Policy Object

The policy object describes the policy and rule that either triggered the event or the policy that was in effect when the event occurred.

Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments.

Name Attribute Requirement Type Description
Description desc Recommended String The description of the policy.
Effective Date effective_date Recommended Datetime The date and time that the specific policy and rule was applied and became operational.

Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Group DescriptionЕxt group_desc Recommended String The description of the group to which the policy belongs.
Group Name group_name Recommended String The name of the group to which the policy belongs.
Group IDЕxt group_uid Recommended String The unique identifier of the group to which the policy belongs.
LabelЕxt label Recommended String The label set for the policy.
Name name Recommended String The name given to the policy; for example "LAMP Policy".
Rule CategoryЕxt rule_category_id Recommended Integer The category of the primary rule that triggered the violation.
0UnknownRule category is unknown.
1Engine AnalysisSignature detection or machine learning heuristics detected the file.
2ReputationThe file’s reputation is worse than the policy threshold.
3PrevalenceThe file’s low usage is suspicious and is not allowed per policy threshold.
4Discovered DateThe file is too new and is not allowed per policy threshold.
5Blocked by UserThe file is blocked by the user.
6Blocked by AdminThe file is blocked by the administrator.
7Custom DetectionCustom YARA rule detected the file.
8ComplianceCompliance Scan status.
Rule DescriptionЕxt rule_desc Recommended String The description of the primary rule that triggered the policy event.
Rule Group DescriptionЕxt rule_group_desc Recommended String The additional information that describes the group to which the rule belongs.
Rule Group Name rule_group_name Recommended String The name of the group to which the rule belongs.
Rule Group IDЕxt rule_group_uid Recommended String The unique identifier of the group to which the rule belongs.
Rule Alert rule_is_alertable Recommended Boolean Indicates whether the event should be considered for management server alerting.
Rule Name rule_name Recommended String The name of the primary rule that triggered the policy event. For example: "Software Install Protection - Deny exe Modification", "USB_Registry_Connect_Activity", or "Programs that services should not execute".
Rule IDЕxt rule_uid Recommended String The unique identifer of the primary rule that triggered the policy event.
RulesЕxt rules Recommended Rule Array Additional rules that triggered the policy event.
StatesЕxt state_ids Recommended Integer Array The states related to the policy.
1Prevention Policy Overridden locally
2Policy Globally Disabled
3Prevention Policy Overridden except Self-Protection
4Default Rule applied
5Real-Time Event
6Virtual Event
7Injected
8ITA Forwarded
9CSP Forwarded
10OS Forwarded
11ConfigTool
12IPS Service
13External Event
14Solaris non-global one event
15SVA Generated Event
16Interactive Flag
17Service Flag
18Portal True
19Portal False
20Overrideable
21Exception
22Bad Reputation
23Gray Reputation
24Prevention disabled at sandbox level
25Policy Good
Type type_id Recommended Integer The policy type; one of:
0UnknownPolicy type is unknown
1Policy GroupPolicy group
2Browser IsolationApplication isolation browser policy
3Java IsolationApplication isolation Java® Virtual Machine policy
4Office IsolationApplication Isolation Microsoft Office policy
5PDF Renderer IsolationApplication Isolation PDF Renderer policy
6Generic IsolationApplication Isolation custom policy
7Null IsolationApplication Isolation null policy
8PlatformApplication Isolation platform policy
9Allow ListAllow List policy
10Deny ListDeny List policy
11Generic DiscoveryApplication Isolation generic discovery policy
12Targeted DiscoveryApplication Isolation targeted discovery policy
13Malware ProtectionMalware Protection policy
14Exploit ProtectionExploit Protection policy
15TelemetryTelemetry policy
16ExceptionException policy
17SystemSystem policy
18Device ControlDevice control policy
19Custom Application BehaviorCustom application behavior policy
20ComplianceCompliance policy
21Threat DefenseThreat defense policy
22Web and Cloud Access ProtectionWeb and cloud access protection policy
23MobileMobile policy
24Intrusion PreventionIntrusion prevention policy
25FirewallFirewall policy
26Detection and ResponseDetection and response policy
IDЕxt uid Recommended String A unique identifier of the policy instance that contains the rule generating the event; ordinarily, client or application-specific.
Version version Recommended String The policy version number.