Delete Isolation Exception Rule

Endpoint URL: https://<your server>/rest/settings/isolation-rule/delete
Endpoint URI: settings/isolation-rule/delete

Action: POST

Deletes an isolation exception rule.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file with cookie details with every request.

Input: JSON

Download JSON syntax file

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

            {
            "ruleId": "<ID number>",
            "ipAddressString": "<IP address>",
            "port": "<port>",
            "blocking": "<boolean value>",
            "direction": "<communication direction>",
            "lastUpdated": "<timestamp>"
            }

URL/URI parameters none

Request Body Parameters: You must specify the REQUIRED ruleID parameter and the lastUpdated parameters.

In addition, you must use at least one of these parameters:

Field	Type	Description
ipAddressString	String	The IP address of the machine to which the rule applies.
port	Integer	Optional if the ipAddressString parameter exists. The port by which Cybereason communicates with an isolated machine, according to the rule.
blocking	Boolean	States whether communication with the given IP or port is allowed. Set to true if communication is blocked.
direction	String	The direction of the allowed communication. Values include ALL, INCOMING, or OUTGOING.
lastUpdated	Float	The epoch timestamp for the last update time for the rule.

This request can return the following status codes:

200: Success OK

Code 200 indicating success of the operation.

A failed response returns a message stating the failure:

{
    "message": "<Your message here>",
    "result": "<reason for failing>",
    "currentState": {
        "<details>": null
    }
}

Important information is found in these fields:

result parameter: This string shows the result (success or failure) of the deletion.
currentState* parameter: This string shows the current state of the isolation rule.

Request

curl --request POST \
        --url https://12.34.56.78/rest/settings/isolation-rule/delete \
        --header 'Content-Type:application/json' \
        --data '{
                    "ruleId": "5859b3d0ae8eeb920e9d2f4e",
                    "port": 8443,
                    "blocking": true,
                    "direction": "all",
                    "lastUpdated": 1525594605852
                }'

Request

Download JSON syntax file

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

Use this request body:

                    {
                        "ruleId": "5859b3d0ae8eeb920e9d2f4e",
                        "port": 8443,
                        "blocking": true,
                        "direction": "all",
                        "lastUpdated": 1525594605852
                    }

Request

Request Python script

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

import requests
import json

# Login information

username = "[email protected]"
password = "mypassword"
server = "yourserver.com"
port = "443"

data = {
    "username": username,
    "password": password
}

headers = {"Content-Type": "application/json"}

base_url = "https://" + server + ":" + port

login_url = base_url + "/login.html"

session = requests.session()

login_response = session.post(login_url, data=data, verify=True)

print (login_response.status_code)
print (session.cookies.items())

# Request URL

endpoint_url = "/rest/settings/isolation-rule/delete"

api_url = base_url + endpoint_url

# These are the variables that represent different fields in the request.

rule_id = "5a7b2e95e4b082f2e909a4f3"
ip_address = "1.1.1.1"
port = "8080"
direction = "ALL"
update_time = 1518022293843

rule = json.dumps({"ruleId":rule_id,"ipAddressString":ip_address,"port":port,"blocking":"false","direction":direction,"lastUpdated":update_time})

api_headers = {'Content-Type':'application/json'}

api_response = session.request("POST", api_url, data=rule, headers=api_headers)

your_response = json.loads(api_response.content)

print(json.dumps(your_response, indent=4, sort_keys=True))