Update Snort 3 IPS Rules - Security Cloud Control Firewall Manager API Documentation

{"type":"api","title":"Update Snort 3 IPS Rules","meta":{"id":"/apps/pubhub/media/cdo-api-documentation/ee9bdf946673e45c4f256a22e0a754e29a9b2098/54f4ba30-7fe2-3433-bbd5-a4d458aee37e","info":{"title":"Cisco Cloud-delivered Firewall Management Center (cdFMC) API","version":"1.15.0","description":"Use the documentation to explore the endpoints the cdFMC has to offer","contact":{"name":"Cisco Firepower TAC","email":"ngfw-support@cisco.com"}},"tags":[{"name":"Analysis"},{"name":"Audit"},{"name":"Backup"},{"name":"Change Management"},{"name":"Chassis"},{"name":"Deployment"},{"name":"Device Clusters"},{"name":"Device Groups"},{"name":"Device HA Pairs"},{"name":"Devices"},{"name":"Health"},{"name":"Integration"},{"name":"Intelligence"},{"name":"License"},{"name":"Network Map"},{"name":"Object"},{"name":"Policy"},{"name":"Policy Assignments"},{"name":"Search"},{"name":"Status"},{"name":"System Configuration"},{"name":"System Information"},{"name":"Templates"},{"name":"Troubleshoot"},{"name":"Updates"},{"name":"Users"}],"openapi":"3.0.1","servers":[{"url":"https://api.us.security.cisco.com/firewall","description":"US"},{"url":"https://api.eu.security.cisco.com/firewall","description":"EU"},{"url":"https://api.apj.security.cisco.com/firewall","description":"APJ"},{"url":"https://api.au.security.cisco.com/firewall","description":"AUS"},{"url":"https://api.in.security.cisco.com/firewall","description":"IN"},{"url":"https://api.int.security.cisco.com/firewall","description":"Staging"},{"url":"https://scale.manage.security.cisco.com/api/rest","description":"Scale"},{"url":"https://ci.manage.security.cisco.com/api/rest","description":"CI"},{"url":"https://manage.stg.secure.cisco/api/rest","description":"Stgf9"}],"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"}}},"spec":{"deprecated":false,"description":"**Modifies the per-policy behaviour of the specified intrusion rule ID for the target intrusion policy ID. _Check the response section for applicable examples (if any)._**","operationId":"updateSnort3IPSRules","parameters":[{"description":"Identifier of a Snort 3 intrusion rule.","in":"path","name":"objectId","required":true,"schema":{"type":"string"}},{"description":"UUID of the ticket for tracking the configuration changes.","in":"header","name":"ticket-id","required":false,"schema":{"type":"string"}},{"description":"The container id under which this specific resource is contained.","in":"path","name":"containerUUID","required":true,"schema":{"type":"string"}},{"name":"domainUUID","description":"Domain UUID","in":"path","required":true,"schema":{"type":"string"},"$$ref":"#/components/parameters/domainUUID"}],"requestBody":{"content":{"application/json":{"examples":{"Example 1 : PUT /fmc_config/v1/domain/domainUUID/policy/intrusionpolicies/policyUUID/intrusionrules/Snort3IPSRules-UUID ( Success: Test PUT method for Snort3IPSRules )":{"value":{"description":"\"APP-DETECT 12P DNS request attempt\"","gid":1,"id":"Snort3IPSRules-UUID-1","isSystemDefined":"false | true","msg":"\"APP-DETECT 12P DNS request attempt\"","name":" ","revision":2,"ruleAction":[{"defaultState":"BLOCK","overrideState":"ALERT","policy":{"id":"ccbf50d8-b908-5a56-b1a8-099773b904f2","inlineDrop":0,"name":"Maximum Detection","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"BLOCK","policy":{"id":"6c5fd197-7d58-51cc-b048-40f5a7442f4b","inlineDrop":0,"name":"Balanced Security and Connectivity","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"ALERT","policy":{"id":"e90b3402-1dde-58b8-956e-0ba3e73b9c0a","inlineDrop":0,"name":"Connectivity Over Security","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"DISABLE","policy":{"id":"402cd584-98f0-544e-b628-0c4b40903189","inlineDrop":0,"name":"No Rules Active","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"BLOCK","policy":{"id":"eb508df4-58a2-59c3-a610-500d9a9e4423","inlineDrop":0,"name":"Security Over Connectivity","type":"IntrusionPolicy"}}],"ruleData":"alert udp $HOME_NET any -\u003e any 53 ( msg:\"APP-DETECT 12P DNS request attempt\"; flow:to_server; byte_test:1,!&,0xF8,2; content:\"|03|b32|03|i2p|00|\",fast_pattern,nocase; metadata:policy max-detect-ips drop; service:dns; reference:url,geti2p.net; classtype:misc-activity; sid:37062; rev:2; )","sid":37062}},"Example 2 : PUT /fmc_config/v1/domain/domainUUID/policy/intrusionpolicies/policyUUID/intrusionrules?bulk=true ( Success: Test Bulk PUT method for Snort3IPSRules )":{"value":[{"description":"\"APP-DETECT 12P DNS request attempt\"","gid":1,"id":"Snort3IPSRules-UUID-1","isSystemDefined":"false | true","msg":"\"APP-DETECT 12P DNS request attempt\"","name":" ","revision":2,"ruleAction":[{"defaultState":"BLOCK","overrideState":"ALERT","policy":{"id":"ccbf50d8-b908-5a56-b1a8-099773b904f2","inlineDrop":0,"name":"Maximum Detection","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"BLOCK","policy":{"id":"6c5fd197-7d58-51cc-b048-40f5a7442f4b","inlineDrop":0,"name":"Balanced Security and Connectivity","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"ALERT","policy":{"id":"e90b3402-1dde-58b8-956e-0ba3e73b9c0a","inlineDrop":0,"name":"Connectivity Over Security","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"DISABLE","policy":{"id":"402cd584-98f0-544e-b628-0c4b40903189","inlineDrop":0,"name":"No Rules Active","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"BLOCK","policy":{"id":"eb508df4-58a2-59c3-a610-500d9a9e4423","inlineDrop":0,"name":"Security Over Connectivity","type":"IntrusionPolicy"}}],"ruleData":"alert udp $HOME_NET any -\u003e any 53 ( msg:\"APP-DETECT 12P DNS request attempt\"; flow:to_server; byte_test:1,!