Alert Forwarding Rules¶
Overview¶
You can use this API to configure Alert Forwarding Rules and their properties in BIG-IQ.
REST Endpoint: /mgmt/cm/websafe/working-config/forwarding-alert-rules¶
Requests¶
GET /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>¶
Request Parameters¶
None
Query Parameters¶
None
Response¶
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
id | string (UUID) | A unique identifier given by the system. |
alertCategory | array_of_numbers | An array of numbers, where each number maps to an alert category. Specify the categories of events that need to be forwarded. |
alertStatus | array_of_strings | An array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | A number (0-100). Alerts with a severity equal to or greater than the specified value will be forwarded. |
notificationTarget | array_of_strings | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, or custom. |
forwardingFields | array_of_strings | An array of the fields that should get forwarded. The list of fields includes: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, and Device ID. |
ruleStatus | string | The status of the rule. The possible values are enabled/disabled. |
userNameRequired | boolean | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | Enable or disable forwarding to the Security Operations Center SOC. |
allAccounts | boolean | Determines whether alerts of all accounts will get forwarded, or only specific accounts. |
accountReferences | reference | Used to select the accounts whose alerts will get forwarded. |
name | string | Name of the resource. |
link | string | URI link of the reference. |
webserviceReference | reference | A reference to the webservice object that alerts will get forwarded to. |
name | string | Name of the resource. |
link | string | URI link of the reference. |
emailRecipients | array_of_strings | The email addresses of the recipients of email when email forwarding is enabled. |
emailBodyTemplate | string | A template used to format the body of the email being forwarded. |
emailEnabled | string | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | The name that will appear as sender for the email being forwarded. |
emailSenderAddress | string | The email address of the email sender. |
emailSubject | string | The subject of the email. |
smsTemplate | string | This field is unused and can be empty. |
syslogTemplate | string | The content of the forwarded message. |
syslogServer | string | The address of the syslog server. |
syslogPort | string | The port of the syslog server. |
syslogProtocol | string | The Syslog protocol. |
syslogSeverity | string | The Syslog severity. |
syslogFacility | string | The Syslog facility. |
syslogEnabled | string | Determines whether forwarding to syslog is enabled. The possible values are enabled/disabled. |
customWSEnabled | string | Determines whether forwarding to a custom web service is enabled. The possible values are enabled/disabled. |
wsUsesToken | string | Determines whether an authentication token is used to authenticate the web service. |
wsTokenTimeout | number | Sets the age of a token used to authenticate a custom web service. |
wsTokenUrl | string | The URL used to obtain the token. |
wsTokenMethod | string | The HTTP method used for the request to obtain the token. |
wsTokenHeaders | array_of_strings | The headers used in the request to obtain the token. |
wsTokenRequest | string | The query string used when requesting the token. |
wsTokenResponse | string | A pattern used to extract the token out of the response. |
wsAlertUrl | string | The custom webservice URL endpoint. |
wsAlertMethod | string | The method used to send the alerts, can either be GET or POST. |
wsAlertHeaders | array_of_strings | An array of strings, where each represents a header name and value separated by ‘:’. |
wsAlertRequest | string | The body of the alert. |
useCustomForwardingProxy | boolean | Determines whether a custom proxy should be used. |
customForwardingProxyname | string | Name of the proxy object used to connect to the target. |
useJsonParsing | boolean | Determines whether json parsing is used when keywords are replaced. |
alertCategory¶
The alertCategory field contains an array of numbers. Each number in the array represents an alert category, as described in the following table.
