Rule

rule

The Rule object describes characteristics of a rule associated with a policy or an event.

Contents

Attributes

Caption Name Type Is Array Default Description
Category category String The rule category.
Description desc String The description of the rule that generated the event.
Name name String The name of the rule that generated the event.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Type type String The rule type.
Unique ID uid String The unique identifier of the rule that generated the event.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
Version version String The rule version. For example: 1.1.

References

Referenced By

Context

Rule

JSON

            
{
  "caption": "Rule",
  "description": "The Rule object describes characteristics of a rule associated with a policy or an event.",
  "extends": "_entity",
  "name": "rule",
  "attributes": {
    "category": {
      "description": "The rule category.",
      "requirement": "optional",
      "caption": "Category",
      "type": "string_t"
    },
    "desc": {
      "description": "The description of the rule that generated the event.",
      "requirement": "optional",
      "caption": "Description",
      "type": "string_t"
    },
    "name": {
      "description": "The name of the rule that generated the event.",
      "requirement": "recommended",
      "caption": "Name",
      "type": "string_t"
    },
    "type": {
      "description": "The rule type.",
      "requirement": "optional",
      "caption": "Type",
      "type": "string_t"
    },
    "uid": {
      "description": "The unique identifier of the rule that generated the event.",
      "requirement": "recommended",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "version": {
      "description": "The rule version. For example: <code>1.1</code>.",
      "requirement": "optional",
      "caption": "Version",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "constraints": {
    "at_least_one": [
      "name",
      "uid"
    ]
  }
}