```Enabled``` state.", "operationId": "editRule", "requestBody": { "description": "Enumerates the JSON payload required to edit an Alert Notification Rule", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleEditRequest" } } } }, "responses": { "200": { "$ref": "#/components/responses/RuleEditSuccess" }, "400": { "$ref": "#/components/responses/RuleEditBadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/UnauthorizedImproperPermissions" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/platform/notifications/v1/update-rule-status/{rule_uuid}": { "patch": { "tags": [ "Alert Notification Rules" ], "description": "This endpoint allows a user to modify a rule's status without requiring a full update. A user can either enable or disable an Alert Notification Rule.", "parameters": [ { "name": "rule_uuid", "in": "path", "required": true, "example": "3053ad1f-0efc-305d-90dd-a305ab4153a4", "description": "Full rule uuid of the Alert Notification Rule", "schema": { "type": "string" } } ], "summary": "Edit the status of an existing Alert Notification Rule", "operationId": "updateRuleStatus", "requestBody": { "description": "Enumerates the JSON payload required to edit the status of an Alert Notification Rule", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleStatusUpdateRequest" } } } }, "responses": { "204": { "$ref": "#/components/responses/RuleStatusUpdateSuccess" }, "400": { "$ref": "#/components/responses/RuleStatusUpdateBadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/UnauthorizedImproperPermissions" }, "500": { "$ref": "#/components/responses/InternalError" } } } } }, "components": { "responses": { "RuleDeleteSuccess": { "description": "Successful deletion of Alert Notification Rule", "content": { "application/json": { "schema": { "type": "null" } } } }, "RuleDeleteBadRequest": { "description": "Bad request for rule delete call", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "err_msg": { "type": "string", "description": "Error message describing the issue" }, "metadata": { "type": "object", "properties": { "err_extra": { "type": "string", "description": "Additional error details" }, "err_code": { "type": "integer", "description": "HTTP error code" } }, "required": [ "err_extra", "err_code" ] } }, "required": [ "err_msg", "metadata" ] } }, "required": [ "data" ] }, "example": { "data": { "err_msg": "The request contains invalid or missing parameters.", "metadata": { "err_extra": "Alert notification rule id 305 was not found.", "err_code": 400 } } } } } }, "RuleStatusUpdateBadRequest": { "description": "Bad request for rule status update call", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "err_msg": { "type": "string", "description": "Error message describing the issue" }, "metadata": { "type": "object", "properties": { "err_extra": { "type": "string", "description": "Additional error details" }, "err_code": { "type": "integer", "description": "HTTP error code" } }, "required": [ "err_extra", "err_code" ] } }, "required": [ "err_msg", "metadata" ] } }, "required": [ "data" ] }, "example": { "data": { "err_msg": "The request contains invalid or missing parameters.", "metadata": { "err_extra": "Alert notification rule id 305 was not found.", "err_code": 400 } } } } } }, "Unauthorized": { "description": "Unauthorized access", "content": { "application/json": { "schema": { "type": "object", "example": { "reply": { "err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null } } } } } }, "UnauthorizedImproperPermissions": { "description": "Unauthorized access due to lack of sufficient permissions", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_msg": { "type": "string" }, "err_extra": { "type": "string" }, "err_code": { "type": "integer" } } } }, "example": { "reply": { "err_code": 403, "err_msg": "Forbidden. Access was denied to this resource.", "err_extra": "Insufficient permissions for api key" } } } } } }, "InternalError": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "example": { "data": { "err_msg": "An unexpected error occurred by XDR public API", "metadata": { "err_extra": null, "err_code": 500 } } } } } }, "RuleCreatedBadRequest": { "description": "Bad request for alert notification rule create call", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "err_msg": { "type": "string", "description": "Error message describing the issue" }, "metadata": { "type": "object", "properties": { "err_extra": { "type": "string", "description": "Additional error details" }, "err_code": { "type": "integer", "description": "HTTP error code" } }, "required": [ "err_extra", "err_code" ] } }, "required": [ "err_msg", "metadata" ] } }, "required": [ "data" ] }, "example": { "data": { "err_msg": "The request contains invalid or missing parameters.", "metadata": { "err_extra": "The mail format field provided is invalid.", "err_code": 400 } } } } } }, "RuleCreatedSuccess": { "description": "Alert Notification Rule created successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "name": { "type": "string", "description": "Name of the rule", "minLength": 1 }, "rule_uuid": { "type": "string", "description": "The unique identifier of the rule", "minLength": 1 }, "description": { "type": "string", "description": "Optional description of the rule" }, "forward_type": { "type": "string", "example": "alert | audit | agent_audit | case", "description": "A required value from the LogForwardType Enum." }, "filter": { "type": "object", "items": { "type": "string" }, "description": "An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.", "minItems": 1 }, "forward_source": { "type": "object", "properties": { "email": { "type": "object", "properties": { "distribution_list": { "type": "array", "description": "List of valid email addresses that will receive