Delete Isolation Exception Rule

Endpoint URL: https://<your server>/rest/settings/isolation-rule/delete
Endpoint URI: settings/isolation-rule/delete

Action: POST

Deletes an isolation exception rule.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

Request Headers

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file with cookie details with every request.


Request Body

Input: JSON

Download JSON syntax file

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

            {
            "ruleId": "<ID number>",
            "ipAddressString": "<IP address>",
            "port": "<port>",
            "blocking": "<boolean value>",
            "direction": "<communication direction>",
            "lastUpdated": "<timestamp>"
            }

Request Parameters

URL/URI parameters none

Request Body Parameters: You must specify the REQUIRED ruleID parameter and the lastUpdated parameters.

In addition, you must use at least one of these parameters:

Field

Type

Description

ipAddressString

String

The IP address of the machine to which the rule applies.

port

Integer

Optional if the ipAddressString parameter exists. The port by which Cybereason communicates with an isolated machine, according to the rule.

blocking

Boolean

States whether communication with the given IP or port is allowed. Set to true if communication is blocked.

direction

String

The direction of the allowed communication. Values include ALL, INCOMING, or OUTGOING.

lastUpdated

Float

The epoch timestamp for the last update time for the rule.


Response Status Codes

This request can return the following status codes:

  • 200: Success OK


Response Success Schema

Code 200 indicating success of the operation.


Response Failure Schema

A failed response returns a message stating the failure:

{
    "message": "<Your message here>",
    "result": "<reason for failing>",
    "currentState": {
        "<details>": null
    }
}

Important Response Fields

Important information is found in these fields:

  • result parameter: This string shows the result (success or failure) of the deletion.

  • currentState* parameter: This string shows the current state of the isolation rule.


Example: Delete an isolation rule

Request

curl --request POST \
        --url https://12.34.56.78/rest/settings/isolation-rule/delete \
        --header 'Content-Type:application/json' \
        --data '{
                    "ruleId": "5859b3d0ae8eeb920e9d2f4e",
                    "port": 8443,
                    "blocking": true,
                    "direction": "all",
                    "lastUpdated": 1525594605852
                }'