Value | Meaning |
---|---|
1 | phishing |
2 | advanced phishing |
3 | user defined phishing |
4 | generic malware |
5 | targeted malware |
6 | external scripts |
7 | page modification |
8 | browser automation |
10 | transaction modification |
11 | user defined auto transactions |
12 | remote access tools |
13 | stolen credentials |
14 | user inspection |
15 | mobile malware |
16 | mobile man-in-the-middle |
17 | mobile security |
18 | user defined mobile |
19 | transaction errors |
20 | missing components |
21 | encryption errors |
22 | mobile errors |
23 | infected users |
26 | client logs |
Permissions¶
Role | Allow |
---|---|
Application_Editor | Yes |
WebSafe_Manager_Deployer | Yes |
ASM_Manager | Yes |
WebSafe_Manager | Yes |
Service_Catalog_Editor | Yes |
WebSafe_Manager_View | Yes |
Service_Catalog_Viewer | Yes |
WebSafe_Manager_Edit | Yes |
Security_Manager | Yes |
POST /mgmt/cm/websafe/working-config/forwarding-alert-rules¶
Request Parameters¶
Name | Type | Required | Description |
---|---|---|---|
name | string | True | The name of the alert forwarding rule. |
alertCategory | array_of_numbers | False | An array of numbers, where each number maps to an alert category. Specify the categories of events that need to be forwarded. |
alertStatus | array_of_strings | False | An array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | False | A number (0-100). Alerts with a severity equal to or greater than the specified value will be forwarded. |
notificationTarget | array_of_strings | False | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, or custom. |
forwardingFields | array_of_strings | False | An array of the fields that should get forwarded. The list of fields includes: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, and Device ID. |
ruleStatus | string | False | The status of the rule. The possible values are enabled/disabled. |
userNameRequired | boolean | False | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | False | Enable or disable forwarding to the Security Operations Center SOC. |
allAccounts | boolean | False | Determines whether alerts of all accounts will get forwarded, or only specific accounts. |
accountReferences | reference | False | Used to select the accounts whose alerts will get forwarded. |
name | string | False | Name of the resource. |
link | string | False | URI link of the reference. |
webserviceReference | reference | False | A reference to the webservice object that alerts will get forwarded to. |
name | string | False | Name of the resource. |
link | string | False | URI link of the reference. |
emailRecipients | array_of_strings | False | The email addresses of the recipients of email when email forwarding is enabled. |
emailBodyTemplate | string | False | A template used to format the body of the email being forwarded. |
emailEnabled | string | False | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | False | The name that will appear as sender for the email being forwarded. |
emailSenderAddress | string | False | The email address of the email sender. |
emailSubject | string | False | The subject of the email. |
smsTemplate | string | False | This field is unused and can be empty. |
syslogTemplate | string | False | The content of the forwarded message. |
syslogServer | string | False | The address of the syslog server. |
syslogPort | string | False | The port of the syslog server. |
syslogProtocol | string | False | The Syslog protocol. |
syslogSeverity | string | False | The Syslog severity. |
syslogFacility | string | False | The Syslog facility. |
syslogEnabled | string | False | Determines whether forwarding to syslog is enabled. The possible values are enabled/disabled. |
customWSEnabled | string | False | Determines whether forwarding to a custom web service is enabled. The possible values are enabled/disabled. |
wsUsesToken | string | False | Determines whether an authentication token is used to authenticate the web service. |
wsTokenTimeout | number | False | Sets the age of a token used to authenticate a custom web service. |
wsTokenUrl | string | False | The URL used to obtain the token. |
wsTokenMethod | string | False | The HTTP method used for the request to obtain the token. |
wsTokenHeaders | array_of_strings | False | The headers used in the request to obtain the token. |
wsTokenRequest | string | False | The query string used when requesting the token. |
wsTokenResponse | string | False | A pattern used to extract the token out of the response. |
wsAlertUrl | string | False | The custom webservice URL endpoint. |
wsAlertMethod | string | False | The method used to send the alerts, can either be GET or POST. |
wsAlertHeaders | array_of_strings | False | An array of strings, where each represents a header name and value separated by ‘:’. |
wsAlertRequest | string | False | The body of the alert. |
useCustomForwardingProxy | boolean | False | Determines whether a custom proxy should be used. |
customForwardingProxyname | string | False | Name of the proxy object used to connect to the target. |
