Securonix Policy Management API

openapi: 3.2.0
info:
  version: 3.1.4
  title: Service Policy Management API
  description: "The Policy Management API allows users to create, retrieve, update, and manage security policies in the Unified Defense SIEM (UDS) platform.\n\n---\n\n### Authentication & Authorization\n- **Authentication**: All requests require a JWT Bearer token.\n- **Authorization**: Access is enforced using `role` and `tenant` claims present in the JWT.\n  - **Read APIs** require one of: `ROLE_ADMIN`, `ROLE_CONTENT_DEVELOPER`, `ROLE_READ_ONLY`.\n  - **Write APIs** require one of: `ROLE_ADMIN`, `ROLE_CONTENT_DEVELOPER`.\n\n Refer to the [Authentication Guide](https://documentation.securonix.com/r/content/authentication.htm) for token acquisition and usage.\n\n **⚠️ Important:** The **API Base URL** is region-specific and must be obtained from your Technical Account Manager or Securonix Customer Support."
  contact:
    name: Securonix Customer Support
    url: ''
    email: customer-support@securonix.com
servers:
- url: https://policymanagement.api.securonix.net
  description: Policy Management API regional base URL
security:
- bearerAuth: []
tags:
- name: Policy Management
  description: The Policy Management API allows users to configure  policies in the Unified Defense SIEM platform (UDS).
paths:
  /v1/policies/client-id:
    get:
      tags:
      - Policy Management
      summary: Get Client ID from JWT token
      description: "Extracts and returns the Client ID information from the provided JWT authorization token. \n"
      operationId: getClientId
      responses:
        '200':
          description: 'TenantId is retrieved successfully. You can use the tenantId as the header parameter (**client-id**) for policy APIs to authenticate your request. '
          content:
            application/json:
              schema:
                type: string
                examples:
                - tenant1
              examples:
                default:
                  $ref: '#/components/examples/default'
        '401':
          description: Invalid JWT token. Please provide a valid token to access the resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    statusCode: GATEWAY-10-1
                    message: Access token expired
        '403':
          description: Forbidden - Valid credentials but insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    statusCode: 403 FORBIDDEN
                    message: User is Not entitled for getting the requested data
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/400BadRequest'
              examples:
                Example 1:
                  value:
                    message: Policy not found for id 1
                    httpStatus: NOT_FOUND
        '422':
          description: Parent id not found in Auth token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    message: Parent id not found in Auth token
                    statusCode: 422 Unprocessable Entity
        '500':
          description: Error processing the request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    statusCode: INTERNAL_ERROR
                    message: An unexpected error occurred while processing the policy.
      security:
      - bearerAuth: []
  /v1/policies/create:
    post:
      tags:
      - Policy Management
      summary: Creates new UDS policies.
      description: 'Creates a new policy in the Unified Defense SIEM platform (UDS). It accepts the DELTA format polices, then converts and saves them to UDS.


        > **YAML Response Support:**

        > - To receive a YAML response, include the header `Accept: application/yaml` or `Accept: application/x-yaml` in the request.

        > - JSON remains the default when the Accept header is not provided.

        > - If YAML conversion fails, the response falls back to JSON.

        '
      operationId: createPolicies
      parameters:
      - $ref: '#/components/parameters/ClientIdHeader'
      - $ref: '#/components/parameters/AcceptHeader'
      requestBody:
        description: "YAML object containing the details of the policy to be created in the Securonix platform. \nThe request must include all required fields as defined in the `Policy` schema. \n\n"
        required: true
        content:
          application/yaml:
            schema:
              $ref: '#/components/schemas/Policy'
            examples:
              Example 1:
                value:
                  name: Account Updates From Suspicious IP Address
                  category:
                  - Persistence
                  - FRAUD
                  functionality:
                  - loud Authentication / SSO / Single Sign-On
                  lifecycle: experimental
                  version: 6402507
                  description: P Address of (username spraying and password spraying) violators are stored in a active list where this information is stored for 24 hrs.