notifications forwarded by the given rule.", "minItems": 1, "items": { "type": "string" } }, "aggregation": { "type": "integer", "example": 10, "description": "An integer that is between 0 and 1440 (in minutes)." }, "custom_mail_subject": { "type": "string", "example": "Custom Email Subject", "description": "This string value allows the user to customize the mail subject of the event forwarded by the given rule." }, "legacy_mail_format": { "type": "boolean", "example": false, "description": "This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)" } }, "description": "An object containing all the information that configures email output for the given notification rule.", "minItems": 1 }, "slack": { "type": "object", "properties": { "channels": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "List of valid Slack channels that will receive notifications forwarded by the given rule." } }, "description": "An object containing all the information that configures Slack output for the given notification rule." }, "syslog": { "type": "object", "properties": { "id": { "type": "integer", "example": 305, "description": "This string value that specifies the Syslog integration that will be associated with the given notification rule." } }, "description": "An object containing all the information that configures Syslog output for the given notification rule." } }, "description": " This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs." }, "applications": { "type": "array", "description": "List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.", "minItems": 1, "items": { "type": "string" } }, "time_zone": { "type": "string", "default": "UTC", "description": "This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```" }, "mail_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "syslog_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "slack_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack." }, "created_by": { "type": "string", "description": "This string indicates the user or api-key responsible for creating the notification rule." }, "created_at": { "type": "integer", "format": "int64", "description": "This value represents the timestamp when the notification rule was created." }, "modified_at": { "type": "integer", "format": "int64", "description": "This value represents the timestamp when the notification rule was last modified." }, "enabled": { "type": "boolean", "default": true, "description": "A flag indicating whether the notification rule is currently active and enabled." } } } } }, "example": { "data": { "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4", "name": "Test Rule 01", "description": "a description for the test rule", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } }, "applications": [ "63e3ad1f-0efc-401d-90dd-a305ab6053a4" ], "forward_source": { "email": { "distribution_list": [ "testuser@paloaltonetworks.com" ], "aggregation": 1000, "legacy_mail_format": false }, "syslog": { "id": 1 }, "slack": { "channels": [ "slack-test-channel1" ] } }, "forward_type": "alert", "time_zone": "Pacific/Nauru", "mail_format": "issue", "syslog_format": "standard_alert", "slack_format": "issue", "created_by": "testuser@paloaltonetworks.com", "created_at": 1764958056697, "modified_at": 1764958056697, "enabled": true } } } } }, "RuleEditSuccess": { "description": "Alert Notification Rule edited successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "name": { "type": "string", "description": "Name of the rule", "minLength": 1 }, "rule_uuid": { "type": "string", "description": "The unique identifier of the rule", "minLength": 1 }, "description": { "type": "string", "description": "Optional description of the rule" }, "forward_type": { "type": "string", "example": "alert | audit | agent_audit | case", "description": "A required value from the LogForwardType Enum." }, "filter": { "type": "object", "items": { "type": "string" }, "description": "An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.", "minItems": 1 }, "forward_source": { "type": "object", "properties": { "email": { "type": "object", "properties": { "distribution_list": { "type": "array", "description": "List of valid email addresses that will receive notifications forwarded by the given rule.", "minItems": 1, "items": { "type": "string" } }, "aggregation": { "type": "integer", "example": 10, "description": "An integer that is between 0 and 1440 (in minutes)." }, "custom_mail_subject": { "type": "string", "example": "Custom Email Subject", "description": "This string value allows the user to customize the mail subject of the event forwarded by the given rule." }, "legacy_mail_format": { "type": "boolean", "example": false, "description": "This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)" } }, "description": "An object containing all the information that configures email output for the given notification rule.", "minItems": 1 }, "slack": { "type": "object", "properties": { "channels": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "List of valid Slack channels that will receive notifications forwarded by the given rule." } }, "description": "An object containing all the information that configures Slack output for the given notification rule." }, "syslog": { "type": "object", "properties": { "id": { "type": "integer", "example": 305, "description": "This string value that specifies the Syslog integration that will be associated with the given notification rule." } }, "description": "An object containing all the information that configures Syslog output for the given notification rule." } }, "description": " This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs." }, "applications": { "type": "array", "description": "List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.", "minItems": 