{"type":"api","title":"Get Organization Appliance Security Intrusion Rule Groups","meta":{"id":"/apps/pubhub/media/Meraki-Dashboard-API-v1-Documentation/3b15f175eb740bae9830ad63e0277ebbcfc7df39/401c6d5b-0873-3519-be2b-c203501ad95c","info":{"title":"Meraki Dashboard API","description":"A RESTful API to programmatically manage and monitor Cisco Meraki networks at scale.\n\n\u003e Date: 15 July, 2026\n\u003e\n\u003e [Recent Updates](https://meraki.io/whats-new/)\n\n---\n\n[API Documentation](https://meraki.io/api)\n\n[Community Support](https://meraki.io/community)\n\n[Meraki Homepage](https://www.meraki.com)\n","contact":{"name":"Meraki Developer Community","url":"https://meraki.io/community"},"version":"1.72.0-beta.2"},"security":[{"meraki_api_key":[]},{"bearerAuth":[]},{"oauth2":[]}],"tags":[{"name":"organizations"},{"name":"networks"},{"name":"devices"},{"name":"insight"},{"name":"wireless"},{"name":"camera"},{"name":"appliance"},{"name":"switch"},{"name":"cellularGateway"},{"name":"sm"},{"name":"sensor"},{"name":"administered"},{"name":"campusGateway"},{"name":"users"},{"name":"wirelessController"},{"name":"spaces"},{"name":"support"},{"name":"assistant"},{"name":"accelerometer"},{"name":"accessControlLists"},{"name":"accessGroups"},{"name":"accessPolicies"},{"name":"account"},{"name":"accounts"},{"name":"aclHitCount"},{"name":"acls"},{"name":"actionBatches"},{"name":"activities"},{"name":"adaptivePolicy"},{"name":"adaptivePolicyGroups"},{"name":"addressFamilies"},{"name":"addresses"},{"name":"administrators"},{"name":"admins"},{"name":"afc"},{"name":"airMarshal"},{"name":"alertTypes"},{"name":"alerts"},{"name":"allowlist"},{"name":"alternateManagementInterface"},{"name":"analytics"},{"name":"api"},{"name":"apiRequests"},{"name":"apnsCert"},{"name":"apple"},{"name":"appliances"},{"name":"application"},{"name":"applicationCategories"},{"name":"applicationUsage"},{"name":"applications"},{"name":"areas"},{"name":"arpInspection"},{"name":"arpTable"},{"name":"artifacts"},{"name":"assets"},{"name":"assignments"},{"name":"association"},{"name":"attributes"},{"name":"auth"},{"name":"authZones"},{"name":"authentication"},{"name":"authenticationToken"},{"name":"authorities"},{"name":"authorization"},{"name":"authorizations"},{"name":"autoLocate"},{"name":"autoRf"},{"name":"automate"},{"name":"automations"},{"name":"autonomousSystems"},{"name":"availabilities"},{"name":"bands"},{"name":"bandwidthUsageHistory"},{"name":"bgp"},{"name":"billing"},{"name":"blink"},{"name":"bluetooth"},{"name":"bluetoothClients"},{"name":"bonjourForwarding"},{"name":"boots"},{"name":"boundaries"},{"name":"brandingPolicies"},{"name":"buildings"},{"name":"bulk"},{"name":"bulkAdd"},{"name":"bulkCreate"},{"name":"bulkDelete"},{"name":"bulkEdit"},{"name":"bulkEnrollment"},{"name":"bulkRemove"},{"name":"bulkUpdate"},{"name":"bulkUpload"},{"name":"byAdmin"},{"name":"byApplication"},{"name":"byAutonomousSystem"},{"name":"byBand"},{"name":"byBoundary"},{"name":"byClient"},{"name":"byClientOs"},{"name":"byClientType"},{"name":"byCluster"},{"name":"byDevice"},{"name":"byEnergyUsage"},{"name":"byFilterList"},{"name":"byGroup"},{"name":"byInterval"},{"name":"byMetric"},{"name":"byModel"},{"name":"byNetwork"},{"name":"byNewDevice"},{"name":"byOperation"},{"name":"byPeerGroup"},{"name":"byPipeline"},{"name":"byPort"},{"name":"byPrefixList"},{"name":"byProfile"},{"name":"byRouter"},{"name":"byServer"},{"name":"byServerType"},{"name":"bySite"},{"name":"bySourceIp"},{"name":"bySsid"},{"name":"byStack"},{"name":"byStatus"},{"name":"bySwitch"},{"name":"bySwitchProfile"},{"name":"byType"},{"name":"byUsage"},{"name":"byUtilization"},{"name":"byVlan"},{"name":"byVrf"},{"name":"bypassActivationLockAttempts"},{"name":"cableTest"},{"name":"callbacks"},{"name":"capabilities"},{"name":"captures"},{"name":"categories"},{"name":"cellular"},{"name":"cellularFirewallRules"},{"name":"cellularUsageHistory"},{"name":"certificateAuthority"},{"name":"certificates"},{"name":"certs"},{"name":"changeHistory"},{"name":"changelogs"},{"name":"channelAvailability"},{"name":"channelUtilization"},{"name":"channelUtilizationHistory"},{"name":"channels"},{"name":"chat"},{"name":"checkup"},{"name":"claim"},{"name":"claimKey"},{"name":"clientCountHistory"},{"name":"clientExclusion"},{"name":"clients"},{"name":"cloud"},{"name":"cloudEnrollment"},{"name":"clusters"},{"name":"commands"},{"name":"communicationPlans"},{"name":"completions"},{"name":"compliance"},{"name":"compute"},{"name":"configTemplates"},{"name":"configurationChanges"},{"name":"configurations"},{"name":"configure"},{"name":"configuredDevices"},{"name":"connectedCountHistory"},{"name":"connectionStats"},{"name":"connections"},{"name":"connectivity"},{"name":"connectivityEvents"},{"name":"connectivityMonitoringDestinations"},{"name":"connectors"},{"name":"contentFiltering"},{"name":"contents"},{"name":"controller"},{"name":"correlated"},{"name":"coterm"},{"name":"coverage"},{"name":"cpu"},{"name":"crls"},{"name":"current"},{"name":"customAnalytics"},{"name":"customPerformanceClasses"},{"name":"cycle"},{"name":"data"},{"name":"dataRate"},{"name":"dataRateHistory"},{"name":"delegated"},{"name":"deltas"},{"name":"deploy"},{"name":"deployable"},{"name":"deployed"},{"name":"deployments"},{"name":"descriptors"},{"name":"desktopLogs"},{"name":"details"},{"name":"detections"},{"name":"deviceCommandLogs"},{"name":"deviceProfiles"},{"name":"deviceTypeGroupPolicies"},{"name":"dhcp"},{"name":"dhcpLeases"},{"name":"dhcpServerPolicy"},{"name":"dictionaries"},{"name":"disconnect"},{"name":"discovered"},{"name":"discovery"},{"name":"disenrollments"},{"name":"dns"},{"name":"domains"},{"name":"doorLocks"},{"name":"download"},{"name":"downloadUrl"},{"name":"dscpTaggingOptions"},{"name":"dscpToCosMappings"},{"name":"eapOverride"},{"name":"earlyAccess"},{"name":"electronicShelfLabel"},{"name":"eligible"},{"name":"enrollments"},{"name":"entitlements"},{"name":"entries"},{"name":"eox"},{"name":"errors"},{"name":"esims"},{"name":"ethernet"},{"name":"eventTypes"},{"name":"events"},{"name":"exclusions"},{"name":"experience"},{"name":"extensions"},{"name":"failedConnections"},{"name":"failover"},{"name":"failures"},{"name":"featureTiers"},{"name":"features"},{"name":"feedback"},{"name":"fetchTableQuery"},{"name":"fields"},{"name":"filterLists"},{"name":"filters"},{"name":"firewall"},{"name":"firewalledServices"},{"name":"firmware"},{"name":"firmwareUpgrades"},{"name":"floorPlans"},{"name":"gateways"},{"name":"geolocations"},{"name":"global"},{"name":"group"},{"name":"groupPolicies"},{"name":"groups"},{"name":"health"},{"name":"healthByTime"},{"name":"healthScores"},{"name":"historical"},{"name":"history"},{"name":"hosts"},{"name":"hotspot20"},{"name":"httpServers"},{"name":"httpsi"},{"name":"hubs"},{"name":"iam"},{"name":"identities"},{"name":"identity"},{"name":"identityPsks"},{"name":"idps"},{"name":"impacted"},{"name":"impactedDevice"},{"name":"import"},{"name":"inboundCellularFirewallRules"},{"name":"inboundFirewallRules"},{"name":"insights"},{"name":"integrate"},{"name":"integration"},{"name":"integrations"},{"name":"interconnects"},{"name":"interfaces"},{"name":"internetPolicies"},{"name":"intrusion"},{"name":"inventory"},{"name":"ipAssignment"},{"name":"ipsec"},{"name":"ipv6"},{"name":"isolation"},{"name":"jobs"},{"name":"json"},{"name":"keys"},{"name":"l2"},{"name":"l3"},{"name":"l3FirewallRules"},{"name":"l7FirewallRules"},{"name":"lan"},{"name":"lanLink"},{"name":"lanStp"},{"name":"latency"},{"name":"latencyHistory"},{"name":"latencyStats"},{"name":"latest"},{"name":"leds"},{"name":"license"},{"name":"licenses"},{"name":"licensing"},{"name":"lines"},{"name":"linkAggregations"},{"name":"linkLayer"},{"name":"links"},