useJsonParsing | boolean | False | Determines whether json parsing is used when keywords are replaced. |
Query Parameters¶
None
Response¶
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
id | string (UUID) | A unique identifier given by the system. |
alertCategory | array_of_numbers | An array of numbers, where each number maps to an alert category. Specify the categories of events that need to be forwarded. |
alertStatus | array_of_strings | An array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | A number (0-100). Alerts with a severity equal to or greater than the specified value will be forwarded. |
notificationTarget | array_of_strings | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, or custom. |
forwardingFields | array_of_strings | An array of the fields that should get forwarded. The list of fields includes: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, and Device ID. |
ruleStatus | string | The status of the rule. The possible values are enabled/disabled. |
userNameRequired | boolean | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | Enable or disable forwarding to the Security Operations Center SOC. |
allAccounts | boolean | Determines whether alerts of all accounts will get forwarded, or only specific accounts. |
accountReferences | reference | Used to select the accounts whose alerts will get forwarded. |
name | string | Name of the resource. |
link | string | URI link of the reference. |
webserviceReference | reference | A reference to the webservice object that alerts will get forwarded to. |
name | string | Name of the resource. |
link | string | URI link of the reference. |
emailRecipients | array_of_strings | The email addresses of the recipients of email when email forwarding is enabled. |
emailBodyTemplate | string | A template used to format the body of the email being forwarded. |
emailEnabled | string | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | The name that will appear as sender for the email being forwarded. |
emailSenderAddress | string | The email address of the email sender. |
emailSubject | string | The subject of the email. |
smsTemplate | string | This field is unused and can be empty. |
syslogTemplate | string | The content of the forwarded message. |
syslogServer | string | The address of the syslog server. |
syslogPort | string | The port of the syslog server. |
syslogProtocol | string | The Syslog protocol. |
syslogSeverity | string | The Syslog severity. |
syslogFacility | string | The Syslog facility. |
syslogEnabled | string | Determines whether forwarding to syslog is enabled. The possible values are enabled/disabled. |
customWSEnabled | string | Determines whether forwarding to a custom web service is enabled. The possible values are enabled/disabled. |
wsUsesToken | string | Determines whether an authentication token is used to authenticate the web service. |
wsTokenTimeout | number | Sets the age of a token used to authenticate a custom web service. |
wsTokenUrl | string | The URL used to obtain the token. |
wsTokenMethod | string | The HTTP method used for the request to obtain the token. |
wsTokenHeaders | array_of_strings | The headers used in the request to obtain the token. |
wsTokenRequest | string | The query string used when requesting the token. |
wsTokenResponse | string | A pattern used to extract the token out of the response. |
wsAlertUrl | string | The custom webservice URL endpoint. |
wsAlertMethod | string | The method used to send the alerts, can either be GET or POST. |
wsAlertHeaders | array_of_strings | An array of strings, where each represents a header name and value separated by ‘:’. |
wsAlertRequest | string | The body of the alert. |
useCustomForwardingProxy | boolean | Determines whether a custom proxy should be used. |
customForwardingProxyname | string | Name of the proxy object used to connect to the target. |
useJsonParsing | boolean | Determines whether json parsing is used when keywords are replaced. |
Permissions¶
Role | Allow |
---|---|
Application_Editor | No |
WebSafe_Manager_Deployer | No |
ASM_Manager | No |
WebSafe_Manager | Yes |
Service_Catalog_Editor | No |
WebSafe_Manager_View | No |
Service_Catalog_Viewer | No |
WebSafe_Manager_Edit | Yes |
Security_Manager | Yes |
PUT /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>¶
Request Parameters¶
Name | Type | Required | Description |
---|---|---|---|
alertCategory | array_of_numbers | False | An array of numbers, where each number maps to an alert category. Specify the categories of events that need to be forwarded. |
alertStatus | array_of_strings | False | An array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | False | A number (0-100). Alerts with a severity equal to or greater than the specified value will be forwarded. |
notificationTarget | array_of_strings | False | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, or custom. |
forwardingFields | array_of_strings | False | An array of the fields that should get forwarded. The list of fields includes: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, and Device ID. |