1, "items": { "type": "string" } }, "time_zone": { "type": "string", "default": "UTC", "description": "This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```" }, "mail_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "syslog_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "slack_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack." }, "created_by": { "type": "string", "description": "This string indicates the user or api-key responsible for creating the notification rule." }, "created_at": { "type": "integer", "format": "int64", "description": "This value represents the timestamp when the notification rule was created." }, "modified_at": { "type": "integer", "format": "int64", "description": "This value represents the timestamp when the notification rule was last modified." }, "enabled": { "type": "boolean", "default": true, "description": "A flag indicating whether the notification rule is currently active and enabled." } } } } }, "example": { "data": { "rule_uuid": "3053ad1f-0efc-305d-90dd-a305ab4153a4", "name": "Test Rule 01", "description": "a description for the test rule", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } }, "applications": [ "63e3ad1f-0efc-401d-90dd-a305ab6053a4" ], "forward_source": { "email": { "distribution_list": [ "testuser@paloaltonetworks.com" ], "aggregation": 1000, "legacy_mail_format": false }, "syslog": { "id": 1 }, "slack": { "channels": [ "slack-test-channel1" ] } }, "forward_type": "alert", "time_zone": "Pacific/Nauru", "mail_format": "issue", "syslog_format": "standard_alert", "slack_format": "issue", "created_by": "testuser@paloaltonetworks.com", "created_at": 1764958056697, "modified_at": 1764958056697, "enabled": true } } } } }, "RuleEditBadRequest": { "description": "Bad request for alert notification rule edit call", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "err_msg": { "type": "string", "description": "Error message describing the issue" }, "metadata": { "type": "object", "properties": { "err_extra": { "type": "string", "description": "Additional error details" }, "err_code": { "type": "integer", "description": "HTTP error code" } }, "required": [ "err_extra", "err_code" ] } }, "required": [ "err_msg", "metadata" ] } }, "required": [ "data" ] }, "example": { "data": { "err_msg": "The request contains invalid or missing parameters.", "metadata": { "err_extra": "The mail format field provided is invalid.", "err_code": 400 } } } } } }, "GetRuleByUUIDBadRequest": { "description": "Bad request for alert notification rule get by uuid call", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "err_msg": { "type": "string", "description": "Error message describing the issue" }, "metadata": { "type": "object", "properties": { "err_extra": { "type": "string", "description": "Additional error details" }, "err_code": { "type": "integer", "description": "HTTP error code" } }, "required": [ "err_extra", "err_code" ] } }, "required": [ "err_msg", "metadata" ] } }, "required": [ "data" ] }, "example": { "data": { "err_msg": "The request contains invalid or missing parameters.", "metadata": { "err_extra": "Alert notification with rule uuid 3056ad1f-0efc-305d-90dd-a305ab4153a4 was not found.", "err_code": 400 } } } } } }, "RuleStatusUpdateSuccess": { "description": "Alert Notification Rule status updated successfully", "content": { "application/json": { "schema": { "type": "null" } } } } }, "schemas": { "RuleCreateRequest": { "type": "object", "description": "Enumerates the rule creation request schema for Alert Notifications", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "name", "forward_type" ], "properties": { "name": { "type": "string", "description": "Name of the rule", "minLength": 1 }, "description": { "type": "string", "description": "Optional description of the rule" }, "forward_type": { "type": "string", "example": "alert | audit | agent_audit | case", "description": "A required value from the LogForwardType Enum." }, "filter": { "type": "object", "items": { "type": "string" }, "description": "An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.", "minItems": 1 }, "forward_source": { "type": "object", "properties": { "email": { "type": "object", "properties": { "distribution_list": { "type": "array", "description": "List of valid email addresses that will receive notifications forwarded by the given rule.", "minItems": 1, "items": { "type": "string" } }, "aggregation": { "type": "integer", "example": 10, "description": "An integer that is between 0 and 1440 (in minutes)." }, "custom_mail_subject": { "type": "string", "example": "Custom Email Subject", "description": "This string value allows the user to customize the mail subject of the event forwarded by the given rule." } }, "required": [ "distribution_list" ], "description": "An object containing all the information that configures email output for the given notification rule.", "minItems": 1 }, "slack": { "type": "object", "properties": { "channels": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "List of valid Slack channels that will receive notifications forwarded by the given rule." } }, "required": [ "channels" ], "description": "An object containing all the information that configures Slack output for the given notification rule." }, "syslog": { "type": "object", "properties": { "id": { "type": "integer", "example": 305, "description": "This string value that specifies the Syslog integration that will be associated with the given notification rule." } }, "required": [ "id" ], "description": "An object containing all the information that configures Syslog output for the given notification