Skip to main content

Get Runtime App-embedded Policy

GET 
/api/v32.07/policies/runtime/app-embedded
x-prisma-cloud-target-env: {"permission":"policyRuntimeServerless"}

Retrieves the runtime policy for apps protected by App-Embedded Defenders. A policy consists of ordered rules.

This endpoint maps to Defend > Runtime > App-Embedded policy in the Console UI.

cURL Request​

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: application/json' \
  -X GET \
  'https://<CONSOLE>/api/v<VERSION>/policies/runtime/app-embedded'

A successful response returns a list of runtime rules in the policy.

Responses​

AppEmbeddedPolicy represents a runtime policy enforced for a given running resource

Schema
    _id string

    Internal identifier.

    rules object[]

    Rules in the policy.

  • Array [
    • advancedProtection boolean

    Indicates whether advanced protection (e.g., custom or premium feeds for container, added whitelist rules for serverless) is enabled (true) or not (false).

    collections object[]

    List of collections. Used to scope the rule.

  • Array [
    • accountIDs string (string)[]

    List of account IDs.

    appIDs string (string)[]

    List of application IDs.

    clusters string (string)[]

    List of Kubernetes cluster names.

    color common.Color (string)

    Color is a hexadecimal representation of color code value

    containers string (string)[]

    List of containers.

    description string

    Free-form text.

    functions string (string)[]

    List of functions.

    hosts string (string)[]

    List of hosts.

    images string (string)[]

    List of images.

    labels string (string)[]

    List of labels.

    modified date-time

    Datetime when the collection was last modified.

    name string

    Collection name. Must be unique.

    namespaces string (string)[]

    List of Kubernetes namespaces.

    owner string

    User who created or last modified the collection.

    prisma boolean

    Indicates whether this collection originates from Prisma Cloud.

    system boolean

    Indicates whether this collection was created by the system (i.e., a non user) (true) or a real user (false).

  • ]
    • customRules object[]

    List of custom runtime rules.

  • Array [
    • _id integer

    Custom rule ID.

    action customrules.Action (string)

    Possible values: [audit,incident]

    Action is the action to perform if the custom rule applies

    effect customrules.Effect (string)

    Possible values: [block,prevent,alert,allow,ban,disable]

    Effect is the effect that will be used for custom rule

  • ]
    • disabled boolean

    Indicates whether the rule is currently disabled. Values: true (disabled) or false (enabled).

    dns object

    DNSRule is the DNS runtime rule

    blacklist string (string)[]

    List of deny-listed domain names (e.g., www.bad-url.com, *.bad-url.com).

    effect runtime.RuleEffect (string)

    Possible values: [block,prevent,alert,disable]

    RuleEffect is the effect that will be used in the runtime rule

    whitelist string (string)[]

    List of allow-listed domain names (e.g., *.gmail.com, .s3..amazon.com).

    filesystem object

    FilesystemRule represents restrictions/suppression for filesystem changes

    backdoorFiles boolean

    Monitors files that can create and/or persist backdoors (currently SSH and admin account config files) (true).

    blacklist string (string)[]

    List of denied file system path.

    checkNewFiles boolean

    Detects changes to binaries and certificates (true).

    effect runtime.RuleEffect (string)

    Possible values: [block,prevent,alert,disable]

    RuleEffect is the effect that will be used in the runtime rule

    skipEncryptedBinaries boolean

    Indicates that encrypted binaries check should be skipped.

    suspiciousELFHeaders boolean

    Indicates whether malware detection based on suspicious ELF headers is enabled.

    whitelist string (string)[]

    List of allowed file system path.

    modified date-time

    Specifies the date and time when the rule was last modified.

    name string

    Name of the rule.

    network object

    NetworkRule represents the restrictions/suppression for networking

    blacklistIPs string (string)[]

    Deny-listed IP addresses.

    blacklistListeningPorts object[]

    Deny-listed listening ports.

  • Array [
    • deny boolean

    Deny indicates whether the connection is denied.

    end integer

    .

    start integer

    .

  • ]
    • blacklistOutboundPorts object[]

    Deny-listed outbound ports.

  • Array [
    • deny boolean

    Deny indicates whether the connection is denied.

    end integer

    .

    start integer

    .

  • ]
    • effect runtime.RuleEffect (string)

    Possible values: [block,prevent,alert,disable]

    RuleEffect is the effect that will be used in the runtime rule

    whitelistIPs string (string)[]

    Allow-listed IP addresses.

    whitelistListeningPorts object[]

    Allow-listed listening ports.

  • Array [
    • deny boolean

    Deny indicates whether the connection is denied.

    end integer

    .

    start integer

    .

  • ]
    • whitelistOutboundPorts object[]

    Allow-listed outbound ports.

  • Array [
    • deny boolean

    Deny indicates whether the connection is denied.

    end integer

    .

    start integer

    .

  • ]
    • notes string

    Describes any noteworthy points for a rule. You can include any text.

    owner string

    User who created or last modified the rule.

    previousName string

    Previous name of the rule. Required for rule renaming.

    processes object

    ProcessesRule represents restrictions/suppression for running processes

    blacklist string (string)[]

    List of processes to deny.

    blockAllBinaries boolean

    Indicates that all processes are blocked except the main process.

    checkCryptoMiners boolean

    Detect crypto miners.

    checkLateralMovement boolean

    Indicates whether dectection of processes that can be used for lateral movement exploits is enabled.

    checkNewBinaries boolean

    Indicates whether binaries which do not belong to the original image are allowed to run.

    effect runtime.RuleEffect (string)

    Possible values: [block,prevent,alert,disable]

    RuleEffect is the effect that will be used in the runtime rule

    skipModified boolean

    Indicates whether to trigger audits/incidents when a modified proc is spawned.

    whitelist string (string)[]

    List of processes to allow.

    wildFireAnalysis runtime.RuleEffect (string)

    Possible values: [block,prevent,alert,disable]

    RuleEffect is the effect that will be used in the runtime rule

  • ]
Loading...