{"name":"listenRanges"},{"name":"live"},{"name":"liveTools"},{"name":"lldpCdp"},{"name":"load"},{"name":"local"},{"name":"localOverrides"},{"name":"location"},{"name":"locationScanning"},{"name":"loginSecurity"},{"name":"logs"},{"name":"lookups"},{"name":"lossAndLatencyHistory"},{"name":"lowPower"},{"name":"macTable"},{"name":"malware"},{"name":"managementInterface"},{"name":"manufacturers"},{"name":"masks"},{"name":"mdns"},{"name":"me"},{"name":"memory"},{"name":"merakiAuth"},{"name":"merakiAuthUsers"},{"name":"meshStatuses"},{"name":"messages"},{"name":"metrics"},{"name":"migrations"},{"name":"mirror"},{"name":"mirrors"},{"name":"mode"},{"name":"models"},{"name":"monitor"},{"name":"monitoredMediaServers"},{"name":"mostImpactedNetworks"},{"name":"mostImpactedXMs"},{"name":"moves"},{"name":"mqtt"},{"name":"mqttBrokers"},{"name":"mtu"},{"name":"multicast"},{"name":"multicastForwarding"},{"name":"multicastRouting"},{"name":"nac"},{"name":"nat"},{"name":"neighbors"},{"name":"netflow"},{"name":"networkAdapters"},{"name":"networkHealth"},{"name":"networkServices"},{"name":"new"},{"name":"nodes"},{"name":"objectDetectionModels"},{"name":"onboarding"},{"name":"onboardingHistory"},{"name":"oneToManyNatRules"},{"name":"oneToOneNatRules"},{"name":"openRoaming"},{"name":"openapiSpec"},{"name":"opportunistic"},{"name":"opportunisticPcap"},{"name":"optIns"},{"name":"optimization"},{"name":"order"},{"name":"orders"},{"name":"ospf"},{"name":"ospfNeighbors"},{"name":"override"},{"name":"overrides"},{"name":"overview"},{"name":"overviews"},{"name":"package"},{"name":"packetCapture"},{"name":"packetCaptures"},{"name":"packetLoss"},{"name":"packets"},{"name":"payloadTemplates"},{"name":"peers"},{"name":"performance"},{"name":"performanceHistory"},{"name":"permissions"},{"name":"pii"},{"name":"piiKeys"},{"name":"ping"},{"name":"pingDevice"},{"name":"pipelines"},{"name":"placement"},{"name":"planning"},{"name":"poe"},{"name":"policies"},{"name":"policy"},{"name":"policyObjects"},{"name":"portForwardingRules"},{"name":"portSchedules"},{"name":"ports"},{"name":"position"},{"name":"positions"},{"name":"power"},{"name":"powerLimits"},{"name":"powerModules"},{"name":"prefixLists"},{"name":"prefixes"},{"name":"priorities"},{"name":"privateApplicationGroups"},{"name":"privateApplications"},{"name":"privateResourceGroups"},{"name":"privateResources"},{"name":"productAnnouncements"},{"name":"productIntegrations"},{"name":"profiles"},{"name":"provisioning"},{"name":"publicApplications"},{"name":"push"},{"name":"qosRules"},{"name":"qualityAndRetention"},{"name":"qualityRetentionProfiles"},{"name":"queryLimits"},{"name":"queues"},{"name":"raGuardPolicy"},{"name":"radio"},{"name":"radius"},{"name":"radsec"},{"name":"ratePlans"},{"name":"readings"},{"name":"reboot"},{"name":"receivers"},{"name":"recent"},{"name":"recommendations"},{"name":"records"},{"name":"redundancy"},{"name":"regions"},{"name":"regulatoryDomain"},{"name":"relationships"},{"name":"remoteAccess"},{"name":"remoteAccessLog"},{"name":"remoteAccessLogsExports"},{"name":"rendezvousPoints"},{"name":"requests"},{"name":"requirements"},{"name":"responseCodes"},{"name":"rest"},{"name":"restrictions"},{"name":"revocationLists"},{"name":"rfHealth"},{"name":"rfProfiles"},{"name":"roaming"},{"name":"roles"},{"name":"rollbacks"},{"name":"routers"},{"name":"routing"},{"name":"routingTable"},{"name":"rrm"},{"name":"rssi"},{"name":"ruleGroups"},{"name":"rules"},{"name":"rulesets"},{"name":"salesRepresentatives"},{"name":"saml"},{"name":"samlRoles"},{"name":"sase"},{"name":"scanning"},{"name":"schedules"},{"name":"scores"},{"name":"sdwan"},{"name":"sdwanmanager"},{"name":"search"},{"name":"secureClient"},{"name":"secureConnect"},{"name":"security"},{"name":"securityCenters"},{"name":"seen"},{"name":"sense"},{"name":"sentry"},{"name":"serverHealth"},{"name":"servers"},{"name":