Cortex.Api.DisablePrevention

Cortex disable-prevention rules — exceptions that disable a specific prevention module from running on selected processes / files / hashes.

Three endpoints:

fetchRules — list configured disable-prevention rules.
fetchInjectionRules — same shape, for the injection-prevention sibling resource.
getModules — list disable-able modules for a given platform.

type alias Response =

{ data : List Rule

, filterCount : Maybe Int

, totalCount : Maybe Int

}

Paginated envelope for both fetchRules and fetchInjectionRules.

type alias Rule =

{ ruleId : Maybe String

, ruleName : Maybe String

, description : Maybe String

, platform : Maybe String

, conditions : Maybe Value

, moduleIds : List Int

, profileIds : List Int

, scope : Maybe String

, status : Maybe String

, createdBy : Maybe String

, userEmail : Maybe String

, modificationTime : Maybe Int

, associatedTargets : List String

}

A single disable-prevention (or disable-injection-prevention) rule.

type alias Module =

{ moduleId : Maybe Int

, name : Maybe String

, description : Maybe String

, profileType : Maybe String

, conditionsDefinition : Maybe Value

}

One disable-able module type returned by getModules.

POST /public_api/v1/disable_prevention/fetch

POST /public_api/v1/disable_injection_prevention_rules/fetch

getModules : String -> Request (List Module)

POST /public_api/v1/disable_prevention/get_modules

platform must be windows, linux, or macos (lowercase).

vanhecke/celmex/3.0.0