&,0xF8,2; content:\"|03|b32|03|i2p|00|\",fast_pattern,nocase; metadata:policy max-detect-ips drop; service:dns; reference:url,geti2p.net; classtype:misc-activity; sid:37062; rev:2; )","sid":37062},{"description":"\"APP-DETECT 12P DNS request attempt\"","gid":1,"id":"Snort3IPSRules-UUID-2","isSystemDefined":"false | true","msg":"\"APP-DETECT 360.cn SafeGuard local HTTP management console access attempt\"","name":" ","revision":3,"ruleAction":[{"defaultState":"BLOCK","overrideState":"ALERT","policy":{"id":"ccbf50d8-b908-5a56-b1a8-099773b904f2","inlineDrop":0,"name":"Maximum Detection","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"BLOCK","policy":{"id":"6c5fd197-7d58-51cc-b048-40f5a7442f4b","inlineDrop":0,"name":"Balanced Security and Connectivity","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"ALERT","policy":{"id":"e90b3402-1dde-58b8-956e-0ba3e73b9c0a","inlineDrop":0,"name":"Connectivity Over Security","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"DISABLE","policy":{"id":"402cd584-98f0-544e-b628-0c4b40903189","inlineDrop":0,"name":"No Rules Active","type":"IntrusionPolicy"}},{"defaultState":"DISABLE","overrideState":"BLOCK","policy":{"id":"eb508df4-58a2-59c3-a610-500d9a9e4423","inlineDrop":0,"name":"Security Over Connectivity","type":"IntrusionPolicy"}}],"ruleData":"alert tcp $EXTERNAL_NET any -\u003e $HOME_NET $HTTP_PORTS ( msg:\"APP-DETECT 360.cn SafeGuard local HTTP management console access attempt\"; flow:to_server,established; http_uri; content:\"/login.php?refer=%2F\",fast_pattern,nocase; metadata:policy max-detect-ips drop; service:http; reference:url,en.wikipedia.org/wiki/360_Safeguard; reference:url,research.zscaler.com/2011/05/is-360cn-evil.html; reference:url,www.alexa.com/siteinfo/360safe.com; reference:url,www.virustotal.com/en/domain/360safe.com/information/; classtype:trojan-activity; sid:28071; rev:3; )","sid":28071}]}},"schema":{"type":"object","description":"Object representing the per-policy behaviour of a specified intrusion rule for a target intrusion policy.","properties":{"commentHistoryList":{"description":"This is a read-only list of all comments added to this resource.","items":{"type":"object","properties":{"comment":{"type":"string"},"date":{"format":"int32","type":"integer"},"user":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IConsoleUser"}},"$$ref":"#/components/schemas/ICommentHistory"},"type":"array"},"defaultState":{"description":"Default State of the rule. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"description":{"description":"User provided resource description.","type":"string"},"gid":{"description":"Generator Identifier used to identify the part of Snort which generates an event.","format":"int32","type":"integer"},"id":{"description":"Unique identifier (UUID) for the intrusion rule.","type":"string"},"isSystemDefined":{"description":"Read-only field indicating if the rule is system-defined (i.e., Talos provided). If value is false, then rule is user-defined.","type":"boolean"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"description":"Object representing metadata attributes for the intrusion rule.","type":"object","properties":{"defaultSetBy":{"items":{"type":"object","description":"Object representing on how default action is set in a policy.","properties":{"action":{"description":"Based on how default action is set in a policy for a rule.","type":"string"},"id":{"description":"The unique UUID of the object.","type":"string"},"name":{"description":"Name of the action.","type":"string"},"type":{"description":"Type of the object.","type":"string"}},"$$ref":"#/components/schemas/ISnort3DefaultSetBy"},"type":"array"},"domain":{"type":"object","description":"The details about the domain.","properties":{"id":{"description":"Unique UUID of this domain","type":"string"},"links":{"description":"Links to the domain resource URLs.