                  labels:
                  - attack.defense_evasion
                  logsource:
                    product: Google Login
                    service: Google
                  detection:
                    selection_1:
                      baseeventid: '4688'
                    selection_2:
                      destinationprocessname: lsaas.exe
                    selection_3:
                      commandline|contains: lsass.exe
                    condition: selection_1 AND ( selection_2 or selection_3 )
                  criticality: Low
                  violator: Activityip
                  violatorAttribute: sourceaddress
                  tenantname:
                  - string
                  signatureid: CAAL-Delta-1
                  threatname: Account Manipulation
                  saveasthreat: true
                  verbose_info: '''Account ${accountname!"UNKNOWN"} getting updates from possible suspicious IP Address.'''
                  violation_summary:
                    grouping_attribute: DeviceAction
                    level2_attribute: DeviceEventCategory
                    level2_metadata_attributes:
                    - DestinationUserName
                    - ModifiedProperties1
                    metadata_attributes:
                    - SourceUserId
                    - Category
                  incident_workflow: SOCTeamReview
                  autoIncidentEnabled: true
                  analytical_type:
                    aggregated_event_analytics:
                    - name: Authentication Failed
                      aee_filter:
                        selection1:
                          baseeventid: 4625
                        condition: selection1
                      number_of_occurrences:
                        duration: 01:30:00
                        atleast: 1
                        count_matching_criteria:
                          baseeventid: 15
                      similar_value:
                      - accountname
                      consecutive_events: true
                      distinct_value:
                      - ipaddress
                      - eventcountry
                    - name: Authentication Success
                      aee_filter:
                        selection1:
                          baseeventid|equals: 4625
                        condition: selection1
                      number_of_occurrences:
                        duration: 01:30:00
                        atleast: 1
                        count_matching_criteria:
                          baseeventid: 15
                      consecutive_events: false
                      distinct_value:
                      - ipaddress
                      - eventcountry
                      parent_child_relationship:
                        duration: 01:00:00
                        common_values:
                        - accountname
                  additional_event_analytics:
                    match_all_checks: true
                    check_against_watchlist:
                    - accountname: Terminated_Contractors
                      flag_violation_not_found_in_watchlist: true
                    check_against_lookup:
                    - lookup:
                        accountname: MultipleFailedEntries
                      condition: lookup
                      additional_criteria:
                        selection_1:
                          VendorId|contains: Vendor
                        condition: NOT selection_1
                    email_to_self:
                    - emailrecipient: 0.8
                    match_string:
                    - ms:
                        first_field: AccountName
                        second_field: UserNameSpace
                        threshold: 0.8
                    check_against_tpi:
                    - tpi: null
                      destinationaddress:
                      - SNXTIS_BASIC_IPV4
                      - SNXTIS_BASIC_IPV6
                      additional_criteria:
                        selection_1:
                        - tpi_src_confidence|gt: 5
                        - tpi_country|contains|attr: country
                        selection_2:
                        - tpi_src: abc
                        condition: selection_1 AND NOT selection_2
                    check_against_activelist:
                    - activelist:
                        rule: ipaddress
                        rule_match_present: true
                        activelist_name: Password_spraying_attempts_From_single_IP
                  violation_action:
                    dailyviolationthreshold: 100000
                    add_to_watchlist:
                      watchlist_name: Domain_Admin
                      removal_period:
                        days: 1
                        time: '12:00:00'
                        expiry_date_from_current_time: true
                  apisource: AI
      responses:
        '200':
          description: Policies created successfully. Supports both JSON and YAML response formats via Accept header (application/json or application/x-yaml). If YAML conversion fails, returns JSON.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatePolicyResponse'
              examples:
                Example 1:
                  value:
                    id: 12345
                    name: Suspicious Login Policy
                    description: Detects suspicious login patterns
                    enabled: true
                    createdOn: '2023-01-15T10:30:00Z'
                    lastUpdated: '2023-06-20T14:45:00Z'
                    createdBy: admin
                    updatedBy: security_analyst
                    owner: security_team
                    riskTypeId: 101
                    criticality: HIGH
                    riskThreatId: 201
                    threatName: Account Compromise
                    category: Authentication
                    categoryId: 301
                    policyType: REALTIME
                    functionality: LOGIN_MONITORING
                    functionalityId: 401
                    hql: SELECT * FROM events WHERE...