rule." } }, "description": " This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs." }, "applications": { "type": "array", "description": "List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.", "minItems": 1, "items": { "type": "string" } }, "time_zone": { "type": "string", "default": "UTC", "description": "This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```" }, "mail_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "syslog_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "slack_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the ```legacy_alert``` format is not permissible for Slack." } } } }, "additionalProperties": false, "example": { "request_data": { "name": "Test Rule 01", "description": "a description for the test rule", "forward_type": "alert", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } }, "forward_source": { "email": { "distribution_list": [ "testuser@paloaltonetworks.com" ], "aggregation": 1000 }, "syslog": { "id": 1 }, "slack": { "channels": [ "slack-test-channel1" ] } }, "applications": [ "63e3ad1f-0efc-401d-90dd-a305ab6053a4" ], "time_zone": "Pacific/Nauru", "mail_format": "issue", "syslog_format": "standard_alert", "slack_format": "issue" } } }, "Rule": { "type": "object", "description": "Enumerates the various attributes of an alert notification rule that is returned via numerous flows.", "properties": { "name": { "type": "string", "description": "Name of the rule", "minLength": 1 }, "rule_uuid": { "type": "string", "description": "The unique identifier of the rule", "minLength": 1 }, "description": { "type": "string", "description": "Optional description of the rule" }, "forward_type": { "type": "string", "example": "alert | audit | agent_audit | case", "description": "A required value from the LogForwardType Enum." }, "filter": { "type": "object", "items": { "type": "string" }, "description": "An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.", "minItems": 1 }, "forward_source": { "type": "object", "properties": { "email": { "type": "object", "properties": { "distribution_list": { "type": "array", "description": "List of valid email addresses that will receive notifications forwarded by the given rule.", "minItems": 1, "items": { "type": "string" } }, "aggregation": { "type": "integer", "example": 10, "description": "An integer that is between 0 and 1440 (in minutes)." }, "custom_mail_subject": { "type": "string", "example": "Custom Email Subject", "description": "This string value allows the user to customize the mail subject of the event forwarded by the given rule." }, "legacy_mail_format": { "type": "boolean", "example": false, "description": "This boolean value signifies whether the legacy mail format is being utilized (applicable only for legacy Xpanse tenant)" } }, "description": "An object containing all the information that configures email output for the given notification rule.", "minItems": 1 }, "slack": { "type": "object", "properties": { "channels": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "List of valid Slack channels that will receive notifications forwarded by the given rule." } }, "description": "An object containing all the information that configures Slack output for the given notification rule." }, "syslog": { "type": "object", "properties": { "id": { "type": "integer", "example": 305, "description": "This string value that specifies the Syslog integration that will be associated with the given notification rule." } }, "description": "An object containing all the information that configures Syslog output for the given notification rule." } }, "description": " This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs." }, "applications": { "type": "array", "description": "List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.", "minItems": 1, "items": { "type": "string" } }, "time_zone": { "type": "string", "default": "UTC", "description": "This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```" }, "mail_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for mail integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "syslog_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "slack_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI. Note: the ```legacy_alert``` format is not permissible for Slack." }, "created_by": { "type": "string", "description": "This string indicates the user or api-key responsible for creating the notification rule." }, "created_at": { "type": "integer", "format": "int64", "description": "This value represents the timestamp when the notification rule was created." }, "modified_at": { "type": "integer", "format": "int64", "description": "This value represents the timestamp when the notification rule was last modified." }, "enabled": { "type": "boolean", "default": true, "description": "A flag indicating whether the notification rule is currently active and enabled." } }, "additionalProperties": false }, "RuleEditRequest": { "type": "object", "description": "Enumerates the various attributes required for editing an existing notification rule", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "name", "forward_type" ], "properties": { "name": { "type": "string", "description": "Name of the rule", "minLength": 1 }, "description": { "type": "string", "description": "Optional description of the rule" }, "forward_type": { "type": "string", "example": "alert | audit | agent_audit | case", "description": "A required value from the LogForwardType Enum. It must be the same as its current forward_type as this field is not mutable during edits." }, "filter": { "type": "object", "items": { "type": "string" }, "description": "An object containing the various attributes of the filter that will be applied to the given alert notification rule. Please refer to the ```BaseFilterExample``` and ```ComplexFilterExample``` schemas to gather further