Prisma Cloud API: Unable to create a new alert rule with a Microsoft Teams Integration

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Prisma Cloud API: Unable to create a new alert rule with a Microsoft Teams Integration

L1 Bithead

Hello everyone,

 

I have been unable to create an alert rule using the Prisma Cloud CSPM API that contains the "alertRuleNotificationConfig" inside the body in order to link it to a Microsoft Teams Integration, here are the steps that I have followed to do it:

  1. Save the correct base URI in a variable.
  2. Login and obtain the token.
  3. Obtain the AccountGroupID.
  4. Create a new Alert rule. Until this point, without the "alertRuleNotificationConfig", it works and creates a new alert rule.
  5. Tried to add the alert rule part to the Body, keeps responding 400 (Bad Request)

The PowerShell code is as follows:

 

function New-PrismaCloudTeamsAlertRule{
    param(
        #String with the JWT token
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [String]
        $Token,

        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [String]
        $AlertRuleName,
        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [String]
        $AlertRuleDescription,

        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $AccountGroupIDs,

        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $Severity,

        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $CloudType,

        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $ComplianceStandard,

        [Parameter(
        Mandatory=$false,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $TeamsIntegrationID,

        [Parameter(
        Mandatory=$false,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [ValidateSet("as_it_happens","daily","weekly","monthly")]
        [String]
        $Frequency,
        
        [Parameter(
        Mandatory=$false,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [string]
        $daysOfWeek="MO"
)

#Check severity
$ref=@('critical','high','medium','low','informational')
$refregex=[string]::Join('|',$ref)
if($Severity -notmatch $refregex){
    exit
}
$Severity = $Severity.ToUpper()

#Check cloud type
$ref=@('All','AWS','Azure','Alibaba_Cloud','OCI','IBM')
$refregex=[string]::Join('|',$ref)
if($CloudType -notmatch $refregex){
    exit
}
$CloudType = $CloudType.ToLower()



$PrismaNewTeamsAlerRule = @{
    Uri = "$URI" + "alert/rule"
    Method= "POST"
    Headers= @{"x-redlock-auth"= $token;"Accept"= "application/json";"charset"="UTF-8";"content-type"="application/json"}
    Body = @{
            "name"="$AlertRuleName"
            "description"="$AlertRuleDescription"
            "allowAutoRemediate"=$false
            "enabled"=$true
            "scanAll"=$false
            "target"=@{
                "accountGroups"=$AccountGroupIDs
                "alertRulePolicyFilter"=@{
                    "policy.severity"=$Severity
                    "cloud.type"=$CloudType
                    "policy.complianceStandard"=$ComplianceStandard
                }
            }
            "alertRuleNotificationConfig"=@{
                 "daysOfWeek"=@(@{
                     "day"=$daysOfWeek
                     "offset"=[int]0
                })
                "enabled"=$true
                "detailedReport"=$false
                "frequency"=$Frequency
                "withCompression"=$false
                "includeRemediation"=$false
                "recipients"=$TeamsIntegrationID
                "type"='microsoft_teams'
            }
                
    } | ConvertTo-Json -Depth 3
}
$PrismaNewTeamsAlerRule.Body
Invoke-RestMethod @PrismaNewTeamsAlerRule -Verbose
}

 

1 accepted solution

Accepted Solutions

I have solved it, the problem was that the integration itself was not enclosed inside an array, as seen here:

 

$PrismaNewTeamsAlerRule = @{
    Uri = "$URI" + "alert/rule"
    Method= "POST"
    Headers= @{"x-redlock-auth"= $token;"Accept"= "application/json";"charset"="UTF-8";"content-type"="application/json"}
    Body = @{
            "name"="$AlertRuleName"
            "description"="$AlertRuleDescription"
            "allowAutoRemediate"=$false
            "enabled"=$true
            "scanAll"=$false
            "policies"=$policies
            "target"=@{
                "accountGroups"=$AccountGroupIDs
                "alertRulePolicyFilter"=@{
                    "policy.severity"=$Severity
                    "cloud.type"=$CloudType
                    "policy.complianceStandard"=$ComplianceStandard
                }
            }
            "alertRuleNotificationConfig"=@(@{ #Array added
                 "daysOfWeek"=@(@{
                     "day"=$daysOfWeek
                     "offset"=0
                })
                "enabled"=$true
                "detailedReport"=$false
                "frequency"=$Frequency
                "withCompression"=$false
                "includeRemediation"=$false
                "recipients"=$IntegrationID
                "type"=$IntegrationType
            })
    } | ConvertTo-Json -Depth 4
}

I also had to add the conversion to JSON with Depth 4, as adding the array adds an additional depth grade. I have checked the pan.dev page with the add alert rule request for the API and it appears in a very unclear way.