                    query: user.login_attempts > 5
                    groupBy: user_id
                    havingClause: COUNT(*) > 3
                    joinGroup: user_events
                    initiateWorkFlow: true
                    directHql: false
                    directiveEnabled: true
                    functionEnabled: true
                    directiveConfig: <directiveConfig>...</directiveConfig>
                    functionConfig: <functionConfig>...</functionConfig>
                    configWorkflowName: incident_response_workflow
                    violator: user_id
                    violatorAttribute: sourceusername
                    violation: Multiple failed login attempts
                    violatorCriticalityLevel: HIGH
                    violationDisplayConfig: <display>...</display>
                    verboseInfoTemplate: User {user} attempted {count} logins
                    maxResults: 1000
                    dailyViolationThreshold: 100
                    aggregateScore: 85
                    cappedRiskScore: 9.5
                    constantScore: '7.5'
                    customScore: 8.2
                    secVersion: 2.1
                    uniqueCode: POL_LOGIN_001
                    signatureId: SIG_12345
                    isWatchlist: false
                    sandboxCategory: false
                    notification: true
                    realTimeCheck: true
                    outputDatabase: true
                    savePveAndScore: true
                    saveAsThreat: false
                    actionPrediction: true
                    commitPolicy: true
                    additionalInfo: false
                    valid: true
                    riskBoosterEnabled: false
                    riskBoosterConfig: <riskbooster>...</riskbooster>
                    functionSuspectConfigEnabled: false
                    functionSuspectConfig: <suspect>...</suspect>
                    suspectConfig: <config>...</config>
                    suspectChecksListId: 501
                    resourceGroupId: 601
                    emailTemplateId: 701
                    spConfigSummarizationId: 801
                    resourceType: DATABASE
                    resourceTypeId: DB_001
                    analyticsType: BEHAVIORAL
                    operatorConfig: <operator>...</operator>
                    analyzerConfig: <analyzer>...</analyzer>
                    ownership: security_team
                    pipelineName: security_pipeline
                    feedback: Working as expected
                    releaseNotes: Updated threshold values
                    whatsNew: Added new detection logic
                    origin: PA
                    modifiedOrigin: UI
                    remediator: auto_remediation
                    threatRemediationSteps: 1. Block user 2. Notify admin
                    policyFunctionalityRelations:
                    - id: 1
                      functionalityName: LOGIN_MONITORING
                      tenantid: 4
                      idx: 0
                    policylabels:
                    - label_name: scx.attack.privilege_escalation
                      labelId: 245
                      idx: 1
                    policyWatchlists:
                    - id: 10
                      watchlistId: 9995
                      index: 0
                      watchlistName: Recent_Transfers
                      expiryDaysCount: 30
                      decayFactor: 0
                      decayFlag: false
                      initialConfidenceLevel: 1
                      confidenceIncrementFactor: 0
                      dynamicWatchlist: true
                      fieldList: ''
                      calculateExpiryFromNow: false
                    policyActivelists:
                    - activelistId: 9
                      policyId: 12345
                      index: 0
