rules

OSA Webhook API

GET/api/rules

Search Sigma rules

Query parameters

prepackagedboolean

true = pre-packaged rules, false/omitted = custom rules.

qstring

Full-text over title/description/tags.

categorystring
frominteger
sizeinteger

Responses

200 Matching rules
totalnumberrequired
rulesRule[]required
idstringrequired
titlestring
categorystring

Log type — windows / linux / network / cloudtrail …

levelstring

Sigma level — critical / high / medium / low / informational

descriptionstring
authorstring
statusstring
tagsstring[]
last_update_timestring
rulestring

The original Sigma rule YAML.

prePackagedbooleanrequired
cURL
curl -X GET https://osawebhook.defenderx.sentrixsolution.com/api/rules?prepackaged=true&q=string&category=string
JavaScript
const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/rules", {
  method: "GET"
});
const data = await res.json();
Response 200
{
  "total": 0,
  "rules": [
    {
      "id": "string",
      "title": "string",
      "category": "string",
      "level": "string",
      "description": "string",
      "author": "string",
      "status": "string",
      "tags": [
        "string"
      ]
    }
  ]
}
POST/api/rules

Create a custom Sigma rule

Request body

categorystringrequired

Log type the rule belongs to.

rulestringrequired

Sigma rule YAML.

Responses

201 Created401 Missing/wrong webhook secret (only when WEBHOOK_SECRET is set)422 category/rule missing, or the SA plugin rejected the YAML (e.g. no id/date)
idstringrequired
cURL
curl -X POST https://osawebhook.defenderx.sentrixsolution.com/api/rules \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"category":"string","rule":"string"}'
JavaScript
const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/rules", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "category": "string",
    "rule": "string"
  })
});
const data = await res.json();
Response 201
{
  "id": "string"
}
GET/api/rules/{id}

Get one Sigma rule

Looked up in custom rules first, then pre-packaged.

Path parameters

idstringrequired

Responses

200 The rule404 Unknown rule id
idstringrequired
titlestring
categorystring

Log type — windows / linux / network / cloudtrail …

levelstring

Sigma level — critical / high / medium / low / informational

descriptionstring
authorstring
statusstring
tagsstring[]
last_update_timestring
rulestring

The original Sigma rule YAML.

prePackagedbooleanrequired
cURL
curl -X GET https://osawebhook.defenderx.sentrixsolution.com/api/rules/{id}
JavaScript
const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/rules/{id}", {
  method: "GET"
});
const data = await res.json();
Response 200
{
  "id": "string",
  "title": "string",
  "category": "string",
  "level": "string",
  "description": "string",
  "author": "string",
  "status": "string",
  "tags": [
    "string"
  ],
  "last_update_time": "string",
  "rule": "string",
  "prePackaged": true
}
PUT/api/rules/{id}

Update a custom Sigma rule

Path parameters

idstringrequired

Query parameters

forcedboolean

Required (true) when the rule is used by a detector.

Request body

categorystringrequired

Log type the rule belongs to.

rulestringrequired

Sigma rule YAML.

Responses

200 Updated401 Missing/wrong webhook secret (only when WEBHOOK_SECRET is set)
idstringrequired
cURL
curl -X PUT https://osawebhook.defenderx.sentrixsolution.com/api/rules/{id}?forced=true \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"category":"string","rule":"string"}'
JavaScript
const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/rules/{id}", {
  method: "PUT",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "category": "string",
    "rule": "string"
  })
});
const data = await res.json();
Response 200
{
  "id": "string"
}
DELETE/api/rules/{id}

Delete a custom Sigma rule

Path parameters

idstringrequired

Query parameters

forcedboolean

Required (true) when the rule is used by a detector.

Responses

200 Deleted401 Missing/wrong webhook secret (only when WEBHOOK_SECRET is set)
idstringrequired
deletedbooleanrequired
cURL
curl -X DELETE https://osawebhook.defenderx.sentrixsolution.com/api/rules/{id}?forced=true \
  -H "Authorization: Bearer $TOKEN"
JavaScript
const res = await fetch("https://osawebhook.defenderx.sentrixsolution.com/api/rules/{id}", {
  method: "DELETE",
  headers: {
    "Authorization": `Bearer ${token}`
  }
});
const data = await res.json();
Response 200
{
  "id": "string",
  "deleted": true
}