information on this field. A user can also derive a filter by utilizing the JSON export functionality when defining a rule via the UI.", "minItems": 1 }, "forward_source": { "type": "object", "properties": { "email": { "type": "object", "properties": { "distribution_list": { "type": "array", "items": { "type": "string" }, "description": "List of valid email addresses that will receive notifications forwarded by the given rule.", "minItems": 1 }, "aggregation": { "type": "integer", "example": 10, "description": "An integer that is between 0 and 1440 (in minutes). The default is 10 minutes." }, "custom_mail_subject": { "type": "string", "example": "Custom Email Subject", "description": "This string value allows the user to customize the mail subject of the event forwarded by the given rule." } }, "required": [ "distribution_list" ], "description": "An object containing all the information that configures email output for the given notification rule.", "minItems": 1 }, "slack": { "type": "object", "properties": { "channels": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "List of valid Slack channels that will receive notifications forwarded by the given rule." } }, "required": [ "channels" ], "description": "An object containing all the information that configures Slack output for the given notification rule." }, "syslog": { "type": "object", "properties": { "id": { "type": "integer", "example": 305, "description": "This string value that specifies the Syslog integration that will be associated with the given notification rule." } }, "required": [ "id" ], "description": "An object containing all the information that configures Syslog output for the given notification rule." } }, "description": " This JSON object provides the user with the ability to specify configurations for Email, Slack, and Syslog outputs." }, "applications": { "type": "array", "description": "List of valid application IDs (AWS SQS, AWS S3, Splunk, and webhook integrations). These can be found by utilizing the List External Applications API.", "minItems": 1, "items": { "type": "string" } }, "time_zone": { "type": "string", "default": "UTC", "description": "This string indicates which time zone the rule will be associated with. If the field is not passed in, the default value will be UTC. The following are valid time zone options: ```Africa/Abidjan```, ```Africa/Accra```, ```Africa/Addis_Ababa```, ```Africa/Algiers```, ```Africa/Asmara```, ```Africa/Asmera```, ```Africa/Bamako```, ```Africa/Bangui```, ```Africa/Banjul```, ```Africa/Bissau```, ```Africa/Blantyre```, ```Africa/Brazzaville```, ```Africa/Bujumbura```, ```Africa/Cairo```, ```Africa/Casablanca```, ```Africa/Ceuta```, ```Africa/Conakry```, ```Africa/Dakar```, ```Africa/Dar_es_Salaam```, ```Africa/Djibouti```, ```Africa/Douala```, ```Africa/El_Aaiun```, ```Africa/Freetown```, ```Africa/Gaborone```, ```Africa/Harare```, ```Africa/Johannesburg```, ```Africa/Juba```, ```Africa/Kampala```, ```Africa/Khartoum```, ```Africa/Kigali```, ```Africa/Kinshasa```, ```Africa/Lagos```, ```Africa/Libreville```, ```Africa/Lome```, ```Africa/Luanda```, ```Africa/Lubumbashi```, ```Africa/Lusaka```, ```Africa/Malabo```, ```Africa/Maputo```, ```Africa/Maseru```, ```Africa/Mbabane```, ```Africa/Mogadishu```, ```Africa/Monrovia```, ```Africa/Nairobi```, ```Africa/Ndjamena```, ```Africa/Niamey```, ```Africa/Nouakchott```, ```Africa/Ouagadougou```, ```Africa/Porto-Novo```, ```Africa/Sao_Tome```, ```Africa/Timbuktu```, ```Africa/Tripoli```, ```Africa/Tunis```, ```Africa/Windhoek```, ```America/Adak```, ```America/Anchorage```, ```America/Anguilla```, ```America/Antigua```, ```America/Araguaina```, ```America/Argentina/Buenos_Aires```, ```America/Argentina/Catamarca```, ```America/Argentina/ComodRivadavia```, ```America/Argentina/Cordoba```, ```America/Argentina/Jujuy```, ```America/Argentina/La_Rioja```, ```America/Argentina/Mendoza```, ```America/Argentina/Rio_Gallegos```, ```America/Argentina/Salta```, ```America/Argentina/San_Juan```, ```America/Argentina/San_Luis```, ```America/Argentina/Tucuman```, ```America/Argentina/Ushuaia```, ```America/Aruba```, ```America/Asuncion```, ```America/Atikokan```, ```America/Atka```, ```America/Bahia```, ```America/Bahia_Banderas```, ```America/Barbados```, ```America/Belem```, ```America/Belize```, ```America/Blanc-Sablon```, ```America/Boa_Vista```, ```America/Bogota```, ```America/Boise```, ```America/Buenos_Aires```, ```America/Cambridge_Bay```, ```America/Campo_Grande```, ```America/Cancun```, ```America/Caracas```, ```America/Catamarca```, ```America/Cayenne```, ```America/Cayman```, ```America/Chicago```, ```America/Chihuahua```, ```America/Ciudad_Juarez```, ```America/Coral_Harbour```, ```America/Cordoba```, ```America/Costa_Rica```, ```America/Coyhaique```, ```America/Creston```, ```America/Cuiaba```, ```America/Curacao```, ```America/Danmarkshavn```, ```America/Dawson```, ```America/Dawson_Creek```, ```America/Denver```, ```America/Detroit```, ```America/Dominica```, ```America/Edmonton```, ```America/Eirunepe```, ```America/El_Salvador```, ```America/Ensenada```, ```America/Fort_Nelson```, ```America/Fort_Wayne```, ```America/Fortaleza```, ```America/Glace_Bay```, ```America/Godthab```, ```America/Goose_Bay```, ```America/Grand_Turk```, ```America/Grenada```, ```America/Guadeloupe```, ```America/Guatemala```, ```America/Guayaquil```, ```America/Guyana```, ```America/Halifax```, ```America/Havana```, ```America/Hermosillo```, ```America/Indiana/Indianapolis```, ```America/Indiana/Knox```, ```America/Indiana/Marengo```, ```America/Indiana/Petersburg```, ```America/Indiana/Tell_City```, ```America/Indiana/Vevay```, ```America/Indiana/Vincennes```, ```America/Indiana/Winamac```, ```America/Indianapolis```, ```America/Inuvik