Description

The deleteIntrusionRuleGroup operation handles configuration related to IntrusionRuleGroup model. 
This API call is not allowed on the standby unit in an HA pair.

This API is only supported for Snort 3. This will allow the user to delete a custom intrusion rule group

HTTP request

DELETE /api/fdm/v6/object/intrusionrulegroups/{objId}

Path Parameters

Parameter Required Type Description
objId True string

Query Parameters

Parameter Required Type Description
disableInAllPolicies False boolean A Boolean value, TRUE or FALSE. This parameter is optional and the default value is False. A TRUE value indicates that the rule group will be disabled for all intrusion policies automatically before the deletion.
cascadeDelete False boolean A Boolean value, TRUE or FALSE. This parameter is optional and the default value is False. A TRUE value indicates that a cascade deletion will be performed when deleting the rule group. This means rules that no longer are contained within a rule group, due to the removal of this rule group, will also be deleted.

Example

curl -X DELETE \
    --header "Accept: application/json" \
    --header "Authorization: Bearer ${ACCESS_TOKEN}" \
    "https://${HOST}:${PORT}/api/fdm/v6/object/intrusionrulegroups/{objId}"
from bravado.requests_client import RequestsClient
from bravado.client import SwaggerClient


def get_client(host, token):
    http_client = RequestsClient()
    http_client.ssl_verify = False
    http_client.set_api_key(
        host,
        "Bearer {}".format(token),
        param_name="Authorization",
        param_in="header"
    )
    return SwaggerClient.from_url(
        "https://{}/apispec/ngfw.json".format(host),
        http_client=http_client,
        config={
            "validate_responses": False,
            "validate_swagger_spec": False
        }
    )


def delete_intrusion_rule_group(client, obj_id):
    return client.IntrusionPolicy.deleteIntrusionRuleGroup(
        objId=obj_id
    ).response().result


if __name__ == "__main__":
    host = "ftd.example.com"
    token = "access_token"
    client = get_client(host, token)

    obj_id = "string"

    delete_intrusion_rule_group(client, obj_id)