Get Runtime Container Policy

GET 
/api/v33.02/policies/runtime/container

x-prisma-cloud-target-env: {"permission":"policyRuntimeContainer"}

Retrieves the runtime policy for containers protected by Defender. A policy consists of ordered rules.

This endpoint maps to Defend > Runtime > Container policy in the Console UI.

cURL Request

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: application/json' \
  -X GET \
  'https://<CONSOLE>/api/v<VERSION>/policies/runtime/container'

A successful response returns a list of runtime rules in the policy.

Responses

200

ContainerPolicy represents a runtime policy enforced for a given running resource

application/json

Schema

Schema

_id string

Internal identifier.

learningDisabled boolean

Indicates whether automatic behavioural learning is enabled (true) or not (false).

rules object[]
Rules in the policy.
Array [
advancedProtectionEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
cloudMetadataEnforcementEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
collections object[]
List of collections. Used to scope the rule.
Array [
accountIDs string (string)[]
List of account IDs.
appIDs string (string)[]
List of application IDs.
clusters string (string)[]
List of Kubernetes cluster names.
color common.Color (string)
Color is a hexadecimal representation of color code value
containers string (string)[]
List of containers.
description string
Free-form text.
functions string (string)[]
List of functions.
hosts string (string)[]
List of hosts.
images string (string)[]
List of images.
labels string (string)[]
List of labels.
modified date-time
Datetime when the collection was last modified.
name string
Collection name. Must be unique.
namespaces string (string)[]
List of Kubernetes namespaces.
owner string
User who created or last modified the collection.
prisma boolean
Indicates whether this collection originates from Prisma Cloud.
system boolean
Indicates whether this collection was created by the system (i.e., a non user) (true) or a real user (false).
]
customRules object[]
List of custom runtime rules.
Array [
_id integer
Custom rule ID.
action customrules.Action (string)
Possible values: [audit,incident]
Action is the action to perform if the custom rule applies
effect customrules.Effect (string)
Possible values: [block,prevent,alert,allow,ban,disable]
Effect is the effect that will be used for custom rule
]
disabled boolean
Indicates whether the rule is currently disabled. Values: true (disabled) or false (enabled).
dns object
ContainerDNSRule is the DNS runtime rule for container
defaultEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
disabled boolean
Disabled a global disable for the DNS rule.
domainList object
DNSListRule represents an explicitly allowed/denied domains list rule
allowed string (string)[]
Allowed the allow-listed domain names.
denied string (string)[]
Denied the deny-listed domain names.
effect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
filesystem object
ContainerFilesystemRule represents restrictions/suppression for filesystem changes
allowedList string (string)[]
AllowedList is the list of allowed file system path.
backdoorFilesEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
defaultEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
deniedList object
DenyListRule represents a rule containing paths of files and processes to alert/prevent and the required effect
effect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
paths string (string)[]
Paths are the paths to alert/prevent when an event with one of the paths is triggered.
disabled boolean
Disabled a global disable for the filesystem rule.
encryptedBinariesEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
newFilesEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
suspiciousELFHeadersEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
kubernetesEnforcementEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
modified date-time
Specifies the date and time when the rule was last modified.
name string
Name of the rule.
network object
ContainerNetworkRule represents the restrictions/suppression for networking
allowedIPs string (string)[]
AllowedIPs the allow-listed IP addresses.
defaultEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
deniedIPs string (string)[]
DeniedIPs the deny-listed IP addresses.
deniedIPsEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
disabled boolean
Disabled a global disable for the network rule.
listeningPorts object
PortListRule represents a rule containing ports to allowed/denied and the required effect
allowed object[]
Allowed the allow-listed listening ports.
Array [
deny boolean
Deny indicates whether the connection is denied.
end integer
.
start integer
.
]
denied object[]
Denied the deny-listed listening ports.
Array [
deny boolean
Deny indicates whether the connection is denied.
end integer
.
start integer
.
]
effect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
modifiedProcEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
outboundPorts object
PortListRule represents a rule containing ports to allowed/denied and the required effect
allowed object[]
Allowed the allow-listed listening ports.
Array [
deny boolean
Deny indicates whether the connection is denied.
end integer
.
start integer
.
]
denied object[]
Denied the deny-listed listening ports.
Array [
deny boolean
Deny indicates whether the connection is denied.
end integer
.
start integer
.
]
effect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
portScanEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
rawSocketsEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
notes string
Describes any noteworthy points for a rule. You can include any text.
owner string
User who created or last modified the rule.
previousName string
Previous name of the rule. Required for rule renaming.
processes object
ContainerProcessesRule represents restrictions/suppression for running processes
allowedList string (string)[]
AllowedList is the list of processes to allow.
checkParentChild boolean
Indicates whether checking for parent child relationship when comparing spawned processes in the model is enabled.
cryptoMinersEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
defaultEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
deniedList object
DenyListRule represents a rule containing paths of files and processes to alert/prevent and the required effect
effect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
paths string (string)[]
Paths are the paths to alert/prevent when an event with one of the paths is triggered.
disabled boolean
Disabled a global disable for the processes rule.
lateralMovementEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
modifiedProcessEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
reverseShellEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
suidBinariesEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
skipExecSessions boolean
Indicates whether to skip runtime validation for events triggered by docker/kubectl exec.
wildFireAnalysis runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
]

