Get Runtime Host Policy

GET 
/api/v33.01/policies/runtime/host

x-prisma-cloud-target-env: {"permission":"policyRuntimeHosts"}

Retrieves the runtime policy for hosts protected by Defender. A policy consists of ordered rules.

This endpoint maps to Defend > Runtime > Host policy in the Console UI.

cURL Request

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: application/json' \
  -X GET \
  'https://<CONSOLE>/api/v<VERSION>/policies/runtime/host'

A successful response returns a list of runtime rules in the policy.

Responses

200

HostPolicy represents a host runtime policy enforced for a given running resource

application/json

Schema

Schema

_id string

ID is the host runtime policy internal id.

owner string

Owner is the host runtime policy owner.

rules object[]
Rules is the list of host runtime rules.
Array [
antiMalware object
AntiMalwareRule represents restrictions/suppression for suspected anti-malware
allowedProcesses string (string)[]
AllowedProcesses contains paths of files and processes for which we skip anti-malware checks.
cryptoMiner runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
customFeed runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
deniedProcesses object
DenyListRule represents a rule containing paths of files and processes to alert/prevent and the required effect
effect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
paths string (string)[]
Paths are the paths to alert/prevent when an event with one of the paths is triggered.
detectCompilerGeneratedBinary boolean
DetectCompilerGeneratedBinary represents what happens when a compiler service writes a binary.
encryptedBinaries runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
executionFlowHijack runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
intelligenceFeed runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
reverseShell runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
serviceUnknownOriginBinary runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
skipSSHTracking boolean
SkipSSHTracking indicates whether host SSH tracking should be skipped.
suspiciousELFHeaders runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
tempFSProc runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
userUnknownOriginBinary runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
webShell runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
wildFireAnalysis runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
collections object[]
Collections is a list of collections the rule applies to.
Array [
accountIDs string (string)[]
List of account IDs.
appIDs string (string)[]
List of application IDs.
clusters string (string)[]
List of Kubernetes cluster names.
color common.Color (string)
Color is a hexadecimal representation of color code value
containers string (string)[]
List of containers.
description string
Free-form text.
functions string (string)[]
List of functions.
hosts string (string)[]
List of hosts.
images string (string)[]
List of images.
labels string (string)[]
List of labels.
modified date-time
Datetime when the collection was last modified.
name string
Collection name. Must be unique.
namespaces string (string)[]
List of Kubernetes namespaces.
owner string
User who created or last modified the collection.
prisma boolean
Indicates whether this collection originates from Prisma Cloud.
system boolean
Indicates whether this collection was created by the system (i.e., a non user) (true) or a real user (false).
]
customRules object[]
CustomRules is a list of custom rules associated with the container runtime policy.
Array [
_id integer
Custom rule ID.
action customrules.Action (string)
Possible values: [audit,incident]
Action is the action to perform if the custom rule applies
effect customrules.Effect (string)
Possible values: [block,prevent,alert,allow,ban,disable]
Effect is the effect that will be used for custom rule
]
disabled boolean
Indicates whether the rule is currently disabled. Values: true (disabled) or false (enabled).
dns object
HostDNSRule represents a host DNS runtime rule
allow string (string)[]
Allow is a list of user-defined domains to skip checks for.
deny string (string)[]
Deny is a list of user-defined domains to deny.
denyListEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
intelligenceFeed runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
fileIntegrityRules object[]
FileIntegrityRules are the file integrity monitoring rules.
Array [
dir boolean
Dir indicates that the path is a directory.
exclusions string (string)[]
Exclusions are filenames that should be ignored while generating audits These filenames may contain a wildcard regex pattern, e.g. foo*.log, *.cache.
metadata boolean
Metadata indicates that metadata changes should be monitored (e.g. chmod, chown).
path string
Path is the path to monitor.
procWhitelist string (string)[]
ProcWhitelist are the processes to ignore Filesystem events caused by these processes DO NOT generate file integrity events.
read boolean
Read indicates that reads operations should be monitored.
recursive boolean
Recursive indicates that monitoring should be recursive.
write boolean
Write indicates that write operations should be monitored.
]
forensic object
HostForensicSettings indicates how to perform host forensic
activitiesDisabled boolean
ActivitiesDisabled indicates if the host activity collection is enabled/disabled.
dockerEnabled boolean
DockerEnabled indicates whether docker commands are collected.
readonlyDockerEnabled boolean
ReadonlyDockerEnabled indicates whether docker readonly commands are collected.
serviceActivitiesEnabled boolean
ServiceActivitiesEnabled indicates whether activities from services are collected.
sshdEnabled boolean
SshdEnabled indicates whether ssh commands are collected.
sudoEnabled boolean
SudoEnabled indicates whether sudo commands are collected.
logInspectionRules object[]
LogInspectionRules is a list of log inspection rules.
Array [
path string
Path is the log path.
regex string (string)[]
Regex are the regular expressions associated with the rule if it is a custom one.
]
modified date-time
Specifies the date and time when the rule was last modified.
name string
Name of the rule.
network object
HostNetworkRule represents the restrictions/suppression for host networking
allowedOutboundIPs string (string)[]
AllowedOutboundIPs is a list of IPs to skip checks for.
customFeed runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
deniedListeningPorts object[]
DeniedListeningPorts is a list of listening ports to deny.
Array [
deny boolean
Deny indicates whether the connection is denied.
end integer
.
start integer
.
]
deniedOutboundIPs string (string)[]
DeniedOutboundIPs is a list of outbound IPs to deny.
deniedOutboundPorts object[]
DeniedOutboundPorts is a list of outbound ports to deny.
Array [
deny boolean
Deny indicates whether the connection is denied.
end integer
.
start integer
.
]
denyListEffect runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
intelligenceFeed runtime.RuleEffect (string)
Possible values: [block,prevent,alert,disable]
RuleEffect is the effect that will be used in the runtime rule
notes string
Describes any noteworthy points for a rule. You can include any text.
owner string
User who created or last modified the rule.
previousName string
Previous name of the rule. Required for rule renaming.
]

