topic Re: Retrieving and Creating Alert rules via API in Prisma Cloud Discussions

Retrieving and Creating Alert rules via API

Yifan — Thu, 07 Jul 2022 15:38:59 GMT

- Api call add alert rule:

I want to create alert rules via API for the CSPM. Are there any examples for this? It's not clear to me how to populate:

alertRuleNotificationConfig

https://prisma.pan.dev/api/cloud/cspm/alert-rules#operation/add-alert-rule

POST https://{{api-endpoint}}/v2/alert/rule >> 405

Can we post events on this API endpoint?

- API call retrieving alert rule by ID:

GET https://{{api-endpoint}}/v1/alert/{{ruleid}} >> 404

The {id} which I retrieve with this API call:

https://prisma.pan.dev/api/cloud/cspm/alert-rules#operation/get-alert-rules-v2

Can any one verify that their api call are valid?

Re: Retrieving and Creating Alert rules via API

ENwankwo1 — Thu, 28 Jul 2022 08:43:48 GMT

Please follow Instructions on how to setup the Postman Collections and Environments relating to Prisma Cloud (including Compute Console) API requests.

[1] https://github.com/PaloAltoNetworks/pcs-postman

This is an easy way to use create alert rules via API for the CSPM.

Re: Retrieving and Creating Alert rules via API

NNawaz — Tue, 13 Sep 2022 17:21:32 GMT

Greeting,

I highly recommend you review the following doc before Prisma Cloud API.
1- Access the Prisma Cloud REST API
2- Generate JWT Token in Prisma Cloud
3- Stack API based on STACKs

I have added the sample Payload for your convenience.

{
"alertRuleNotificationConfig": [
{
"detailedReport": false,
"enabled": false,
"includeRemediation": false,
"recipients": [
"user@email.com"
],
"type": "email",
"withCompression": false,
"frequency": "as_it_happens"
}
],
"allowAutoRemediate": false,
"delayNotificationMs": 0,
"description": "",
"enabled": true,
"name": "Test12",
"policies": [
"5cc78081-1006-4874-8b13-bd01583888c4"
],
"policyLabels": [],
"scanAll": false,
"target": {
"accountGroups": [
"41ec1962-2f54-49e7-b07e-d7ae1cacfd3d"
],
"excludedAccounts": [],
"regions": [],
"targetResourceList": {
"action": "AUTO_DISMISS",
"additionalNotes": "",
"approver": "",
"enabled": false,
"ids": [],
"reason": "",
"requestor": ""
},
"tags": []
},
"notifyOnDismissed": true,
"notifyOnOpen": true,
"notifyOnResolved": true,
"notifyOnSnoozed": true
}

POST https://{{api-endpoint}}/v2/alert/rule >> 405
Can we post events on this API endpoint?

No, we can't post to the above endpoint as API endpoint is missing.

Prisma Cloud API call is mainly based on the STACK for instance if I am on STACK APP2 the link would be https://api2.prismacloud.io/v2/alert/rule
or If I am using APP.EU the API call link would be https://api.eu.prismacloud.io/v2/alert/rule

API call retrieving alert rule by ID:

GET https://{{api-endpoint}}/v1/alert/{{ruleid}}

To run the following API call, firstly run the API call to get Alert ID.

My tenant is on APP3 so the API call would be https://api3.prismacloud.io/v2/alert/rule

Then use the following API call.

https://api3.prismacloud.io/v1/alert/{{ruleid}}

I hope this info will help.