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"Name of the domain.","type":"string"},"type":{"description":"Domain type definition (fixed).","type":"string"},"uuid":{"type":"string"}},"$$ref":"#/components/schemas/Domain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","description":"This object defines details about the user.","properties":{"id":{"description":"The unique UUID of the user","type":"string"},"links":{"description":"Contains the self referencing links to this resource","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"Name of the user.","type":"string"},"type":{"description":"The user type (fixed).","type":"string"}},"$$ref":"#/components/schemas/MetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","description":"Defines the read only conditions if the referenced resource is read only.","properties":{"reason":{"description":"Reason the resource is read only - SYSTEM (if it is system defined), RBAC (if user RBAC permissions make it read only) or DOMAIN (if resource is read only in current domain).","enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"description":"True if this resource us read only and false otherwise.","type":"boolean"}},"$$ref":"#/components/schemas/ReadOnly"},"replaceRule":{"type":"boolean"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/Snort3IPSRuleMetadata"},"msg":{"description":"User provided rule description.","type":"string"},"name":{"description":"Name of the intrusion rule.","type":"string"},"newComments":{"description":"Object representing the new comments provided in this resource.","items":{"type":"string"},"type":"array"},"overrideState":{"description":"User override state of the rule. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"recommendedState":{"enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"revision":{"format":"int32","type":"integer"},"ruleAction":{"description":"This field is disabled.","items":{"type":"object","description":"Object representing the rule action specified for an intrusion policy.","properties":{"default":{"description":"Default state of the rule for the specified intrusion policy. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT | PASS | REJECT | REACT | REWRITE","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"override":{"description":"Override state of the rule for the specified intrusion policy. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT | PASS | REJECT | REACT | REWRITE","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"policy":{"description":"Object representing the intrusion policy.","type":"object","properties":{"basePolicy":{"description":"Representing policy details which is used as base for current policy. This field is not present for preprovisioned intrusioned policies.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"id":{"description":"Intrusion Policy UUID","type":"string"},"inlineDrop":{"description":"Indicates the inspection mode \u003c0 or 1\u003e","format":"int32","type":"integer"},"inspectionMode":{"description":"Only applicable for SNORT3. Possible values could be DETECTION or PREVENTION","enum":["PREVENTION","DETECTION"],"type":"string"},"isSystemDefined":{"type":"boolean"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"Name of the intrusion policy","type":"string"},"ruleRecommendation":{"type":"object","properties":{"acceptDisabledRules":{"type":"boolean"},"lastUpdatedTime":{"format":"int32","type":"integer"},"networks":{"items":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"}},"$$ref":"#/components/schemas/Snort3IPSReferenceObject"},"type":"array"},"recommendationInUse":{"type":"boolean"},"securityLevel":{"enum":["LEVEL_1","LEVEL_2","LEVEL_3","LEVEL_4"],"type":"string"}},"$$ref":"#/components/schemas/IRuleRecommendation"},"snortEngine":{"description":"Possible values could be SNORT2 or SNORT3","enum":["SNORT2","SNORT3"],"type":"string"},"sseProxyData":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"$$ref":"#/components/schemas/SseProxyData"},"type":{"description":"Type must be intrusionpolicy","type":"string"}},"$$ref":"#/components/schemas/IIntrusionPolicyModel"},"recommended":{"enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"}},"$$ref":"#/components/schemas/IRuleAction"},"type":"array"},"ruleData":{"description":"Details of the rule based on which rule created or updated.","type":"string"},"ruleGroups":{"description":"Object containing a list of rules groups associated with the rule.","items":{"type":"object","description":"Contains reference information.","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"type":"array"},"sid":{"description":"Snort Identifier used to uniquely identify Snort rules.","format":"int32","type":"integer"},"suppression":{"description":"List of rule suppressions. Object containing configuration which allows users to suppress events for a rule for specific trusted IP addresses. Will be returned when rules are fetched globally and without any specific policy.","type":"object","properties":{"description":{"type":"string"},"destinationNetworks":{"description":"Object representing destination networks selected for the intrusion rule suppression setting.","items":{"type":"object","properties":{"description":{"type":"string"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"overridable":{"type":"boolean"},"overrides":{"type":"object","description":"Defines the override details for this object.","properties":{"parent":{"description":"Link to the parent/global resource which is overriden.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"target":{"description":"The device or the domain target on which this override is enabled.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"}},"$$ref":"#/components/schemas/IOverride"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/INetworkAddress"},"type":"array"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"sourceNetworks":{"description":"Object representing source networks selected for the intrusion rule suppression setting.","items":{"type":"object","properties":{"description":{"type":"string"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"overridable":{"type":"boolean"},"overrides":{"type":"object","description":"Defines the override details for this object.","properties":{"parent":{"description":"Link to the parent/global resource which is overriden.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"target":{"description":"The device or the domain target on which this override is enabled.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"}},"$$ref":"#/components/schemas/IOverride"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/INetworkAddress"},"type":"array"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/IIntrusionRuleSuppression"},"threshold":{"description":"This field is disabled.","type":"object","properties":{"count":{"description":"Number of seconds to match before generating an event.","format":"int32","type":"integer"},"description":{"type":"string"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"seconds":{"description":"Time in seconds for which the rule is matched before generating an event.","format":"int32","type":"integer"},"thresholdType":{"description":"Rate which must be exceeded by a source or destination host before a rule can generate an event. One of: LIMIT | THRESHOLD | BOTH","enum":["LIMIT","THRESHOLD","BOTH"],"type":"string"},"trackBy":{"description":"Value describing the attribute by which configuration generates the event. One of: SOURCE | DESTINATION","enum":["SOURCE","DESTINATION"],"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/IIntrusionRuleThreshold"},"type":{"description":"Type of the response object. This value is always IntrusionRule.","type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/Snort3IPSRules"}}},"description":"Input representation of Snort 3 intrusion rule.","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","description":"Object representing the per-policy behaviour of a specified intrusion rule for a target intrusion policy.","properties":{"commentHistoryList":{"description":"This is a read-only list of all comments added to this resource.","items":{"type":"object","properties":{"comment":{"type":"string"},"date":{"format":"int32","type":"integer"},"user":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IConsoleUser"}},"$$ref":"#/components/schemas/ICommentHistory"},"type":"array"},"defaultState":{"description":"Default State of the rule. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"description":{"description":"User provided resource description.","type":"string"},"gid":{"description":"Generator Identifier used to identify the part of Snort which generates an event.","format":"int32","type":"integer"},"id":{"description":"Unique identifier (UUID) for the intrusion rule.","type":"string"},"isSystemDefined":{"description":"Read-only field indicating if the rule is system-defined (i.e., Talos provided). If value is false, then rule is user-defined.","type":"boolean"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"description":"Object representing metadata attributes for the intrusion rule.","type":"object","properties":{"defaultSetBy":{"items":{"type":"object","description":"Object representing on how default action is set in a policy.","properties":{"action":{"description":"Based on how default action is set in a policy for a rule.","type":"string"},"id":{"description":"The unique UUID of the object.","type":"string"},"name":{"description":"Name of the action.","type":"string"},"type":{"description":"Type of the object.","type":"string"}},"$$ref":"#/components/schemas/ISnort3DefaultSetBy"},"type":"array"},"domain":{"type":"object","description":"The details about the domain.","properties":{"id":{"description":"Unique UUID of this domain","type":"string"},"links":{"description":"Links to the domain resource URLs.