upsertFileRule

The upsertFileRule operation handles configuration related to FileRule model. 

Description

This API call is not allowed on the standby unit in an HA pair.

Data Parameters

Parameter Required Type Description
version False string A unique string version assigned by the system when the object is created or modified. No assumption can be made on the format or content of this identifier. The identifier must be provided whenever attempting to modify/delete an existing object. As the version will change every time the object is modified, the value provided in this identifier must match exactly what is present in the system or the request will be rejected.
name True string Name of the File Policy Rule. It must match pattern (^[a-zA-Z0-9_]$)|(^[a-zA-Z0-9_][ a-zA-Z0-9_.+-]*[a-zA-Z0-9_.+-]$). (Note: Additional constraints might exist)
rulePosition False integer Transient field holding the index position for the rule
description False string description of the rule
Field level constraints: length must be between 0 and 128 (inclusive). (Note: Additional constraints might exist)
fileTypeCategories False [object] A list of fileTypeCategory objects.The system can detect various types of files. These file types are grouped into basic categories, including multimedia (swf, mp3), executables (exe, torrent), and PDFs. You can configure file rules that detect individual file types, or on entire categories of file types.
To get list of all file types category use 'GET /object/filetypecategories' API
Allowed types are: [FileTypeCategory]
fileTypes False [object] A list of fileType objects. The system can detect various types of files. You can configure file rules that detect individual file types and generate events for particular files.
To get list of all file types use 'GET /object/filetypes' API
Allowed types are: [FileType]
applicationProtocols True string The system can detect and inspect files transmitted via FTP, HTTP, SMTP, IMAP, POP3, and NetBIOS-ssn (SMB). Any, the default, detects files in HTTP, SMTP, IMAP, POP3, FTP, and NetBIOS-ssn (SMB) traffic. To improve performance, you can restrict file detection to only one of those application protocols on a per-file rule basis
Field level constraints: cannot be null. (Note: Additional constraints might exist)
malwareAnalysisOptions False [object] An list of enum values that specifies the methods to use for file inspection and analysis, which determines whether a file contains malware. You can specify the following methods: SPERO, LOCAL_MALWARE_ANALYSIS
storeFiles False [object] List of options from ALL,CLEAN,MALWARE,CUSTOM,UNKNOWN, based on malware analysis options
directionOfTransfer True string An enum value that specifies the direction of file transfer for the files that should match this rule. Possible values are DOWNLOAD, UPLOAD and ANY. You can inspect incoming FTP, HTTP, IMAP, POP3, and NetBIOS-ssn (SMB) traffic for downloaded files, and outgoing FTP, HTTP, SMTP and NetBIOS-ssn (SMB) traffic for uploaded files.
Field level constraints: cannot be null. (Note: Additional constraints might exist)
ruleAction True string An enum value that defines the action to apply to files that match this rule. Possible values are: DETECT_FILES, BLOCK_FILES, MALWARE_CLOUD_LOOKUP, MALWARE_BLOCK.
Detect Files rules allow you to log the detection of specific file types to the database, while still allowing their transmission.
Block Files rules allow you to block specific file types. You can configure options to reset the connection when a file transfer is blocked, and store captured files to the managed device.
Malware Cloud Lookup rules allow you to obtain and log the disposition of files traversing your network, while still allowing their transmission.
Block Malware rules allow you to calculate the SHA-256 hash value of specific file types, query the AMP cloud to determine if files traversing your network contain malware, then block files that represent threats.

File Rule Actions: Evaluation Order: If more than one rule can apply to a particular situation, the evaluation order will be (1) Block Files, (2) Block Malware, (3)Malware Cloud Lookup, (4)Detect Files
Field level constraints: cannot be null. (Note: Additional constraints might exist)
reset False boolean A Boolean value, TRUE or FALSE (the default). Cisco recommends that you enable Reset Connection for the Block Files and Block Malware actions to prevent blocked application sessions from remaining open until the TCP connection resets. If you do not reset connections, the client session will remain open until the TCP connection resets itself
isSystemDefined False boolean A Boolean value, TRUE or FALSE (the default). The TRUE value indicates that the system created the object. FALSE indicates that the object is user-defined
id False string A unique string identifier assigned by the system when the object is created. No assumption can be made on the format or content of this identifier. The identifier must be provided whenever attempting to modify/delete (or reference) an existing object.
Field level constraints: must match pattern ^((?!;).)*$. (Note: Additional constraints might exist)
type True string A UTF8 string, all letters lower-case, that represents the class-type. This corresponds to the class name.

Path Parameters

Parameter Required Type Description
parentId True string

Query Parameters

Parameter Required Type Description
at False integer An integer representing where to add the new object in the ordered list. Use 0 to add it at the beginning of the list. If not specified, it will be added at the end of the list
filter False string The criteria used to filter the models you are requesting. It should have the following format: {key}{operator}{value}[;{key}{operator}{value}]. Supported operators are: "!"(not equals), ":"(equals), "~"(similar). Supported keys are: "name", "fts". The "fts" filter cannot be used with other filters. Default filtering for Upsert operation is done by name.

Example

- name: Execute 'upsertFileRule' operation
  ftd_configuration:
    operation: "upsertFileRule"
    data:
        version: "{{ version }}"
        name: "{{ name }}"
        rulePosition: "{{ rule_position }}"
        description: "{{ description }}"
        fileTypeCategories: "{{ file_type_categories }}"
        fileTypes: "{{ file_types }}"
        applicationProtocols: "{{ application_protocols }}"
        malwareAnalysisOptions: "{{ malware_analysis_options }}"
        storeFiles: "{{ store_files }}"
        directionOfTransfer: "{{ direction_of_transfer }}"
        ruleAction: "{{ rule_action }}"
        reset: "{{ reset }}"
        isSystemDefined: "{{ is_system_defined }}"
        id: "{{ id }}"
        type: "{{ type }}"
    path_params:
        parentId: "{{ parent_id }}"
    query_params:
        at: "{{ at }}"
        filter: "{{ filter }}"