"serviceProviders"},{"name":"sessions"},{"name":"settings"},{"name":"signalQuality"},{"name":"signalQualityHistory"},{"name":"sims"},{"name":"singleLan"},{"name":"siteToSite"},{"name":"siteToSiteVpn"},{"name":"sites"},{"name":"slas"},{"name":"smDevicesForKey"},{"name":"smOwnersForKey"},{"name":"snmp"},{"name":"software"},{"name":"softwares"},{"name":"spanningTree"},{"name":"speedTest"},{"name":"speedTestResults"},{"name":"splash"},{"name":"splashAuthorizationStatus"},{"name":"splashLoginAttempts"},{"name":"split"},{"name":"ssids"},{"name":"stacks"},{"name":"staged"},{"name":"stages"},{"name":"static"},{"name":"staticRoutes"},{"name":"statics"},{"name":"stats"},{"name":"status"},{"name":"statuses"},{"name":"stickyEvents"},{"name":"stormControl"},{"name":"stp"},{"name":"subnetPool"},{"name":"subnets"},{"name":"subscription"},{"name":"subscriptions"},{"name":"successfulConnections"},{"name":"successfulConnects"},{"name":"summaries"},{"name":"summary"},{"name":"summaryPanel"},{"name":"supported"},{"name":"swap"},{"name":"swaps"},{"name":"switchPortStatus"},{"name":"switches"},{"name":"sync"},{"name":"syncJobs"},{"name":"syslog"},{"name":"syslogServers"},{"name":"system"},{"name":"tags"},{"name":"targetGroups"},{"name":"targets"},{"name":"tasks"},{"name":"taxonomy"},{"name":"telemetry"},{"name":"testConnectivity"},{"name":"tests"},{"name":"themes"},{"name":"thirdPartyVPNPeers"},{"name":"thousandEyes"},{"name":"threads"},{"name":"throughputTest"},{"name":"timeToConnect"},{"name":"token"},{"name":"tokens"},{"name":"top"},{"name":"topics"},{"name":"topology"},{"name":"towers"},{"name":"traceRoute"},{"name":"traffic"},{"name":"trafficAnalysis"},{"name":"trafficHistory"},{"name":"trafficShaping"},{"name":"transceivers"},{"name":"traps"},{"name":"trustedAccessConfigs"},{"name":"trustedServers"},{"name":"tunnelCreation"},{"name":"tunneling"},{"name":"types"},{"name":"umbrella"},{"name":"unassigned"},{"name":"update"},{"name":"updates"},{"name":"upgrades"},{"name":"uplink"},{"name":"uplinkBandwidth"},{"name":"uplinkSelection"},{"name":"uplinks"},{"name":"uplinksLossAndLatency"},{"name":"usage"},{"name":"usageHistories"},{"name":"usageHistory"},{"name":"userAccessDevices"},{"name":"utilization"},{"name":"v4"},{"name":"values"},{"name":"versions"},{"name":"video"},{"name":"videoLink"},{"name":"videoWalls"},{"name":"vlanAssignments"},{"name":"vlanProfiles"},{"name":"vlans"},{"name":"vmx"},{"name":"vpn"},{"name":"vpnExclusions"},{"name":"vpnFirewallRules"},{"name":"vpnPeers"},{"name":"vppAccounts"},{"name":"vrfs"},{"name":"vrrp"},{"name":"vrrpTable"},{"name":"wakeOnLan"},{"name":"warmSpare"},{"name":"warnings"},{"name":"webApps"},{"name":"webhookTests"},{"name":"webhooks"},{"name":"wired"},{"name":"wirelessControllers"},{"name":"wirelessProfiles"},{"name":"wlanLists"},{"name":"workflows"},{"name":"xdr"},{"name":"zigbee"},{"name":"zones"}],"x-parser-conf":{"overview":{"markdownPath":"docs/overview-early-access.md"},"theme":"meraki","serverConfig":true,"httpBearer":{"bearerToken":"75dd5334bef4d2bc96f26138c163c0a3fa0b5ca6"},"labelConfig":{"endpoint":{"field":"operationId","format":"startCase"}},"groupBy":{"$remoteModule":"config/group_platform.js"},"filterBy":{"$remoteModule":"config/filter_only_beta.js"},"sortBy":{"$remoteModule":"config/sort_by.js"},"exampleAsDefault":true,"expand":0,"variables":{"organizationId":"1215707","networkId":"N_784752235069315754","serial":"QBSB-VQ3J-XZ54"}},"openapi":"3.0.1","servers":[{"url":"https://api.meraki.com/{basePath}","variables":{"basePath":{"default":"api/v1"}}}],"securitySchemes":{"meraki_api_key":{"type":"apiKey","name":"X-Cisco-Meraki-API-Key","in":"header"},"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"},"oauth2":{"type":"oauth2","description":"This API uses OAuth 2 with the authorization code grant flow. [More