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"Name of the domain.","type":"string"},"type":{"description":"Domain type definition (fixed).","type":"string"},"uuid":{"type":"string"}},"$$ref":"#/components/schemas/Domain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","description":"This object defines details about the user.","properties":{"id":{"description":"The unique UUID of the user","type":"string"},"links":{"description":"Contains the self referencing links to this resource","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"Name of the user.","type":"string"},"type":{"description":"The user type (fixed).","type":"string"}},"$$ref":"#/components/schemas/MetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","description":"Defines the read only conditions if the referenced resource is read only.","properties":{"reason":{"description":"Reason the resource is read only - SYSTEM (if it is system defined), RBAC (if user RBAC permissions make it read only) or DOMAIN (if resource is read only in current domain).","enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"description":"True if this resource us read only and false otherwise.","type":"boolean"}},"$$ref":"#/components/schemas/ReadOnly"},"replaceRule":{"type":"boolean"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/Snort3IPSRuleMetadata"},"msg":{"description":"User provided rule description.","type":"string"},"name":{"description":"Name of the intrusion rule.","type":"string"},"newComments":{"description":"Object representing the new comments provided in this resource.","items":{"type":"string"},"type":"array"},"overrideState":{"description":"User override state of the rule. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"recommendedState":{"enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"revision":{"format":"int32","type":"integer"},"ruleAction":{"description":"This field is disabled.","items":{"type":"object","description":"Object representing the rule action specified for an intrusion policy.","properties":{"default":{"description":"Default state of the rule for the specified intrusion policy. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT | PASS | REJECT | REACT | REWRITE","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"override":{"description":"Override state of the rule for the specified intrusion policy. One of: DROP | BLOCK | ALERT | DISABLE | DEFAULT | PASS | REJECT | REACT | REWRITE","enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"},"policy":{"description":"Object representing the intrusion policy.","type":"object","properties":{"basePolicy":{"description":"Representing policy details which is used as base for current policy. This field is not present for preprovisioned intrusioned policies.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"id":{"description":"Intrusion Policy UUID","type":"string"},"inlineDrop":{"description":"Indicates the inspection mode \u003c0 or 1\u003e","format":"int32","type":"integer"},"inspectionMode":{"description":"Only applicable for SNORT3. Possible values could be DETECTION or PREVENTION","enum":["PREVENTION","DETECTION"],"type":"string"},"isSystemDefined":{"type":"boolean"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"Name of the intrusion policy","type":"string"},"ruleRecommendation":{"type":"object","properties":{"acceptDisabledRules":{"type":"boolean"},"lastUpdatedTime":{"format":"int32","type":"integer"},"networks":{"items":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"}},"$$ref":"#/components/schemas/Snort3IPSReferenceObject"},"type":"array"},"recommendationInUse":{"type":"boolean"},"securityLevel":{"enum":["LEVEL_1","LEVEL_2","LEVEL_3","LEVEL_4"],"type":"string"}},"$$ref":"#/components/schemas/IRuleRecommendation"},"snortEngine":{"description":"Possible values could be SNORT2 or SNORT3","enum":["SNORT2","SNORT3"],"type":"string"},"sseProxyData":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"$$ref":"#/components/schemas/SseProxyData"},"type":{"description":"Type must be intrusionpolicy","type":"string"}},"$$ref":"#/components/schemas/IIntrusionPolicyModel"},"recommended":{"enum":["DROP","BLOCK","ALERT","DISABLE","DEFAULT","PASS","REJECT","REACT","REWRITE"],"type":"string"}},"$$ref":"#/components/schemas/IRuleAction"},"type":"array"},"ruleData":{"description":"Details of the rule based on which rule created or updated.","type":"string"},"ruleGroups":{"description":"Object containing a list of rules groups associated with the rule.","items":{"type":"object","description":"Contains reference information.","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"type":"array"},"sid":{"description":"Snort Identifier used to uniquely identify Snort rules.","format":"int32","type":"integer"},"suppression":{"description":"List of rule suppressions. Object containing configuration which allows users to suppress events for a rule for specific trusted IP addresses. Will be returned when rules are fetched globally and without any specific policy.","type":"object","properties":{"description":{"type":"string"},"destinationNetworks":{"description":"Object representing destination networks selected for the intrusion rule suppression setting.","items":{"type":"object","properties":{"description":{"type":"string"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"overridable":{"type":"boolean"},"overrides":{"type":"object","description":"Defines the override details for this object.","properties":{"parent":{"description":"Link to the parent/global resource which is overriden.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"target":{"description":"The device or the domain target on which this override is enabled.