                      metadata: "<activeListParamsBean>\n    <keyRule>u_employeeid</keyRule>\n    <violationAttributes>deviceaction,ipaddress,destinationaddress,destinationport</violationAttributes>\n</activeListParamsBean>"
                    policyDeprecateInfo:
                    - id: 769
                      deprecated: false
                      index: 0
                      starttime: '2023-04-12'
                      endtime: '2023-04-19'
                      validityindays: '7'
                      deprecatedwithviolation: false
                      signatureid: SIG_12345
                      policyname: Suspicious Login Policy
                    policyPredictionAttributes:
                    - riskTypeId: 2393
                      forestId: 2393
                      riskThreatId: 50149
                      signatureId: '1000024'
                      index: 0
                      attributes: "<policyAttributeBean>\n    <attributePriorityMap>\n        <entry>\n            <key>ipaddress</key>\n            <value>1</value>\n        </entry>\n        <entry>\n            <key>u_employeeid</key>\n            <value>1</value>\n        </entry>\n        <entry>\n            <key>u_department</key>\n            <value>1</value>\n        </entry>\n        <entry>\n            <key>u_firstname</key>\n            <value>1</value>\n        </entry>\n        <entry>\n            <key>accountname</key>\n            <value>1</value>\n        </entry>\n        <entry>\n            <key>transactionstring1</key>\n            <value>1</value>\n        </entry>\n        <entry>\n            <key>u_lastname</key>\n            <value>1</value>\n        </entry>\n    </attributePriorityMap>\n</policyAttributeBean>"
                    policyOutputConfigs: []
                    policyResources:
                    - id: 1
                      resourceId: 1
                      resourceGroupId: 1
                      resourceTypeId: 1
                    policyRules:
                    - id: 1050
                      object: Users
                      field: transferreddate
                      condition: CONDITION_GREATER_THAN_OR_EQUALS
                      value: $CURRENT_DATE
                      logicalCondition: AND
                      group: group_1
                      index: 0
                      deviationFlag: 'No'
                      ruleType: USER
                      functionRightString: fn_date_sub(${field}, ${p1}, ${p2})
                      functionRightParameters: 30|DAY
            application/yaml:
              schema:
                $ref: '#/components/schemas/Policy'
              description: YAML representation of the created policy in DELTA format. Returned when Accept header is application/yaml or application/x-yaml.
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Policy'
              description: YAML representation of the created policy in DELTA format. Equivalent to application/yaml.
        '400':
          description: Invalid input data. Cannot process policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/400BadRequest'
        '401':
          description: Unauthorized - Missing or invalid credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    statusCode: GATEWAY-10-1
                    message: Access token expired
        '403':
          description: Forbidden - Valid credentials but insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/400BadRequest'
              examples:
                Example 1:
                  value:
                    message: Policy not found for id 1
                    httpStatus: NOT_FOUND
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    message: Parent id not found in Auth token
                    statusCode: 422 Unprocessable Entity
        '500':
          description: Error processing policies.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                Example 1:
                  value:
                    statusCode: INTERNAL_ERROR
                    message: An unexpected error occurred while processing the policy.