 

Thank you for the response and sorry for the inconvenience.

 

View solution in original post

3 REPLIES 3

L1 Bithead

Bump.

L1 Bithead

Hello, 

 

I see you are getting 400 Bad request, can you please share which one of the below errors are you getting

 

 

invalid_param_value / auto_remediation_only_for_config_remediable_policies / missing_required_param / non_notification_state_selected / invalid_notification_state / invalid_resource_list_id / snooze_time_must_be_relative / dismissal_reason_required / has_overlaps_in_resource_list_rules / missing_required_param

 

 

We will need to first add the integration via the API or Prisma Cloud Console and then run the API to add the alert rule with the actual integration name. 

 

More details on adding integration here >>> https://pan.dev/prisma-cloud/api/cspm/create-integration-v-1/ 

 

Once the integration has been added, in this case Microsoft_teams, make sure we are using either of below 3 for recipients

 

 

For email notifications: List of unique email addresses to notify
For integrations without notification templates: List of integration ids
For integrations with notification templates: List of notification template ids

 

 

and for 'type' use microsoft_teams

 

Your schema shall have similar to what we see below: additional details here >>> https://pan.dev/prisma-cloud/api/cspm/add-alert-rule/ 

 

{
"alertRuleNotificationConfig": [
{
"dayOfMonth": 0,
"daysOfWeek": [
{
"day": "SU",
"offset": 0
}
],
"detailedReport": true,
"enabled": true,
"frequency": "as_it_happens",
"frequencyFromRRule": "string",
"hourOfDay": 0,
"id": "string",
"includeRemediation": true,
"lastUpdated": 0,
"last_sent_ts": 0,
"recipients": [
"0346b5dd-5b3c-88d8-a1543-ad2c006fe076" 
],
"rruleSchedule": "string",
"templateId": "string",
"timezone": "string",
"type": "microsoft_teams",
"withCompression": true
}
],
"allowAutoRemediate": true,
"delayNotificationMs": 0,
"description": "string",
"enabled": true,
"lastModifiedBy": "string",
"lastModifiedOn": 0,
"name": "string",
"notifyOnDismissed": true,
"notifyOnOpen": true,
"notifyOnResolved": true,
"notifyOnSnoozed": true,
"policies": [
"string"
],
"policyLabels": [
"string"
],
"policyScanConfigId": "string",
"scanAll": true,
"target": {
"accountGroups": [
"string"
],
"alertRulePolicyFilter": {
"availablePolicyFilters": [
"string"
],
"cloud.type": [
"ALL"
],
"policy.complianceStandard": [
"string"
],
"policy.label": [
"string"
],
"policy.severity": [
"string"
]
},
"excludedAccounts": [
"string"
],
"includedResourceLists": {
"computeAccessGroupIds": [
"string"
]
},
"regions": [
"string"
],
"tags": [
{
"key": "string",
"values": [
"string"
]
}
]
}
}





 

 

Let us know if there are any additional questions. 

Thanks

I have solved it, the problem was that the integration itself was not enclosed inside an array, as seen here:

 

$PrismaNewTeamsAlerRule = @{
    Uri = "$URI" + "alert/rule"
    Method= "POST"
    Headers= @{"x-redlock-auth"= $token;"Accept"= "application/json";"charset"="UTF-8";"content-type"="application/json"}
    Body = @{
            "name"="$AlertRuleName"
            "description"="$AlertRuleDescription"
            "allowAutoRemediate"=$false
            "enabled"=$true
            "scanAll"=$false
            "policies"=$policies
            "target"=@{
                "accountGroups"=$AccountGroupIDs
                "alertRulePolicyFilter"=@{
                    "policy.severity"=$Severity
                    "cloud.type"=$CloudType
                    "policy.complianceStandard"=$ComplianceStandard
                }
            }
            "alertRuleNotificationConfig"=@(@{ #Array added
                 "daysOfWeek"=@(@{
                     "day"=$daysOfWeek
                     "offset"=0
                })
                "enabled"=$true
                "detailedReport"=$false
                "frequency"=$Frequency
                "withCompression"=$false
                "includeRemediation"=$false
                "recipients"=$IntegrationID
                "type"=$IntegrationType
            })
    } | ConvertTo-Json -Depth 4
}

I also had to add the conversion to JSON with Depth 4, as adding the array adds an additional depth grade. I have checked the pan.dev page with the add alert rule request for the API and it appears in a very unclear way.

 

Thank you for the response and sorry for the inconvenience.

 

  • 1 accepted solution
  • 1469 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!