Create stream rules from input records. Rules are created disabled.

Input record:

• name (required) - Rule name. A duplicate name is rejected
• schema_code (required) - Log schema code - the code field of sonar-log-schemas, e.g. session
• msg (required) - Event title template. $field inserts a log field value, e.g. SSH: $src_ip -> $dst_ip
• priority (required) - LOW, MEDIUM or HIGH
• commands (required) - List of condition records - each element is one condition of the rule body
• query (required) - Whole rule body as one pipeline string; it is split into stages on the pipe
• description (optional) - Free-text description
• source_type (optional) - LOGGER or LOGGER_MODEL
• logger_guids (optional) - Logger GUIDs - a list, or a comma-separated string
• logger_model_guids (optional) - Logger model GUIDs - a list, or a comma-separated string
• category_guid (optional) - Category GUID
• ticket_repo_guid (optional) - Ticket repository GUID
• suppress_key (optional) - Suppression key template, e.g. $src_ip$dst_ip. One event per distinct combination
• event_suppress_interval (optional) - Event suppression window in seconds
• ticket_suppress_interval (optional) - Ticket suppression window in seconds
• keep_alive (optional) - true or false
• enabled (optional) - true or false. false unless given
• mitre_tactics (optional) - MITRE tactic IDs in TA0011 form - a list, or a space- or comma-separated string
• mitre_techs (optional) - MITRE technique IDs in T1071.001 form - a list, or a space- or comma-separated string

commands and query are two ways to give the same thing - one of them is required.

run=VALUE

Optional. Create rule only if value is 't'

Output Fields