Querying the Alert Rule Template List

Function

List alert rule templates

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/templates

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID.
workspace_id	Yes	String	Workspace ID.

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
offset	Yes	Long	Offset.
limit	Yes	Long	Number of items.
sort_key	No	String	Sorting field.
sort_dir	No	String	Sorting order. You can sort fields in ascending or descending order.
severity	No	Array of strings	Severity. The options are Informational, Low, Medium, High, and Critical. TIPS, LOW, MEDIUM, HIGH, FATAL

Request Parameters

**Table 3** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	User token. You can obtain the token by calling the IAM API used to obtain a user token.

Response Parameters

Status code: 200

**Table 4** Response header parameters
Parameter	Type	Description
X-request-id	String	This field is the request ID number for task tracking. Format is request_uuid-timestamp-hostname.

**Table 5** Response body parameters
Parameter	Type	Description
count	Long	Total number.
records	Array of AlertRuleTemplate objects	Alert rule template.

**Table 6** AlertRuleTemplate
Parameter	Type	Description
template_id	String	Alert rule template ID.
update_time	Long	Update time.
template_name	String	Name of the alert rule template.
data_source	String	Data source.
version	String	Version.
query	String	Query statement.
query_type	String	Query syntax: SQL.
severity	String	Severity. The options are Informational, Low, Medium, High, and Critical. (TIPS, LOW, MEDIUM, HIGH, FATAL)
custom_properties	Map<String,String>	Custom extension information.
event_grouping	Boolean	Alert group.
schedule	Schedule object	Schedule rule.
triggers	Array of AlertRuleTrigger objects	Alert triggering rules.

**Table 7** Schedule
Parameter	Type	Description
frequency_interval	Integer	Scheduling interval.
frequency_unit	String	Scheduling interval unit, which can be minute, hour, or day. (MINUTE, HOUR, DAY)
period_interval	Integer	Time window interval.
period_unit	String	Time window unit, which can be minute, hour, or day. (MINUTE, HOUR, DAY.)
delay_interval	Integer	Delay interval.
overtime_interval	Integer	Timeout interval.

**Table 8** AlertRuleTrigger
Parameter	Type	Description
mode	String	Mode and quantity. COUNT.
operator	String	Operator. The value can be: EQ: Equal to NE: Not equal to GT: Greater than LT: Less than
expression	String	expression
severity	String	Severity. The options are Informational, Low, Medium, High, and Critical. (TIPS, LOW, MEDIUM, HIGH, FATAL)
accumulated_times	Integer	accumulated_times

Status code: 400

**Table 9** Response header parameters
Parameter	Type	Description
X-request-id	String	This field is the request ID number for task tracking. Format is request_uuid-timestamp-hostname.

Example Requests

None

Example Responses

Status code: 200

Request succeeded.

{
  "count" : 9223372036854776000,
  "records" : [ {
    "template_id" : "443a0117-1aa4-4595-ad4a-796fad4d4950",
    "update_time" : 1665221214,
    "template_name" : "Alert rule template",
    "data_source" : "sec_hss_vul",
    "version" : "1.0.0",
    "query" : "* | select status, count(*) as count group by status",
    "query_type" : "SQL",
    "severity" : "TIPS",
    "custom_properties" : {
      "references" : "https://localhost/references",
      "maintainer" : "isap"
    },
    "event_grouping" : true,
    "schedule" : {
      "frequency_interval" : 5,
      "frequency_unit" : "MINUTE",
      "period_interval" : 5,
      "period_unit" : "MINUTE",
      "delay_interval" : 2,
      "overtime_interval" : 10
    },
    "triggers" : [ {
      "mode" : "COUNT",
      "operator" : "GT",
      "expression" : 10,
      "severity" : "TIPS"
    } ]
  } ]
}