FPSetRule
Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value.
python · Forcepoint Web Security
Details
| ID | FPSetRule |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | forcepoint triton |
README
Adds (or updates an existing) rule in Forcepoint Triton. Preserves orders of rules and modifies policy in-place if a rule exists with the exact type and value.
Script Data
| Name | Description |
|---|---|
| Script Type | python |
| Tags | forcepoint, triton |
Dependencies
This script uses the following commands and scripts.
- ssh
Inputs
| Argument Name | Description |
|---|---|
| policy | The policy/action assigned to the rule. Can be, “allow” or “deny” only. |
| type | The Triton rule type. Can be, “dest_domain”, “dest_ip”, “dest_host” or “url_regex”. |
| value | The value to match for this rule. Can be, “domain”, “regex”, etc… depending on the type. |
| remoteaccessname | If the Forcepoint Triton instance is configured as a RemoteAccess integration instance ‐ insert its name here. Replaces argument “tritonsystem”. |
| tritonsystem | The system name of the linux host on which Forcepoint Triton is installed. Only use this if it is not working with Triton as a RemoteAccess integration instance ‐ if so, use the “remoteaccessname” argument instead. |
Outputs
There are no outputs for this script.
commonfields: id: FPSetRule version: -1 name: FPSetRule script: '' type: python subtype: python3 tags: - forcepoint - triton comment: Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value. system: true args: - name: policy required: true default: true description: Policy/action assigned to the rule - "allow" or "deny" only. - name: type required: true description: The Triton rule type - "dest_domain", "dest_ip", "dest_host" or "url_regex". - name: value required: true description: The value to match for this rule (domain, regex, etc. depending on the type). - name: remoteaccessname description: If the Forcepoint Triton instance is configured as a RemoteAccess integration instance ‐ insert its name here. Replaces argument "tritonsystem". - name: tritonsystem description: System name of the linux host on which Forcepoint Triton is installed. Only use if not working with Triton as a RemoteAccess integration instance ‐ if so, use the "remoteaccessname" argument instead. scripttarget: 0 dependson: must: - ssh timeout: 0s fromversion: 5.0.0 dockerimage: demisto/python3:3.12.13.10116658 tests: - No tests (auto formatted)