```, ```America/Iqaluit```, ```America/Jamaica```, ```America/Jujuy```, ```America/Juneau```, ```America/Kentucky/Louisville```, ```America/Kentucky/Monticello```, ```America/Knox_IN```, ```America/Kralendijk```, ```America/La_Paz```, ```America/Lima```, ```America/Los_Angeles```, ```America/Louisville```, ```America/Lower_Princes```, ```America/Maceio```, ```America/Managua```, ```America/Manaus```, ```America/Marigot```, ```America/Martinique```, ```America/Matamoros```, ```America/Mazatlan```, ```America/Mendoza```, ```America/Menominee```, ```America/Merida```, ```America/Metlakatla```, ```America/Mexico_City```, ```America/Miquelon```, ```America/Moncton```, ```America/Monterrey```, ```America/Montevideo```, ```America/Montreal```, ```America/Montserrat```, ```America/Nassau```, ```America/New_York```, ```America/Nipigon```, ```America/Nome```, ```America/Noronha```, ```America/North_Dakota/Beulah```, ```America/North_Dakota/Center```, ```America/North_Dakota/New_Salem```, ```America/Nuuk```, ```America/Ojinaga```, ```America/Panama```, ```America/Pangnirtung```, ```America/Paramaribo```, ```America/Phoenix```, ```America/Port-au-Prince```, ```America/Port_of_Spain```, ```America/Porto_Acre```, ```America/Porto_Velho```, ```America/Puerto_Rico```, ```America/Punta_Arenas```, ```America/Rainy_River```, ```America/Rankin_Inlet```, ```America/Recife```, ```America/Regina```, ```America/Resolute```, ```America/Rio_Branco```, ```America/Rosario```, ```America/Santa_Isabel```, ```America/Santarem```, ```America/Santiago```, ```America/Santo_Domingo```, ```America/Sao_Paulo```, ```America/Scoresbysund```, ```America/Shiprock```, ```America/Sitka```, ```America/St_Barthelemy```, ```America/St_Johns```, ```America/St_Kitts```, ```America/St_Lucia```, ```America/St_Thomas```, ```America/St_Vincent```, ```America/Swift_Current```, ```America/Tegucigalpa```, ```America/Thule```, ```America/Thunder_Bay```, ```America/Tijuana```, ```America/Toronto```, ```America/Tortola```, ```America/Vancouver```, ```America/Virgin```, ```America/Whitehorse```, ```America/Winnipeg```, ```America/Yakutat```, ```America/Yellowknife```, ```Antarctica/Casey```, ```Antarctica/Davis```, ```Antarctica/DumontDUrville```, ```Antarctica/Macquarie```, ```Antarctica/Mawson```, ```Antarctica/McMurdo```, ```Antarctica/Palmer```, ```Antarctica/Rothera```, ```Antarctica/South_Pole```, ```Antarctica/Syowa```, ```Antarctica/Troll```, ```Antarctica/Vostok```, ```Arctic/Longyearbyen```, ```Asia/Aden```, ```Asia/Almaty```, ```Asia/Amman```, ```Asia/Anadyr```, ```Asia/Aqtau```, ```Asia/Aqtobe```, ```Asia/Ashgabat```, ```Asia/Ashkhabad```, ```Asia/Atyrau```, ```Asia/Baghdad```, ```Asia/Bahrain```, ```Asia/Baku```, ```Asia/Bangkok```, ```Asia/Barnaul```, ```Asia/Beirut```, ```Asia/Bishkek```, ```Asia/Brunei```, ```Asia/Calcutta```, ```Asia/Chita```, ```Asia/Choibalsan```, ```Asia/Chongqing```, ```Asia/Chungking```, ```Asia/Colombo```, ```Asia/Dacca```, ```Asia/Damascus```, ```Asia/Dhaka```, ```Asia/Dili```, ```Asia/Dubai```, ```Asia/Dushanbe```, ```Asia/Famagusta```, ```Asia/Gaza```, ```Asia/Harbin```, ```Asia/Hebron```, ```Asia/Ho_Chi_Minh```, ```Asia/Hong_Kong```, ```Asia/Hovd```, ```Asia/Irkutsk```, ```Asia/Istanbul```, ```Asia/Jakarta```, ```Asia/Jayapura```, ```Asia/Jerusalem```, ```Asia/Kabul```, ```Asia/Kamchatka```, ```Asia/Karachi```, ```Asia/Kashgar```, ```Asia/Kathmandu```, ```Asia/Katmandu```, ```Asia/Khandyga```, ```Asia/Kolkata```, ```Asia/Krasnoyarsk```, ```Asia/Kuala_Lumpur```, ```Asia/Kuching```, ```Asia/Kuwait```, ```Asia/Macao```, ```Asia/Macau```, ```Asia/Magadan```, ```Asia/Makassar```, ```Asia/Manila```, ```Asia/Muscat```, ```Asia/Nicosia```, ```Asia/Novokuznetsk```, ```Asia/Novosibirsk```, ```Asia/Omsk```, ```Asia/Oral```, ```Asia/Phnom_Penh```, ```Asia/Pontianak```, ```Asia/Pyongyang```, ```Asia/Qatar```, ```Asia/Qostanay```, ```Asia/Qyzylorda```, ```Asia/Rangoon```, ```Asia/Riyadh```, ```Asia/Saigon```, ```Asia/Sakhalin```, ```Asia/Samarkand```, ```Asia/Seoul```, ```Asia/Shanghai```, ```Asia/Singapore```, ```Asia/Srednekolymsk```, ```Asia/Taipei```, ```Asia/Tashkent```, ```Asia/Tbilisi```, ```Asia/Tehran```, ```Asia/Tel_Aviv```, ```Asia/Thimbu```, ```Asia/Thimphu```, ```Asia/Tokyo```, ```Asia/Tomsk```, ```Asia/Ujung_Pandang```, ```Asia/Ulaanbaatar```, ```Asia/Ulan_Bator```, ```Asia/Urumqi```, ```Asia/Ust-Nera```, ```Asia/Vientiane```, ```Asia/Vladivostok```, ```Asia/Yakutsk```, ```Asia/Yangon```, ```Asia/Yekaterinburg```, ```Asia/Yerevan```, ```Atlantic/Azores```, ```Atlantic/Bermuda```, ```Atlantic/Canary```, ```Atlantic/Cape_Verde```, ```Atlantic/Faeroe```, ```Atlantic/Faroe```, ```Atlantic/Jan_Mayen```, ```Atlantic/Madeira```, ```Atlantic/Reykjavik```, ```Atlantic/South_Georgia```, ```Atlantic/St_Helena```, ```Atlantic/Stanley```, ```Australia/ACT```, ```Australia/Adelaide```, ```Australia/Brisbane```, ```Australia/Broken_Hill```, ```Australia/Canberra```, ```Australia/Currie```, ```Australia/Darwin```, ```Australia/Eucla```, ```Australia/Hobart```, ```Australia/LHI```, ```Australia/Lindeman```, ```Australia/Lord_Howe```, ```Australia/Melbourne```, ```Australia/NSW```, ```Australia/North```, ```Australia/Perth```, ```Australia/Queensland```, ```Australia/South```, ```Australia/Sydney```, ```Australia/Tasmania```, ```Australia/Victoria```, ```Australia/West```, ```Australia/Yancowinna```, ```Brazil/Acre```, ```Brazil/DeNoronha```, ```Brazil/East```, ```Brazil/West```, ```CET```, ```CST6CDT```, ```Canada/Atlantic```, ```Canada/Central```, ```Canada/Eastern```, ```Canada/Mountain```, ```Canada/Newfoundland```, ```Canada/Pacific```, ```Canada/Saskatchewan```, ```Canada/Yukon```, ```Chile/Continental```, ```Chile/EasterIsland```, ```Cuba```, ```EET```, ```EST```, ```EST5EDT```, ```Egypt```, ```