Get Group Related Ids Rules

Get IDS rules applied to a specific group

Returns IDS (Intrusion Detection Service) rules organized by parent IDS security policies for the specified NSX group. Each result entry is an IDS security policy containing its list of associated rules.

Notes:

start_time is required. Either site_id or site_ids must also be provided.
relationship_type: CONTAINS (default) returns IDS rules whose applied-to scope directly references the group.
relationship_type: EFFECTIVE_MEMBERS returns IDS rules affecting individual VMs within the group rather than the group directly.
filters accepts up to 300 filter entries. Supported filter keys: IDS_RELATED_RULE_RULE_ID, IDS_RELATED_RULE_RULE_NAME.
Obtain group-id from the group topology graph returned by POST /visualization/topology/groups-flow-topology, where each node represents a group.
The group-id is the NSX realization UUID of the group, not its policy path or display name.
To see DFW rules for this group, use POST /visualization/security-analysis/groups/{group-id}/related-dfw-rules.
To see flow records for this group, use POST /visualization/flow-analysis/groups/{group-id}/flow-details.

Request

URI

POST

https://{api_host}/intelligence/visualization/threat-analysis/groups/{group-id}/related-ids-rules

COPY

Path Parameters

string

group-id

Required

ID of the target group.

Request Body

Wrapper request for GroupIdRelatedIdsRules with restricted filter keys

VizGroupIdRelatedIdsRulesRequest of type(s) application/json

Required

This request body class requires all of the following: VizTimeIntervalListSiteRequest , InlineVizGroupIdRelatedIdsRulesRequest1

{
    "start_time": 0,
    "page_size": 10000,
    "site_id": "17f7c7e5-7f8c-490a-97e9-b9c9193c45e1",
    "filters": []
}

Authentication

This operation uses the following authentication methods.

Responses

200

success

Returns RelatedIdsRuleListResult of type(s) application/json

This response body class contains all of the following: VizTimeIntervalListResult , InlineRelatedIdsRuleListResult1

{
    "offset": 0,
    "number_of_results": 2,
    "total_result_count": 2,
    "total_pages": 1,
    "time_interval": {
        "start_time": 0,
        "end_time": 1782178529589
    },
    "results": [
        {
            "site_id": "17f7c7e5-7f8c-490a-97e9-b9c9193c45e1",
            "policy_path": "/infra/domains/default/intrusion-service-policies/mps",
            "related_rules": [
                {
                    "policy_path": "/infra/domains/default/intrusion-service-policies/mps/rules/New_Rule"
                }
            ]
        },
        {
            "site_id": "17f7c7e5-7f8c-490a-97e9-b9c9193c45e1",
            "policy_path": "/infra/domains/default/intrusion-service-policies/SSP_Env_IDPS_0dad89c7-0401-335e-9f46-1d6a9465e578",
            "related_rules": [
                {
                    "policy_path": "/infra/domains/default/intrusion-service-policies/SSP_Env_IDPS_0dad89c7-0401-335e-9f46-1d6a9465e578/rules/SSP_Env_IDPS_Egress_Rule"
                },
                {
                    "policy_path": "/infra/domains/default/intrusion-service-policies/SSP_Env_IDPS_0dad89c7-0401-335e-9f46-1d6a9465e578/rules/SSP_Env_IDPS_Ingress_Rule"
                }
            ]
        }
    ]
}

400

Bad Request

Returns BadRequest of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

401

Unauthorized

Returns Unauthorized of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

403

Forbidden

Returns Forbidden of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

412

Precondition Failed

Returns PreconditionFailed of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

428

Precondition Required

Returns PreconditionRequired of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

429

Too Many Requests

Returns TooManyRequests of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

default

Error

Returns Error of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

Code Samples

COPY

                    curl -X POST -H 'Authorization: <value>' -H 'Content-Type: application/json' -d '{}' https://{api_host}/intelligence/visualization/threat-analysis/groups/{group-id}/related-ids-rules

On This Page

Description

Request

Path Parameters

Request Body

Authentication

Response

200 Response Body

Errors

Security Explorer Operations

POST

Get App Flow Details