Example (from schema)

{
  "_id": "string",
  "owner": "string",
  "rules": [
    {
      "antiMalware": {
        "allowedProcesses": [
          "string"
        ],
        "cryptoMiner": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "customFeed": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "deniedProcesses": {
          "effect": [
            "block",
            "prevent",
            "alert",
            "disable"
          ],
          "paths": [
            "string"
          ]
        },
        "detectCompilerGeneratedBinary": true,
        "encryptedBinaries": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "executionFlowHijack": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "intelligenceFeed": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "reverseShell": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "serviceUnknownOriginBinary": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "skipSSHTracking": true,
        "suspiciousELFHeaders": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "tempFSProc": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "userUnknownOriginBinary": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "webShell": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "wildFireAnalysis": [
          "block",
          "prevent",
          "alert",
          "disable"
        ]
      },
      "collections": [
        {
          "accountIDs": [
            "string"
          ],
          "appIDs": [
            "string"
          ],
          "clusters": [
            "string"
          ],
          "color": "string",
          "containers": [
            "string"
          ],
          "description": "string",
          "functions": [
            "string"
          ],
          "hosts": [
            "string"
          ],
          "images": [
            "string"
          ],
          "labels": [
            "string"
          ],
          "modified": "2024-07-29T15:51:28.071Z",
          "name": "string",
          "namespaces": [
            "string"
          ],
          "owner": "string",
          "prisma": true,
          "system": true
        }
      ],
      "customRules": [
        {
          "_id": 0,
          "action": [
            "audit",
            "incident"
          ],
          "effect": [
            "block",
            "prevent",
            "alert",
            "allow",
            "ban",
            "disable"
          ]
        }
      ],
      "disabled": true,
      "dns": {
        "allow": [
          "string"
        ],
        "deny": [
          "string"
        ],
        "denyListEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "intelligenceFeed": [
          "block",
          "prevent",
          "alert",
          "disable"
        ]
      },
      "fileIntegrityRules": [
        {
          "dir": true,
          "exclusions": [
            "string"
          ],
          "metadata": true,
          "path": "string",
          "procWhitelist": [
            "string"
          ],
          "read": true,
          "recursive": true,
          "write": true
        }
      ],
      "forensic": {
        "activitiesDisabled": true,
        "dockerEnabled": true,
        "readonlyDockerEnabled": true,
        "serviceActivitiesEnabled": true,
        "sshdEnabled": true,
        "sudoEnabled": true
      },
      "logInspectionRules": [
        {
          "path": "string",
          "regex": [
            "string"
          ]
        }
      ],
      "modified": "2024-07-29T15:51:28.071Z",
      "name": "string",
      "network": {
        "allowedOutboundIPs": [
          "string"
        ],
        "customFeed": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "deniedListeningPorts": [
          {
            "deny": true,
            "end": 0,
            "start": 0
          }
        ],
        "deniedOutboundIPs": [
          "string"
        ],
        "deniedOutboundPorts": [
          {
            "deny": true,
            "end": 0,
            "start": 0
          }
        ],
        "denyListEffect": [
          "block",
          "prevent",
          "alert",
          "disable"
        ],
        "intelligenceFeed": [
          "block",
          "prevent",
          "alert",
          "disable"
        ]
      },
      "notes": "string",
      "owner": "string",
      "previousName": "string"
    }
  ]
}

default

Loading...