Eire```, ```Etc/GMT```, ```Etc/GMT+0```, ```Etc/GMT+1```, ```Etc/GMT+10```, ```Etc/GMT+11```, ```Etc/GMT+12```, ```Etc/GMT+2```, ```Etc/GMT+3```, ```Etc/GMT+4```, ```Etc/GMT+5```, ```Etc/GMT+6```, ```Etc/GMT+7```, ```Etc/GMT+8```, ```Etc/GMT+9```, ```Etc/GMT-0```, ```Etc/GMT-1```, ```Etc/GMT-10```, ```Etc/GMT-11```, ```Etc/GMT-12```, ```Etc/GMT-13```, ```Etc/GMT-14```, ```Etc/GMT-2```, ```Etc/GMT-3```, ```Etc/GMT-4```, ```Etc/GMT-5```, ```Etc/GMT-6```, ```Etc/GMT-7```, ```Etc/GMT-8```, ```Etc/GMT-9```, ```Etc/GMT0```, ```Etc/Greenwich```, ```Etc/UCT```, ```Etc/UTC```, ```Etc/Universal```, ```Etc/Zulu```, ```Europe/Amsterdam```, ```Europe/Andorra```, ```Europe/Astrakhan```, ```Europe/Athens```, ```Europe/Belfast```, ```Europe/Belgrade```, ```Europe/Berlin```, ```Europe/Bratislava```, ```Europe/Brussels```, ```Europe/Bucharest```, ```Europe/Budapest```, ```Europe/Busingen```, ```Europe/Chisinau```, ```Europe/Copenhagen```, ```Europe/Dublin```, ```Europe/Gibraltar```, ```Europe/Guernsey```, ```Europe/Helsinki```, ```Europe/Isle_of_Man```, ```Europe/Istanbul```, ```Europe/Jersey```, ```Europe/Kaliningrad```, ```Europe/Kiev```, ```Europe/Kirov```, ```Europe/Kyiv```, ```Europe/Lisbon```, ```Europe/Ljubljana```, ```Europe/London```, ```Europe/Luxembourg```, ```Europe/Madrid```, ```Europe/Malta```, ```Europe/Mariehamn```, ```Europe/Minsk```, ```Europe/Monaco```, ```Europe/Moscow```, ```Europe/Nicosia```, ```Europe/Oslo```, ```Europe/Paris```, ```Europe/Podgorica```, ```Europe/Prague```, ```Europe/Riga```, ```Europe/Rome```, ```Europe/Samara```, ```Europe/San_Marino```, ```Europe/Sarajevo```, ```Europe/Saratov```, ```Europe/Simferopol```, ```Europe/Skopje```, ```Europe/Sofia```, ```Europe/Stockholm```, ```Europe/Tallinn```, ```Europe/Tirane```, ```Europe/Tiraspol```, ```Europe/Ulyanovsk```, ```Europe/Uzhgorod```, ```Europe/Vaduz```, ```Europe/Vatican```, ```Europe/Vienna```, ```Europe/Vilnius```, ```Europe/Volgograd```, ```Europe/Warsaw```, ```Europe/Zagreb```, ```Europe/Zaporozhye```, ```Europe/Zurich```, ```GB```, ```GB-Eire```, ```GMT```, ```GMT+0```, ```GMT-0```, ```GMT0```, ```Greenwich```, ```HST```, ```Hongkong```, ```Iceland```, ```Indian/Antananarivo```, ```Indian/Chagos```, ```Indian/Christmas```, ```Indian/Cocos```, ```Indian/Comoro```, ```Indian/Kerguelen```, ```Indian/Mahe```, ```Indian/Maldives```, ```Indian/Mauritius```, ```Indian/Mayotte```, ```Indian/Reunion```, ```Iran```, ```Israel```, ```Jamaica```, ```Japan```, ```Kwajalein```, ```Libya```, ```MET```, ```MST```, ```MST7MDT```, ```Mexico/BajaNorte```, ```Mexico/BajaSur```, ```Mexico/General```, ```NZ```, ```NZ-CHAT```, ```Navajo```, ```PRC```, ```PST8PDT```, ```Pacific/Apia```, ```Pacific/Auckland```, ```Pacific/Bougainville```, ```Pacific/Chatham```, ```Pacific/Chuuk```, ```Pacific/Easter```, ```Pacific/Efate```, ```Pacific/Enderbury```, ```Pacific/Fakaofo```, ```Pacific/Fiji```, ```Pacific/Funafuti```, ```Pacific/Galapagos```, ```Pacific/Gambier```, ```Pacific/Guadalcanal```, ```Pacific/Guam```, ```Pacific/Honolulu```, ```Pacific/Johnston```, ```Pacific/Kanton```, ```Pacific/Kiritimati```, ```Pacific/Kosrae```, ```Pacific/Kwajalein```, ```Pacific/Majuro```, ```Pacific/Marquesas```, ```Pacific/Midway```, ```Pacific/Nauru```, ```Pacific/Niue```, ```Pacific/Norfolk```, ```Pacific/Noumea```, ```Pacific/Pago_Pago```, ```Pacific/Palau```, ```Pacific/Pitcairn```, ```Pacific/Pohnpei```, ```Pacific/Ponape```, ```Pacific/Port_Moresby```, ```Pacific/Rarotonga```, ```Pacific/Saipan```, ```Pacific/Samoa```, ```Pacific/Tahiti```, ```Pacific/Tarawa```, ```Pacific/Tongatapu```, ```Pacific/Truk```, ```Pacific/Wake```, ```Pacific/Wallis```, ```Pacific/Yap```, ```Poland```, ```Portugal```, ```ROC```, ```ROK```, ```Singapore```, ```Turkey```, ```UCT```, ```US/Alaska```, ```US/Aleutian```, ```US/Arizona```, ```US/Central```, ```US/East-Indiana```, ```US/Eastern```, ```US/Hawaii```, ```US/Indiana-Starke```, ```US/Michigan```, ```US/Mountain```, ```US/Pacific```, ```US/Samoa```, ```UTC```, ```Universal```, ```W-SU```, ```WET```, ```Zulu```" }, "mail_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "syslog_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue```, ```standard_alert```, or ```legacy_alert``` format for Syslog integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI." }, "slack_format": { "type": "string", "default": "issue", "description": "This string indicates whether the rule will use the ```issue``` or ```standard_alert``` format for Slack integration. This string is strictly to be used with the ```alert``` log forwarding type. It is not applicable for other log forwarding types. The value fields are analogous to those visible on the UI.Not: the ```legacy_alert``` format is not permissible for Slack." } } } }, "additionalProperties": false, "example": { "request_data": { "name": "Test Rule 01", "description": "a description for the test rule", "forward_type": "alert", "filter": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } }, "forward_source": { "email": { "distribution_list": [ "testuser@paloaltonetworks.com" ], "aggregation": 1000 }, "syslog": { "id": 1 }, "slack": { "channels": [ "slack-test-channel1" ] } }, "applications": [ "63e3ad1f-0efc-401d-90dd-a305ab6053a4" ], "time_zone": "Pacific/Nauru", "mail_format": "issue", "syslog_format": "standard_alert", "slack_format": "issue" } } }, "RuleStatusUpdateRequest": { "type": "object", "description": "Enumerates the various para meters required for updating the status of a rule", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "status" ], "properties": { "status": { "type": "string", "description": "Value of updated status {enable|disable}", "minLength": 1 } } } }, "additionalProperties": false, "example": { "request_data": { "status": "enable" } } }, "LogForwardType": { "type": "string", "description": "The