info](https://developer.cisco.com/meraki/api-v1/authorization/)","flows":{"authorizationCode":{"authorizationUrl":"https://as.meraki.com/oauth/authorize","tokenUrl":"https://as.meraki.com/oauth/token","scopes":{"camera:config:read":"Cameras (MV)","camera:config:write":"Cameras (MV)","camera:telemetry:read":"Cameras (MV)","camera:telemetry:write":"Cameras (MV)","dashboard:general:config:read":"Entire dashboard, excluding identity and access management","dashboard:general:config:write":"Entire dashboard, excluding identity and access management","dashboard:general:telemetry:read":"Entire dashboard, excluding identity and access management","dashboard:general:telemetry:write":"Entire dashboard, excluding identity and access management","dashboard:iam:config:read":"Dashboard related to identity and access management, including early access features","dashboard:iam:config:write":"Dashboard related to identity and access management, including early access features","dashboard:iam:telemetry:read":"Dashboard related to identity and access management, including early access features","dashboard:iam:telemetry:write":"Dashboard related to identity and access management, including early access features","dashboard:licensing:config:read":"Licensing","dashboard:licensing:config:write":"Licensing","dashboard:licensing:telemetry:read":"Licensing","dashboard:licensing:telemetry:write":"Licensing","iot:gateway:general:config:read":"IoT Gateway Control using NIPC","iot:gateway:general:config:write":"IoT Gateway Control using NIPC","iot:gateway:general:telemetry:read":"IoT Gateway telemetry using NIPC","iot:gateway:general:telemetry:write":"IoT Gateway telemetry using NIPC","iot:gateway:onboarding:config:read":"IoT Gateway Onboarding using SCIM","iot:gateway:onboarding:config:write":"IoT Gateway Onboarding using SCIM","policy:config:read":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","policy:config:write":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","policy:telemetry:read":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","policy:telemetry:write":"Provides granular authorization over all global policy resources including policy objects, adaptive policy, and Organization Group Policy","sdwan:config:read":"Secure SD-WAN (MX including MXIGZ)","sdwan:config:write":"Secure SD-WAN (MX including MXIGZ)","sdwan:telemetry:read":"Secure SD-WAN (MX including MXIGZ)","sdwan:telemetry:write":"Secure SD-WAN (MX including MXIGZ)","sensor:config:read":"Sensors (MT)","sensor:config:write":"Sensors (MT)","sensor:telemetry:read":"Sensors (MT)","sensor:telemetry:write":"Sensors (MT)","sm:config:read":"Endpoint Management (SM)","sm:config:write":"Endpoint Management (SM)","sm:telemetry:read":"Endpoint Management (SM)","sm:telemetry:write":"Endpoint Management (SM)","switch:config:read":"Switches (MS)","switch:config:write":"Switches (MS)","switch:telemetry:read":"Switches (MS)","switch:telemetry:write":"Switches (MS)","wireless:config:read":"Wireless (MR)","wireless:config:write":"Wireless (MR)","wireless:telemetry:read":"Wireless (MR)","wireless:telemetry:write":"Wireless (MR)"}}}}}},"spec":{"description":"List the rule groups that belong to a security policy.","operationId":"getOrganizationApplianceSecurityIntrusionRuleGroups","parameters":[{"name":"organizationId","in":"path","description":"Organization ID","schema":{"type":"string"},"required":true},{"name":"perPage","in":"query","description":"The number of entries per page returned. Acceptable range is 3 - 500. Default is 50.","schema":{"type":"integer"}},{"name":"startingAfter","in":"query","description":"A token used by the server to indicate the start of the page. Often this is a timestamp or an ID but it is not limited to those. This parameter should not be defined by client applications. The link for the first, last, prev, or next page in the HTTP Link header should define