InlineInfraService1
An individual port/protocol entry within an infrastructure service category. Each service represents a single network service definition (e.g., DNS UDP/53 or DNS TCP/53). Multiple services combine to form a infrastructure service category.
{
"service_category_id": "9b9d0c0e-5a65-41bb-b003-e7af60f417d1",
"service_name": "SYSLOG-UDP",
"port_protocol": {
"protocol": "UDP",
"port": "514"
},
"_create_user": "system",
"_create_time": 1782768322732,
"_last_modified_user": "system",
"_last_modified_time": 1782768322732,
"id": "5ff6f983-7dca-4b94-b3b5-58a0a880c934",
"site_ids": [],
"nsx_service_paths": "/infra/services/Syslog_(UDP)",
"is_broadcast_service": false,
"is_server_side": true,
"is_monitoring_enabled": true,
"is_custom": false,
"is_lockdown_allowed": true,
"is_ids_allowed": true
}The ID of the parent infrastructure service category that owns this service.
Use GET /intelligence/monitoring/infra/service-categories to find valid infrastructure service category entries.
Human-readable name of the service (e.g., "DNS", "LDAP", "Active Directory").
NSX policy path of the service object used as the rule service in proposed and published
DFW rules (e.g., /infra/services/DNS). When omitted, the system automatically infers
the NSX service path from the port_protocol definition. Provide this field only when
you need to override the inferred service path with a specific NSX service object.
When true, this service operates over broadcast (e.g., DHCP UDP/67, DHCPv6 UDP/547).
Broadcast services have the following restrictions:
- Discovered servers are not tracked for this service.
- Group publish actions are not supported.
- Lockdown rule proposals are not applicable. Infrastructure monitoring is automatically disabled for broadcast services.
When true, the infrastructure server is the destination side of observed flows
(e.g., a DNS server receiving queries). When false, the infrastructure server is
the source side (client-side service). This flag affects how leaked workloads are
identified: for server-side services the workload is the flow source; for client-side
services the workload is the flow destination.
When true, this service is actively monitored for new traffic flows and newly
discovered servers. When false, the discovered-servers list will not be updated
for this service.
Monitoring is automatically disabled for broadcast services (e.g., DHCP UDP/67, DHCPv6 UDP/547) and cannot be enabled for them. For all other services, this field reflects the persisted per-service monitoring setting.
When true, this service uses a non-standard custom L4 port/protocol (e.g., tcp_8443
or udp_12345). Custom services use dedicated custom DFW and IDS policy paths for rule
proposals and publishing, separate from the standard infrastructure policy.
When true, a lockdown (REJECT) rule may be proposed and published for this service.
Check this flag before setting lockdown_rule_request: true in
POST /intelligence/monitoring/infra/service-categories/{service-category-id}/proposed-rules or
including HIERARCHY_RULE_CREATE action with create_lockdown_rule: "REJECT" in
POST /intelligence/monitoring/infra/service-categories/{service-category-id}/publish-config.
Lockdown rule proposals are not supported for broadcast services.
When true, an IDS (Intrusion Detection System) rule may be proposed and published
for this service. Check this flag before calling POST /intelligence/monitoring/infra/service-categories/{service-category-id}/ids-proposed-rules or
including HIERARCHY_IDS_RULE_CREATE / HIERARCHY_IDS_RULE_UPDATE actions in
POST /intelligence/monitoring/infra/service-categories/{service-category-id}/publish-config.