      security:
      - bearerAuth: []
  /v1/policies/update:
    put:
      tags:
      - Policy Management
      summary: Update an existing policy
      description: "Updates an existing policy by its name in the Unified Defense SIEM platform (UDS).  This endpoint uses YAML object containing the details of the policy to be created in the Securonix platform for requests. Attributes that can be updated using this endpoint are:\n- tenantnames\n- version\n- description\n- labels\n- detection\n- saveasthreat\n- incident workflow\n- auto incident enabled\n- additional event analytics\n- aggregated event analytics\n- verbose_info\n- signatureId \n- daily violation threshold \n- add policy violators to watchlist\n\n> **YAML Response Support:**\n> - To receive a YAML response, include the header `Accept: application/yaml` or `Accept: application/x-yaml` in the request.\n> - JSON remains the default when the Accept header is not provided.\n> - If YAML conversion fails, the response falls back to JSON.\n"
      operationId: updatePolicy
      parameters:
      - $ref: '#/components/parameters/ClientIdHeader'
      - $ref: '#/components/parameters/AcceptHeader'
      requestBody:
        description: "YAML object containing the details of the policy to be created in the Securonix platform. \nThe request must include all required fields as defined in the `Policy` schema. \n"
        required: true
        content:
          application/yaml:
            schema:
              $ref: '#/components/schemas/UpdatePolicy'
            examples:
              Example 1:
                value:
                  tenantnames:
                  - tenantB
                  description: Updating policy description
                  labels:
                  - updated.label.name
                  detection:
                    selection_1:
                      baseeventid: 4688
                    selection_2:
                      destinationprocessname: lsaas.exe
                    selection_3:
                      commandline|contains: lsass.exe
                    condition: selection_1 AND ( selection_2 or selection_3 )
                  saveasthreat: true
                  incident_workflow: SOCTeamReview
                  autoIncidentEnabled: true
                  violatorAttribute: sourceusername
                  additional_event_analytics:
                    match_all_checks: true
                    check_against_watchlist:
                    - accountname: Terminated_Contractors
                      flag_violation_not_found_in_watchlist: true
                    check_against_lookup:
                    - lookup:
                        accountname: MultipleFailedEntries
                      condition: lookup
                      additional_criteria:
                        selection_1:
                          VendorId|contains: Vendor
                        condition: NOT selection_1
                    email_to_self:
                    - emailrecipient: 0.8
                    match_string:
                    - ms:
                        first_field: AccountName
                        second_field: UserNameSpace
                        threshold: 0.8
                    check_against_tpi:
                    - tpi: null
                      destinationaddress:
                      - SNXTIS_BASIC_IPV4
                      - SNXTIS_BASIC_IPV6
                      additional_criteria:
                        selection_1:
                        - tpi_src_confidence|gt: 5
                        - tpi_country|contains|attr: country
                        selection_2:
                        - tpi_src: abc
                        condition: selection_1 AND NOT selection_2
                    check_against_activelist:
                    - activelist:
                        rule: ipaddress
                        rule_match_present: true
                        activelist_name: Password_spraying_attempts_From_single_IP
                  analytic_type:
                    aggregated_event_analytics:
                    - name: Authentication Failed
                      aee_filter:
                        selection1:
                          baseeventid: 4625
                        condition: selection1
                      number_of_occurrences:
                        duration: 01:30:00
                        atleast: 1
                        count_matching_criteria:
                          baseeventid: 15
                      similar_value:
                      - accountname
                      consecutive_events: true
                      distinct_value:
                      - ipaddress
                      - eventcountry
                    - name: Authentication Success
                      aee_filter:
                        selection1:
                          baseeventid|equals: 4625
                        condition: selection1
                      number_of_occurrences:
                        duration: 01:30:00
                        atleast: 1
                        count_matching_criteria:
                          baseeventid: 15
                      consecutive_events: false
                      distinct_value:
                      - ipaddress
                      - eventcountry
                      parent_child_relationship:
                        duration: 01:00:00
                        common_values:
                        - accountname
                  verbose_info: '''Account ${accountname!"UNKNOWN"} getting updates from possible suspicious IP Address.'''
                  apisource: AI
      responses:
        '200':
          description: Policy updated successfully. Supports both JSON and YAML response formats via Accept header (application/json or application/x-yaml). If YAML conversion fails, returns JSON.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatePolicyResponse'
              examples:
                Example 1:
                  value:
                    id: 12345
                    name: Suspicious Login Policy
                    description: Detects suspicious login patterns
                    enabled: true
                    createdOn: '2023-01-15T10:30:00Z'
                    lastUpdated: '2023-06-20T14:45:00Z'
                    createdBy: admin
                    updatedBy: security_analyst
                    owner: security_team
                    riskTypeId: 101
                    criticality: HIGH
                    riskThreatId: 201
                    threatName: Account Compromise
                    category: Authentication
                    categoryId: 301
                    policyType: REALTIME
                    functionality: LOGIN_MONITORING
                    functionalityId: 401
                    hql: SELECT * FROM events WHERE...