ruleStatus | string | False | The status of the rule. The possible values are enabled/disabled. |
userNameRequired | boolean | False | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | False | Enable or disable forwarding to the Security Operations Center SOC. |
allAccounts | boolean | False | Determines whether alerts of all accounts will get forwarded, or only specific accounts. |
accountReferences | reference | False | Used to select the accounts whose alerts will get forwarded. |
name | string | False | Name of the resource. |
link | string | False | URI link of the reference. |
webserviceReference | reference | False | A reference to the webservice object that alerts will get forwarded to. |
name | string | False | Name of the resource. |
link | string | False | URI link of the reference. |
emailRecipients | array_of_strings | False | The email addresses of the recipients of email when email forwarding is enabled. |
emailBodyTemplate | string | False | A template used to format the body of the email being forwarded. |
emailEnabled | string | False | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | False | The name that will appear as sender for the email being forwarded. |
emailSenderAddress | string | False | The email address of the email sender. |
emailSubject | string | False | The subject of the email. |
smsTemplate | string | False | This field is unused and can be empty. |
syslogTemplate | string | False | The content of the forwarded message. |
syslogServer | string | False | The address of the syslog server. |
syslogPort | string | False | The port of the syslog server. |
syslogProtocol | string | False | The Syslog protocol. |
syslogSeverity | string | False | The Syslog severity. |
syslogFacility | string | False | The Syslog facility. |
syslogEnabled | string | False | Determines whether forwarding to syslog is enabled. The possible values are enabled/disabled. |
customWSEnabled | string | False | Determines whether forwarding to a custom web service is enabled. The possible values are enabled/disabled. |
wsUsesToken | string | False | Determines whether an authentication token is used to authenticate the web service. |
wsTokenTimeout | number | False | Sets the age of a token used to authenticate a custom web service. |
wsTokenUrl | string | False | The URL used to obtain the token. |
wsTokenMethod | string | False | The HTTP method used for the request to obtain the token. |
wsTokenHeaders | array_of_strings | False | The headers used in the request to obtain the token. |
wsTokenRequest | string | False | The query string used when requesting the token. |
wsTokenResponse | string | False | A pattern used to extract the token out of the response. |
wsAlertUrl | string | False | The custom webservice URL endpoint. |
wsAlertMethod | string | False | The method used to send the alerts, can either be GET or POST. |
wsAlertHeaders | array_of_strings | False | An array of strings, where each represents a header name and value separated by ‘:’. |
wsAlertRequest | string | False | The body of the alert. |
useCustomForwardingProxy | boolean | False | Determines whether a custom proxy should be used. |
customForwardingProxyname | string | False | Name of the proxy object used to connect to the target. |
useJsonParsing | boolean | False | Determines whether json parsing is used when keywords are replaced. |
Query Parameters¶
None
Response¶
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
alertCategory | array_of_numbers | Array of numbers, each maps to an alert category. Specify the categories of events that needs to be forwarded. |
alertStatus | array_of_strings | Array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | A number (0-100). Alerts with severity equal or greater than the value will be forwarded. |
notificationTarget | array_of_strings | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, custom. |
forwardingFields | array_of_strings | An array of the fields that should get forwarded. The list of fields include: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, Device ID. |
ruleStatus | string | The status of the rule, can either be enabled or disabled. |
userNameRequired | boolean | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | Enable or disable forwarding to the SOC |
allAccounts | boolean | Determines whether alerts of all accounts will get forwarded, or only specific accounts |
accountReferences | reference | Used to select the accounts whose alerts will get forwarded |
name | string | Name of the resource |
link | string | URI link of the reference |
webserviceReference | reference | A reference to the webservice object that alerts will get forwarded to |
name | string | Name of the resource |
link | string | URI link of the reference |
emailRecipients | array_of_strings | Recipients of email when email forwarding is used |
emailBodyTemplate | string | A template used to format the body of an the email being forwarded |