it.","schema":{"type":"string"}},{"name":"endingBefore","in":"query","description":"A token used by the server to indicate the end of the page. Often this is a timestamp or an ID but it is not limited to those. This parameter should not be defined by client applications. The link for the first, last, prev, or next page in the HTTP Link header should define it.","schema":{"type":"string"}},{"name":"policyIds","in":"query","description":"Collection of base or intrusion policy identifiers to filter results by","schema":{"type":"array","items":{"type":"string"}}},{"name":"parentRuleGroupIds","in":"query","description":"Filter results to rule groups whose parent matches any of the provided identifiers","schema":{"type":"array","items":{"type":"string"}}},{"name":"search","in":"query","description":"Case-insensitive text filter applied to rule group name and description","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful operation","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"groupId":{"type":"string","description":"Identifier for the rule group"},"parent":{"type":"object","properties":{"id":{"type":"string","description":"Identifier for the parent rule group, if present"},"name":{"type":"string","description":"Display name of the parent rule group, if present"}},"description":"Identifier and metadata for the parent rule group","nullable":true},"name":{"type":"string","description":"Display name of the rule group"},"description":{"type":"string","description":"Details about the rule group"},"policy":{"type":"object","properties":{"id":{"type":"string","description":"Identifier of the policy this rule group belongs to"}},"description":"Policy metadata for this rule group"},"base":{"type":"object","properties":{"security":{"type":"object","properties":{"level":{"type":"integer","description":"The base security level applied to this rule group (1-4)","nullable":true}},"description":"Base security attributes"}},"description":"Base security configuration"},"override":{"type":"object","properties":{"id":{"type":"string","description":"Identifier for the override resource"},"security":{"type":"object","properties":{"level":{"type":"integer","description":"Security level override applied to this rule group","nullable":true}},"description":"Override security attributes"}},"description":"Override applied to this rule group","nullable":true}}},"description":"Rule groups for the requested policy"},"meta":{"type":"object","properties":{"counts":{"type":"object","properties":{"items":{"type":"object","properties":{"total":{"type":"integer","description":"Total number of rule groups available"},"remaining":{"type":"integer","description":"Number of remaining rule groups after pagination"}},"description":"Counts for the rule group collection"}},"description":"Summary counts for the collection"}},"description":"Metadata for the collection"}}},"example":{"items":[{"groupId":"8dfddd5a-3bb0-5f61-8ea4-b0b48d9ab1c2","parent":{"id":"0c6e7e7a-30c6-5d14-80b2-30f0826db098","name":"File Transfer Parent"},"name":"File Transfer","description":"Rules that inspect file transfer protocols","policy":{"id":"3e9a2a8b-0e56-5a4d-9588-5ac3524c39ad"},"base":{"security":{"level":3}},"override":{"id":"override-123","security":{"level":4}}}],"meta":{"counts":{"items":{"total":5,"remaining":0}}}}}},"headers":{"Link":{"schema":{"type":"string"},"description":"A comma-separated list of first, last, prev, and next relative links used for subsequent paginated requests."}}}},"security":[{"oauth2":["sdwan:config:read"]}],"summary":"List the rule groups that belong to a security policy.","tags":["appliance","configure","security","intrusion","ruleGroups"],"x-release-stage":"beta","__originalOperationId":"getOrganizationApplianceSecurityIntrusionRuleGroups","method":"get","path":"/organizations/{organizationId}/appliance/security/intrusion/ruleGroups"}}