                    query: user.login_attempts > 5
                    groupBy: user_id
                    havingClause: COUNT(*) > 3
                    joinGroup: user_events
                    initiateWorkFlow: true
                    directHql: false
                    directiveEnabled: true
                    functionEnabled: true
                    directiveConfig: <directiveConfig>...</directiveConfig>
                    functionConfig: <functionConfig>...</functionConfig>
                    configWorkflowName: incident_response_workflow
                    violator: user_id
                    violatorAttribute: sourceusername
                    violation: Multiple failed login attempts
                    violatorCriticalityLevel: HIGH
                    violationDisplayConfig: <display>...</display>
                    verboseInfoTemplate: User {user} attempted {count} logins
                    maxResults: 1000
                    dailyViolationThreshold: 100
                    aggregateScore: 85
                    cappedRiskScore: 9.5
                    constantScore: '7.5'
                    customScore: 8.2
                    secVersion: 2.1
                    uniqueCode: POL_LOGIN_001
                    signatureId: SIG_12345
                    isWatchlist: false
                    sandboxCategory: false
                    notification: true
                    realTimeCheck: true
                    outputDatabase: true
                    savePveAndScore: true
                    saveAsThreat: false
                    actionPrediction: true
                    commitPolicy: true
                    additionalInfo: false
                    valid: true
                    riskBoosterEnabled: false
                    riskBoosterConfig: <riskbooster>...</riskbooster>
                    functionSuspectConfigEnabled: false
                    functionSuspectConfig: <suspect>...</suspect>
                    suspectConfig: <config>...</config>
                    suspectChecksListId: 501
                    resourceGroupId: 601
                    emailTemplateId: 701
                    spConfigSummarizationId: 801
                    resourceType: DATABASE
                    resourceTypeId: DB_001
                    analyticsType: BEHAVIORAL
                    operatorConfig: <operator>...</operator>
                    analyzerConfig: <analyzer>...</analyzer>
                    ownership: security_team
                    pipelineName: security_pipeline
                    feedback: Working as expected
                    releaseNotes: Updated threshold values
                    whatsNew: Added new detection logic
                    origin: PA
                    modifiedOrigin: UI
                    remediator: auto_remediation
                    threatRemediationSteps: 1. Block user 2. Notify admin
                    policyFunctionalityRelations:
                    - id: 1
                      functionalityName: LOGIN_MONITORING
                      tenantid: 4
                      idx: 0
                    policylabels:
                    - label_name: scx.attack.privilege_escalation
                      labelId: 245
                      idx: 1
                    policyWatchlists:
                    - id: 10
                      watchlistId: 9995
                      index: 0
                      watchlistName: Recent_Transfers
                      expiryDaysCount: 30
                      decayFactor: 0
                      decayFlag: false
                      initialConfidenceLevel: 1
                      confidenceIncrementFactor: 0
                      dynamicWatchlist: true
                      fieldList: ''
                      calculateExpiryFromNow: false
                    policyActivelists:
                    - activelistId: 9
                      policyId: 12345
                      index: 0
                      metadata: "<activeListParamsBean>\n    <keyRule>u_employeeid</keyRule>\n    <violationAttributes>deviceaction,ipaddress,destinationaddress,destinationport</violationAttributes>\n</activeListParamsBean>"
                    policyDeprecateInfo:
                    - id: 769
                      deprecated: false
                      index: 0
                      starttime: '2023-04-12'
                      endtime: '2023-04-19'
                      validityindays: '7'
                      deprecatedwithviolation: false
                      signatureid: SIG_12345
                      policyname: Suspicious Login Policy
                    policyPredictionAttributes:
                    - riskTypeId: 2393
                      forestId: 2393
                      riskThreatId: 50149
                      signatureId: '1000024'
                 

# --- truncated at 32 KB (162 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/securonix/refs/heads/main/openapi/securonix-policy-management-api-openapi.yml