emailEnabled | string | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | Sender name |
emailSenderAddress | string | The address of the email sender. |
emailSubject | string | The subject of the email |
smsTemplate | string | This field is unused and can be empty. |
syslogTemplate | string | The content of the forwarded message |
syslogServer | string | Address of the syslog server. |
syslogPort | string | Port of the syslog server |
syslogProtocol | string | Syslog protocol |
syslogSeverity | string | Syslog severity |
syslogFacility | string | Syslog facility |
syslogEnabled | string | Determines whether forwarding to syslog is enabled. The value of the string can be “enabled” or “disabled”. |
customWSEnabled | string | Determines whether forwarding to a custom web service is enabled. The value of the string can be “enabled” or “disabled”. |
wsUsesToken | string | Determines whether an authentication token is used to authenticate to the web service |
wsTokenTimeout | number | Set the age of a token used to authenticate with a custom web service |
wsTokenUrl | string | The URL used to obtain the token |
wsTokenMethod | string | The HTTP method used for the request to obtain the token |
wsTokenHeaders | array_of_strings | Headers used in the request to obtain the token |
wsTokenRequest | string | The query string used when requesting auth token |
wsTokenResponse | string | A pattern used to extract the auth token out of the response |
wsAlertUrl | string | The custom webservice URL endpoint |
wsAlertMethod | string | The method used to send the alerts, can either be GET or POST |
wsAlertHeaders | array_of_strings | An array of strings, each represent header name and value separated by ‘:’ |
wsAlertRequest | string | The body of the alert |
useCustomForwardingProxy | boolean | Set whether a custom proxy should be used |
customForwardingProxyname | string | Name of the proxy object used to connect to the target |
useJsonParsing | boolean | Set whether json parsing is used when keywords are replaced |
Permissions¶
Role | Allow |
---|---|
Application_Editor | No |
WebSafe_Manager_Deployer | No |
ASM_Manager | No |
WebSafe_Manager | Yes |
Service_Catalog_Editor | No |
WebSafe_Manager_View | No |
Service_Catalog_Viewer | No |
WebSafe_Manager_Edit | Yes |
Security_Manager | Yes |
PATCH /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>¶
Request Parameters¶
Name | Type | Required | Description |
---|---|---|---|
alertCategory | array_of_numbers | False | An array of numbers, where each number maps to an alert category. Specify the categories of events that need to be forwarded. |
alertStatus | array_of_strings | False | An array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | False | A number (0-100). Alerts with a severity equal to or greater than the specified value will be forwarded. |
notificationTarget | array_of_strings | False | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, or custom. |
forwardingFields | array_of_strings | False | An array of the fields that should get forwarded. The list of fields includes: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, and Device ID. |
ruleStatus | string | False | The status of the rule. The possible values are enabled/disabled. |
userNameRequired | boolean | False | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | False | Enable or disable forwarding to the Security Operations Center SOC. |
allAccounts | boolean | False | Determines whether alerts of all accounts will get forwarded, or only specific accounts. |
accountReferences | reference | False | Used to select the accounts whose alerts will get forwarded. |
name | string | False | Name of the resource. |
link | string | False | URI link of the reference. |
webserviceReference | reference | False | A reference to the webservice object that alerts will get forwarded to. |
name | string | False | Name of the resource. |
link | string | False | URI link of the reference. |
emailRecipients | array_of_strings | False | The email addresses of the recipients of email when email forwarding is enabled. |
emailBodyTemplate | string | False | A template used to format the body of the email being forwarded. |
emailEnabled | string | False | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | False | The name that will appear as sender for the email being forwarded. |
emailSenderAddress | string | False | The email address of the email sender. |
emailSubject | string | False | The subject of the email. |
smsTemplate | string | False | This field is unused and can be empty. |
syslogTemplate | string | False | The content of the forwarded message. |
syslogServer | string | False | The address of the syslog server. |
syslogPort | string | False | The port of the syslog server. |
syslogProtocol | string | False | The Syslog protocol. |
syslogSeverity | string | False | The Syslog severity. |
syslogFacility | string | False | The Syslog facility. |
syslogEnabled | string | False | Determines whether forwarding to syslog is enabled. The possible values are enabled/disabled. |
