Forensic Rule Object
|
Attribute |
Type |
Description |
|---|---|---|
|
id |
string |
unique identifier of the rule |
|
name |
string |
name of the rule |
|
description |
string |
description of the rule |
|
type |
string |
PREDEFINED or USER_DEFINED |
|
eval_group_type |
string |
AS_INDIVIDUAL or AS_GROUP |
|
severity |
string |
one of IMMEDIATE_ACTION, CRITICAL, HIGH, MEDIUM, LOW |
|
actions |
array |
array or ALERT or REPORT strings |
|
created_at |
integer |
Unix timestamp of when the rule was created |
|
updated_at |
integer |
Unix timestamp of when the rule was last updated |