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"}},"$$ref":"#/components/schemas/IOverride"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/INetworkAddress"},"type":"array"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"sourceNetworks":{"description":"Object representing source networks selected for the intrusion rule suppression setting.","items":{"type":"object","properties":{"description":{"type":"string"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"overridable":{"type":"boolean"},"overrides":{"type":"object","description":"Defines the override details for this object.","properties":{"parent":{"description":"Link to the parent/global resource which is overriden.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"},"target":{"description":"The device or the domain target on which this override is enabled.","type":"object","properties":{"id":{"description":"Unique identifier representing resource.","type":"string"},"links":{"description":"Object containing links to this resource.","type":"object","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"description":"User chosen resource name.","type":"string"},"type":{"description":"Response object associated with resource.","type":"string"}},"$$ref":"#/components/schemas/IReference"}},"$$ref":"#/components/schemas/IOverride"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/INetworkAddress"},"type":"array"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/IIntrusionRuleSuppression"},"threshold":{"description":"This field is disabled.","type":"object","properties":{"count":{"description":"Number of seconds to match before generating an event.","format":"int32","type":"integer"},"description":{"type":"string"},"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"metadata":{"type":"object","properties":{"domain":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IDomain"},"isLocked":{"type":"boolean"},"lastUser":{"type":"object","properties":{"id":{"type":"string"},"links":{"type":"object","description":"This defines the self referencing links for the given resource.","properties":{"parent":{"description":"Full resource URL path to reference the parent (if any) for this resource.","type":"string"},"self":{"description":"Full resource URL path to reference this particular resource.","type":"string"}},"$$ref":"#/components/schemas/ILinks"},"name":{"type":"string"},"type":{"type":"string"}},"$$ref":"#/components/schemas/IMetadataUser"},"matches":{"items":{"type":"string"},"type":"array"},"readOnly":{"type":"object","properties":{"reason":{"enum":["RBAC","SYSTEM","DOMAIN"],"type":"string"},"state":{"type":"boolean"}},"$$ref":"#/components/schemas/IReadonly"},"timestamp":{"format":"int32","type":"integer"}},"$$ref":"#/components/schemas/IMetadata"},"name":{"type":"string"},"seconds":{"description":"Time in seconds for which the rule is matched before generating an event.","format":"int32","type":"integer"},"thresholdType":{"description":"Rate which must be exceeded by a source or destination host before a rule can generate an event. One of: LIMIT | THRESHOLD | BOTH","enum":["LIMIT","THRESHOLD","BOTH"],"type":"string"},"trackBy":{"description":"Value describing the attribute by which configuration generates the event. One of: SOURCE | DESTINATION","enum":["SOURCE","DESTINATION"],"type":"string"},"type":{"type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/IIntrusionRuleThreshold"},"type":{"description":"Type of the response object. This value is always IntrusionRule.","type":"string"},"version":{"type":"string"}},"$$ref":"#/components/schemas/Snort3IPSRules"}}},"description":"OK"},"default":{"content":{"application/json":{"schema":{"type":"object","properties":{"category":{"description":"Describes the category of the error thrown.","enum":["FRAMEWORK","OTHER","VALIDATION"],"type":"string"},"messages":{"description":"List of error messages which the response has.","items":{"type":"object","properties":{"bulkPayloadIndex":{"description":"More details about the error.","type":"string"},"code":{"description":"More details about the error.","type":"string"},"description":{"description":"More details about the error.","type":"string"},"details":{"description":"More details about the error.","type":"string"},"errorCode":{"description":"More details about the error.","type":"string"},"location":{"description":"More details about the error.","type":"string"},"severity":{"description":"Specifies the Highest level severity among all the error messages.","enum":["ERROR","WARN"],"type":"string"}},"$$ref":"#/components/schemas/ErrorMessagesContainer"},"type":"array"},"severity":{"description":"Specifies the Highest level severity among all the error messages.","enum":["ERROR","WARN"],"type":"string"}},"$$ref":"#/components/schemas/ErrorResponse"}}},"description":"Error"}},"tags":["Policy"],"__originalOperationId":"updateSnort3IPSRules","method":"put","path":"/v1/cdfmc/api/fmc_config/v1/domain/{domainUUID}/policy/intrusionpolicies/{containerUUID}/intrusionrules/{objectId}"}}