customWSEnabled | string | False | Determines whether forwarding to a custom web service is enabled. The possible values are enabled/disabled. |
wsUsesToken | string | False | Determines whether an authentication token is used to authenticate the web service. |
wsTokenTimeout | number | False | Sets the age of a token used to authenticate a custom web service. |
wsTokenUrl | string | False | The URL used to obtain the token. |
wsTokenMethod | string | False | The HTTP method used for the request to obtain the token. |
wsTokenHeaders | array_of_strings | False | The headers used in the request to obtain the token. |
wsTokenRequest | string | False | The query string used when requesting the token. |
wsTokenResponse | string | False | A pattern used to extract the token out of the response. |
wsAlertUrl | string | False | The custom webservice URL endpoint. |
wsAlertMethod | string | False | The method used to send the alerts, can either be GET or POST. |
wsAlertHeaders | array_of_strings | False | An array of strings, where each represents a header name and value separated by ‘:’. |
wsAlertRequest | string | False | The body of the alert. |
useCustomForwardingProxy | boolean | False | Determines whether a custom proxy should be used. |
customForwardingProxyname | string | False | Name of the proxy object used to connect to the target. |
useJsonParsing | boolean | False | Determines whether json parsing is used when keywords are replaced. |
Query Parameters¶
None
Response¶
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
alertCategory | array_of_numbers | Array of numbers, each maps to an alert category. Specify the categories of events that needs to be forwarded. |
alertStatus | array_of_strings | Array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | A number (0-100). Alerts with severity equal or greater than the value will be forwarded. |
notificationTarget | array_of_strings | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, custom. |
forwardingFields | array_of_strings | An array of the fields that should get forwarded. The list of fields include: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, Device ID. |
ruleStatus | string | The status of the rule, can either be enabled or disabled. |
userNameRequired | boolean | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | Enable or disable forwarding to the SOC |
allAccounts | boolean | Determines whether alerts of all accounts will get forwarded, or only specific accounts |
accountReferences | reference | Used to select the accounts whose alerts will get forwarded |
name | string | Name of the resource |
link | string | URI link of the reference |
webserviceReference | reference | A reference to the webservice object that alerts will get forwarded to |
name | string | Name of the resource |
link | string | URI link of the reference |
emailRecipients | array_of_strings | Recipients of email when email forwarding is used |
emailBodyTemplate | string | A template used to format the body of an the email being forwarded |
emailEnabled | string | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | Sender name |
emailSenderAddress | string | The address of the email sender. |
emailSubject | string | The subject of the email |
smsTemplate | string | This field is unused and can be empty. |
syslogTemplate | string | The content of the forwarded message |
syslogServer | string | Address of the syslog server. |
syslogPort | string | Port of the syslog server |
syslogProtocol | string | Syslog protocol |
syslogSeverity | string | Syslog severity |
syslogFacility | string | Syslog facility |
syslogEnabled | string | Determines whether forwarding to syslog is enabled. The value of the string can be “enabled” or “disabled”. |
customWSEnabled | string | Determines whether forwarding to a custom web service is enabled. The value of the string can be “enabled” or “disabled”. |
wsUsesToken | string | Determines whether an authentication token is used to authenticate to the web service |
wsTokenTimeout | number | Set the age of a token used to authenticate with a custom web service |
wsTokenUrl | string | The URL used to obtain the token |
wsTokenMethod | string | The HTTP method used for the request to obtain the token |
wsTokenHeaders | array_of_strings | Headers used in the request to obtain the token |
wsTokenRequest | string | The query string used when requesting auth token |
wsTokenResponse | string | A pattern used to extract the auth token out of the response |
wsAlertUrl | string | The custom webservice URL endpoint |
wsAlertMethod | string | The method used to send the alerts, can either be GET or POST |
wsAlertHeaders | array_of_strings | An array of strings, each represent header name and value separated by ‘:’ |
wsAlertRequest | string | The body of the alert |
useCustomForwardingProxy | boolean | Set whether a custom proxy should be used |
customForwardingProxyname | string | Name of the proxy object used to connect to the target |