chosen log forwarding type - Possible values: alert (Refers to ```Issues``` log type on the UI. It can be used with email, Slack, Syslog, AWS S3, AWS SQS, Splunk, and webhook), audit (Refers to ```Management Audit Logs``` log type on the UI. It can be used with email and Syslog), agent_audit (Refers to ```Agent Audit Logs``` log type on the UI. It can be used with email and Syslog), and case (Refers to ```Cases``` log type on the UI. It can be used with email, Slack, AWS S3, AWS SQS, Splunk, and webhook).", "enum": [ "alert", "audit", "agent_audit", "case" ] }, "BaseFilterExample": { "type": "object", "description": "Base filter object for log forwarding rules with nested logical conditions. The SEARCH_FIELD and SEARCH_VALUE parameters are in essence open-ended and context-dependent. The field names vary by data source, module, and UI context. The field values depend on the specific field type and business logic. Please refer to the Create/Edit Notification Rule page on the UI for the latest availability of options for these fields. This filter is constructed as a logical requirement that limits data to a specific subset. It begins with the \"filter\" object, which acts as the container for the entire rule. Inside, it uses an \"AND\" logic gate, represented as a list (the square brackets []). This structure is designed to hold one or multiple conditions that must all be true at the same time for a result to be shown.", "properties": { "SEARCH_FIELD": { "type": "string", "example": "xdm.asset.type.class", "description": "The field you want to filter." }, "SEARCH_TYPE": { "type": "string", "example": "NEQ", "enum": [ "EQ", "NEQ", "GT", "LT", "GTE", "LTE", "IN", "NIN", "RLIKE", "NRLIKE", "WILDCARD", "WILDCARD_NOT", "CONTAINS", "NCONTAINS", "IP_MATCH", "NIP_MATCH", "ARRAY_CONTAINS", "ARRAY_NOT_CONTAINS", "IS_EMPTY", "NIS_EMPTY", "REGEX", "REGEX_NOT", "REGEX_MATCH", "REGEX_NOT_MATCH", "IPLIST_MATCH", "NLISTIP_MATCH", "INCIDR", "NINCIDR", "INCIDR6", "NINCIDR6", "RANGE", "RELATIVE_TIMESTAMP", "JSON_OVERLAPS", "JSON_ARRAY_CONTAINED_IN", "JSON_IS_NOT_EMPTY" ], "description": "The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`." }, "SEARCH_VALUE": { "example": "Other", "oneOf": [ { "type": "string" }, { "type": "boolean" }, { "type": "integer" }, { "type": "object" } ], "description": "The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator." } }, "example": { "filter": { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] } } }, "ComplexFilterExample": { "type": "object", "description": "Complex filter object for log forwarding rules with nested logical conditions. It is best to view each set of inner brackets as nested logical statements. This filter operates as a broad \"OR\" gate that allows a record to pass if it satisfies any one of three distinct logical paths. The first path is a straightforward check for records where the whitelist status is set to false, while the second path independently looks for records where the alert name field is empty. The third path is a complex, multi-layered requirement that only triggers if a record simultaneously meets several specific criteria: it must have a status of \"Under Investigation,\" it must contain a valid device hash, and it must belong to a domain that is neither IT, Hunting, nor Health. By nesting these \"AND\" conditions within a primary \"OR\" structure, the filter is constructed to capture a wide net of general alerts while applying a highly specific set of exclusions for investigative data. The SEARCH_FIELD and SEARCH_VALUE parameters are in essence open-ended and context-dependent. The field names vary by data source, module, and UI context. The field values depend on the specific field type and business logic. Please refer to the Create/Edit Notification Rule page on the UI for the latest availability of options for these fields.", "properties": { "SEARCH_FIELD": { "type": "string", "example": "xdm.asset.type.class", "description": "The field you want to filter." }, "SEARCH_TYPE": { "type": "string", "example": "NEQ", "enum": [ "EQ", "NEQ", "GT", "LT", "GTE", "LTE", "IN", "NIN", "RLIKE", "NRLIKE", "WILDCARD", "WILDCARD_NOT", "CONTAINS", "NCONTAINS", "IP_MATCH", "NIP_MATCH", "ARRAY_CONTAINS", "ARRAY_NOT_CONTAINS", "IS_EMPTY", "NIS_EMPTY", "REGEX", "REGEX_NOT", "REGEX_MATCH", "REGEX_NOT_MATCH", "IPLIST_MATCH", "NLISTIP_MATCH", "INCIDR", "NINCIDR", "INCIDR6", "NINCIDR6", "RANGE", "RELATIVE_TIMESTAMP", "JSON_OVERLAPS", "JSON_ARRAY_CONTAINED_IN", "JSON_IS_NOT_EMPTY" ], "description": "The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`." }, "SEARCH_VALUE": { "example": "Other", "oneOf": [ { "type": "string" }, { "type": "boolean" }, { "type": "integer" }, { "type": "object" } ], "description": "The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator." } }, "example": { "filter": { "OR": [ { "AND": [ { "SEARCH_FIELD": "is_whitelisted", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": false } ] }, { "AND": [ { "SEARCH_FIELD": "alert_name", "SEARCH_TYPE": "IS_EMPTY", "SEARCH_VALUE": "<No Value>" } ] }, { "AND": [ { "SEARCH_FIELD": "status.progress", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "STATUS_020_UNDER_INVESTIGATION" }, { "SEARCH_FIELD": "devicehash", "SEARCH_TYPE": "NIS_EMPTY", "SEARCH_VALUE": "<No Value>" }, { "AND": [ { "SEARCH_FIELD": "alert_domain", "SEARCH_TYPE": "NEQ", "SEARCH_VALUE": "DOMAIN_IT" }, { "SEARCH_FIELD": "alert_domain", "SEARCH_TYPE": "NEQ", "SEARCH_VALUE": "DOMAIN_HUNTING" }, { "SEARCH_FIELD": "alert_domain", "SEARCH_TYPE": "NEQ", "SEARCH_VALUE": "DOMAIN_HEALTH" } ] } ] } ] } } }, "Metadata": { "type": "object", "description": "Metadata for the response", "additionalProperties": true } } } }