Example (from schema)

{
  "_id": "string",
  "learningDisabled": true,
  "rules": [
    {
      "advancedProtectionEffect": [
        "block",
        "prevent",
        "alert",
        "disable"
      ],
      "cloudMetadataEnforcementEffect": [
        "block",
        "prevent",
        "alert",
        "disable"
      ],
      "collections": [
        {
          "accountIDs": [
            "string"
          ],
          "appIDs": [
            "string"
          ],
          "clusters": [
            "string"
          ],
          "color": "string",
          "containers": [
            "string"
          ],
          "description": "string",
          "functions": [
            "string"
          ],
          "hosts": [
            "string"
          ],
          "images": [
            "string"
          ],
          "labels": [
            "string"
          ],
          "modified": "2024-07-29T15:51:28.071Z",
          "name": "string",
          "namespaces": [
            "string"
          ],
          "owner": "string",
          "prisma": true,
          "system": true
        }
      ],
      "customRules": [
        {
          "_id": 0,
          "action": [
            "audit",
            "incident"
          ],
          "effect": [
            "block",
            "prevent",
            "alert",
            "allow",
            "ban",
            "disable"
          ]
        }
      ],
      "disabled": true,
      "dns": {
        "defaultEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "disabled": true,
        "domainList": {
          "allowed": [
            "string"
          ],
          "denied": [
            "string"
          ],
          "effect": [
            "block",
            "prevent",
            "alert",
            "disable"
          ]
        }
      },
      "filesystem": {
        "allowedList": [
          "string"
        ],
        "backdoorFilesEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "defaultEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "deniedList": {
          "effect": [
            "block",
            "prevent",
            "alert",
            "disable"
          ],
          "paths": [
            "string"
          ]
        },
        "disabled": true,
        "encryptedBinariesEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "newFilesEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "suspiciousELFHeadersEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ]
      },
      "kubernetesEnforcementEffect": [
        "block",
        "prevent",
        "alert",
        "disable"
      ],
      "modified": "2024-07-29T15:51:28.071Z",
      "name": "string",
      "network": {
        "allowedIPs": [
          "string"
        ],
        "defaultEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "deniedIPs": [
          "string"
        ],
        "deniedIPsEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "disabled": true,
        "listeningPorts": {
          "allowed": [
            {
              "deny": true,
              "end": 0,
              "start": 0
            }
          ],
          "denied": [
            {
              "deny": true,
              "end": 0,
              "start": 0
            }
          ],
          "effect": [
            "block",
            "prevent",
            "alert",
            "disable"
          ]
        },
        "modifiedProcEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "outboundPorts": {
          "allowed": [
            {
              "deny": true,
              "end": 0,
              "start": 0
            }
          ],
          "denied": [
            {
              "deny": true,
              "end": 0,
              "start": 0
            }
          ],
          "effect": [
            "block",
            "prevent",
            "alert",
            "disable"
          ]
        },
        "portScanEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "rawSocketsEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ]
      },
      "notes": "string",
      "owner": "string",
      "previousName": "string",
      "processes": {
        "allowedList": [
          "string"
        ],
        "checkParentChild": true,
        "cryptoMinersEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "defaultEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "deniedList": {
          "effect": [
            "block",
            "prevent",
            "alert",
            "disable"
          ],
          "paths": [
            "string"
          ]
        },
        "disabled": true,
        "lateralMovementEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "modifiedProcessEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "reverseShellEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "suidBinariesEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ]
      },
      "skipExecSessions": true,
      "wildFireAnalysis": [
        "block",
        "prevent",
        "alert",
        "disable"
      ]
    }
  ]
}

default

Loading...