useJsonParsing | boolean | Set whether json parsing is used when keywords are replaced |
Permissions¶
Role | Allow |
---|---|
Application_Editor | No |
WebSafe_Manager_Deployer | No |
ASM_Manager | No |
WebSafe_Manager | Yes |
Service_Catalog_Editor | No |
WebSafe_Manager_View | No |
Service_Catalog_Viewer | No |
WebSafe_Manager_Edit | Yes |
Security_Manager | Yes |
DELETE /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>¶
Request Parameters¶
None
Query Parameters¶
None
Response¶
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
alertCategory | array_of_numbers | Array of numbers, each maps to an alert category. Specify the categories of events that needs to be forwarded. |
alertStatus | array_of_strings | Array of strings of statuses to forward. The only allowed value is “New”. |
alertSeverity | number | A number (0-100). Alerts with severity equal or greater than the value will be forwarded. |
notificationTarget | array_of_strings | An array of the notification targets. The possible values for each element in the array are: email, webservice, syslog, custom. |
forwardingFields | array_of_strings | An array of the fields that should get forwarded. The list of fields include: Alert GUID, GeoIP City, Alert Date, Alert Domain, Alert URL, Alert Details, Alert Recommendation, Client Language, Client HostName, Client Proxy HostName, Client Username, Device Params, GeoIP Country, Client Session Data, Alert Referrer, Alert Severity, Alert Status, Alert Type, Client User Agent, Client IP, Client Proxy IP, Full Alert Query, Device ID. |
ruleStatus | string | The status of the rule, can either be enabled or disabled. |
userNameRequired | boolean | Determines whether a user name is required for an alert to get forwarded. |
socServiceEnabled | string | Enable or disable forwarding to the SOC |
allAccounts | boolean | Determines whether alerts of all accounts will get forwarded, or only specific accounts |
accountReferences | reference | Used to select the accounts whose alerts will get forwarded |
name | string | Name of the resource |
link | string | URI link of the reference |
webserviceReference | reference | A reference to the webservice object that alerts will get forwarded to |
name | string | Name of the resource |
link | string | URI link of the reference |
emailRecipients | array_of_strings | Recipients of email when email forwarding is used |
emailBodyTemplate | string | A template used to format the body of an the email being forwarded |
emailEnabled | string | Determines whether email forwarding is enabled. The possible values are enabled/disabled. |
emailSender | string | Sender name |
emailSenderAddress | string | The address of the email sender. |
emailSubject | string | The subject of the email |
smsTemplate | string | This field is unused and can be empty. |
syslogTemplate | string | The content of the forwarded message |
syslogServer | string | Address of the syslog server. |
syslogPort | string | Port of the syslog server |
syslogProtocol | string | Syslog protocol |
syslogSeverity | string | Syslog severity |
syslogFacility | string | Syslog facility |
syslogEnabled | string | Determines whether forwarding to syslog is enabled. The value of the string can be “enabled” or “disabled”. |
customWSEnabled | string | Determines whether forwarding to a custom web service is enabled. The value of the string can be “enabled” or “disabled”. |
wsUsesToken | string | Determines whether an authentication token is used to authenticate to the web service |
wsTokenTimeout | number | Set the age of a token used to authenticate with a custom web service |
wsTokenUrl | string | The URL used to obtain the token |
wsTokenMethod | string | The HTTP method used for the request to obtain the token |
wsTokenHeaders | array_of_strings | Headers used in the request to obtain the token |
wsTokenRequest | string | The query string used when requesting auth token |
wsTokenResponse | string | A pattern used to extract the auth token out of the response |
wsAlertUrl | string | The custom webservice URL endpoint |
wsAlertMethod | string | The method used to send the alerts, can either be GET or POST |
wsAlertHeaders | array_of_strings | An array of strings, each represent header name and value separated by ‘:’ |
wsAlertRequest | string | The body of the alert |
useCustomForwardingProxy | boolean | Set whether a custom proxy should be used |
customForwardingProxyname | string | Name of the proxy object used to connect to the target |
useJsonParsing | boolean | Set whether json parsing is used when keywords are replaced |
Permissions¶
Role | Allow |
---|---|
Application_Editor | No |
WebSafe_Manager_Deployer | No |
ASM_Manager | No |
WebSafe_Manager | Yes |
Service_Catalog_Editor | No |
WebSafe_Manager_View | No |
Service_Catalog_Viewer | No |
WebSafe_Manager_Edit | Yes |
Security_Manager | Yes |
Examples¶
GET to get a forwarding alert rule¶
To get information for a forwarding alert rule, send a GET request to the forwarding-alert-rules collection and specify the account’s identifier.
