Prisma Cloud API: Unable to create a new alert rule with a Microsoft Teams Integration

[JLlorente]

Hello everyone,

I have been unable to create an alert rule using the Prisma Cloud CSPM API that contains the "alertRuleNotificationConfig" inside the body in order to link it to a Microsoft Teams Integration, here are the steps that I have followed to do it:

1. Save the correct base URI in a variable.
2. Login and obtain the token.
3. Obtain the AccountGroupID.
4. Create a new Alert rule. Until this point, without the "alertRuleNotificationConfig", it works and creates a new alert rule.
5. Tried to add the alert rule part to the Body, keeps responding 400 (Bad Request)

The PowerShell code is as follows:

function New-PrismaCloudTeamsAlertRule{
    param(
        #String with the JWT token
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [String]
        $Token,

        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [String]
        $AlertRuleName,
        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [String]
        $AlertRuleDescription,

        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $AccountGroupIDs,

        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $Severity,

        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $CloudType,

        
        [Parameter(
        Mandatory=$true,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $ComplianceStandard,

        [Parameter(
        Mandatory=$false,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [array]
        $TeamsIntegrationID,

        [Parameter(
        Mandatory=$false,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [ValidateSet("as_it_happens","daily","weekly","monthly")]
        [String]
        $Frequency,
        
        [Parameter(
        Mandatory=$false,
        HelpMessage="Introduce a valid token in String format",
        ValueFromPipeline=$true)]
        [string]
        $daysOfWeek="MO"
)

#Check severity
$ref=@('critical','high','medium','low','informational')
$refregex=[string]::Join('|',$ref)
if($Severity -notmatch $refregex){
    exit
}
$Severity = $Severity.ToUpper()

#Check cloud type
$ref=@('All','AWS','Azure','Alibaba_Cloud','OCI','IBM')
$refregex=[string]::Join('|',$ref)
if($CloudType -notmatch $refregex){
    exit
}
$CloudType = $CloudType.ToLower()



$PrismaNewTeamsAlerRule = @{
    Uri = "$URI" + "alert/rule"
    Method= "POST"
    Headers= @{"x-redlock-auth"= $token;"Accept"= "application/json";"charset"="UTF-8";"content-type"="application/json"}
    Body = @{
            "name"="$AlertRuleName"
            "description"="$AlertRuleDescription"
            "allowAutoRemediate"=$false
            "enabled"=$true
            "scanAll"=$false
            "target"=@{
                "accountGroups"=$AccountGroupIDs
                "alertRulePolicyFilter"=@{
                    "policy.severity"=$Severity
                    "cloud.type"=$CloudType
                    "policy.complianceStandard"=$ComplianceStandard
                }
            }
            "alertRuleNotificationConfig"=@{
                 "daysOfWeek"=@(@{
                     "day"=$daysOfWeek
                     "offset"=[int]0
                })
                "enabled"=$true
                "detailedReport"=$false
                "frequency"=$Frequency
                "withCompression"=$false
                "includeRemediation"=$false
                "recipients"=$TeamsIntegrationID
                "type"='microsoft_teams'
            }
                
    } | ConvertTo-Json -Depth 3
}
$PrismaNewTeamsAlerRule.Body
Invoke-RestMethod @PrismaNewTeamsAlerRule -Verbose
}

[JLlorente]

Bump.

[knaqvi]

Hello, 

I see you are getting 400 Bad request, can you please share which one of the below errors are you getting

invalid_param_value / auto_remediation_only_for_config_remediable_policies / missing_required_param / non_notification_state_selected / invalid_notification_state / invalid_resource_list_id / snooze_time_must_be_relative / dismissal_reason_required / has_overlaps_in_resource_list_rules / missing_required_param

We will need to first add the integration via the API or Prisma Cloud Console and then run the API to add the alert rule with the actual integration name. 

More details on adding integration here >>> https://pan.dev/prisma-cloud/api/cspm/create-integration-v-1/ 

Once the integration has been added, in this case Microsoft_teams, make sure we are using either of below 3 for recipients

For email notifications: List of unique email addresses to notify
For integrations without notification templates: List of integration ids
For integrations with notification templates: List of notification template ids

and for 'type' use microsoft_teams

Your schema shall have similar to what we see below: additional details here >>> https://pan.dev/prisma-cloud/api/cspm/add-alert-rule/ 

{
"alertRuleNotificationConfig": [
{
"dayOfMonth": 0,
"daysOfWeek": [
{
"day": "SU",
"offset": 0
}
],
"detailedReport": true,
"enabled": true,
"frequency": "as_it_happens",
"frequencyFromRRule": "string",
"hourOfDay": 0,
"id": "string",
"includeRemediation": true,
"lastUpdated": 0,
"last_sent_ts": 0,
"recipients": [
"0346b5dd-5b3c-88d8-a1543-ad2c006fe076" 
],
"rruleSchedule": "string",
"templateId": "string",
"timezone": "string",
"type": "microsoft_teams",
"withCompression": true
}
],
"allowAutoRemediate": true,
"delayNotificationMs": 0,
"description": "string",
"enabled": true,
"lastModifiedBy": "string",
"lastModifiedOn": 0,
"name": "string",
"notifyOnDismissed": true,
"notifyOnOpen": true,
"notifyOnResolved": true,
"notifyOnSnoozed": true,
"policies": [
"string"
],
"policyLabels": [
"string"
],
"policyScanConfigId": "string",
"scanAll": true,
"target": {
"accountGroups": [
"string"
],
"alertRulePolicyFilter": {
"availablePolicyFilters": [
"string"
],
"cloud.type": [
"ALL"
],
"policy.complianceStandard": [
"string"
],
"policy.label": [
"string"
],
"policy.severity": [
"string"
]
},
"excludedAccounts": [
"string"
],
"includedResourceLists": {
"computeAccessGroupIds": [
"string"
]
},
"regions": [
"string"
],
"tags": [
{
"key": "string",
"values": [
"string"
]
}
]
}
}

Let us know if there are any additional questions. 

Thanks

[JLlorente · Accepted solution]

I have solved it, the problem was that the integration itself was not enclosed inside an array, as seen here:

$PrismaNewTeamsAlerRule = @{
    Uri = "$URI" + "alert/rule"
    Method= "POST"
    Headers= @{"x-redlock-auth"= $token;"Accept"= "application/json";"charset"="UTF-8";"content-type"="application/json"}
    Body = @{
            "name"="$AlertRuleName"
            "description"="$AlertRuleDescription"
            "allowAutoRemediate"=$false
            "enabled"=$true
            "scanAll"=$false
            "policies"=$policies
            "target"=@{
                "accountGroups"=$AccountGroupIDs
                "alertRulePolicyFilter"=@{
                    "policy.severity"=$Severity
                    "cloud.type"=$CloudType
                    "policy.complianceStandard"=$ComplianceStandard
                }
            }
            "alertRuleNotificationConfig"=@(@{ #Array added
                 "daysOfWeek"=@(@{
                     "day"=$daysOfWeek
                     "offset"=0
                })
                "enabled"=$true
                "detailedReport"=$false
                "frequency"=$Frequency
                "withCompression"=$false
                "includeRemediation"=$false
                "recipients"=$IntegrationID
                "type"=$IntegrationType
            })
    } | ConvertTo-Json -Depth 4
}

I also had to add the conversion to JSON with Depth 4, as adding the array adds an additional depth grade. I have checked the pan.dev page with the add alert rule request for the API and it appears in a very unclear way.

Thank you for the response and sorry for the inconvenience.