GET /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>
Response¶
HTTP/1.1 200 OK
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
POST to create a forwarding alert rule¶
To create a new forwarding alert rule, send a POST request to the forwarding-alert-rules collection and include the account rule information in the body of the request.
POST /mgmt/cm/websafe/working-config/forwarding-alert-rules
The Json in the body of the POST can look similar to the following example.
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
Response¶
The response to the POST can look similar to the following.
HTTP/1.1 200 OK
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
PUT to edit a forwarding alert rule¶
To edit an existing forwarding alert rule, send a PUT request to the forwarding-alert-rules collection, specify the rule’s identifier, and include the modified information in the body of the request.
PUT /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>
The Json in the body of the PUT can look similar to the following example.
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
Response¶
The response to the PUT can look similar to the following.
HTTP/1.1 200 OK
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
PATCH to edit a forwarding alert rule¶
To edit an existing forwarding alert rule, send a PATCH request to the forwarding-alert-rules collection, specify the rule’s identifier, and include the modified information in the body of the request.
PATCH /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
Response¶
The response to the PATCH can look similar to the following.
HTTP/1.1 200 OK
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}
DELETE to delete a forwarding alert rule¶
To delete a forwarding alert rule, send a DELETE request to the forwarding-alert-rules collection and specify the rule’s identifier.
DELETE /mgmt/cm/websafe/working-config/forwarding-alert-rules/<id>
Response¶
The response to the DELETE can look similar to the following.
HTTP/1.1 200 OK
{
"alertCategory": "[1,2]",
"alertStatus": "['new']",
"alertSeverity": 10,
"notificationTarget": "['email', 'syslog']",
"forwardingFields": "['Client IP']",
"ruleStatus": "enabled",
"userNameRequired": true,
"socServiceEnabled": true,
"allAccounts": true,
"accountReferences": [{
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
}],
"webserviceReference": {
"name": "resourceName",
"link": "https://localhost/mgmt/shared/foo/bar/866cfd8a-4d03-48e9-ba94-bb21a4bc2346"
},
"emailRecipients": "['a@b.com']",
"emailBodyTemplate": "Alert Type: {name}, Alert Severity: {severity}, Alert Status: {status},Alert URL: {url} Alert Details: {details} Client Username: {user} Client IP: {ip} Client Hostname: {hostname} Client Language: {language} Client User-Agent: {agent}",
"emailEnabled": "enabled",
"emailSender": "John Doe",
"emailSenderAddress": "a@b.com",
"emailSubject": "Forwarded alert",
"smsTemplate": "",
"syslogTemplate": "{accountid} - {name} %{severity} - {url}",
"syslogServer": "2.2.2.2",
"syslogPort": "6514",
"syslogProtocol": "tcp",
"syslogSeverity": "info",
"syslogFacility": "10",
"syslogEnabled": "enabled",
"customWSEnabled": "disabled",
"wsUsesToken": "No",
"wsTokenTimeout": 4,
"wsTokenUrl": "https://a.com",
"wsTokenMethod": "POST",
"wsTokenHeaders": "",
"wsTokenRequest": "",
"wsTokenResponse": "",
"wsAlertUrl": "http://a.com",
"wsAlertMethod": "POST",
"wsAlertHeaders": "",
"wsAlertRequest": "",
"useCustomForwardingProxy": false,
"customForwardingProxyname": "proxy",
"useJsonParsing": true
}