FPSetRule

Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value.

python · Forcepoint Web Security

Details

IDFPSetRule
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Tagsforcepoint triton

README

Adds (or updates an existing) rule in Forcepoint Triton. Preserves orders of rules and modifies policy in-place if a rule exists with the exact type and value.

Script Data


Name Description
Script Type python
Tags forcepoint, triton

Dependencies


This script uses the following commands and scripts.

  • ssh

Inputs


Argument Name Description
policy The policy/action assigned to the rule. Can be, “allow” or “deny” only.
type The Triton rule type. Can be, “dest_domain”, “dest_ip”, “dest_host” or “url_regex”.
value The value to match for this rule. Can be, “domain”, “regex”, etc… depending on the type.
remoteaccessname If the Forcepoint Triton instance is configured as a RemoteAccess integration instance ‐ insert its name here. Replaces argument “tritonsystem”.
tritonsystem The system name of the linux host on which Forcepoint Triton is installed. Only use this if it is not working with Triton as a RemoteAccess integration instance ‐ if so, use the “remoteaccessname” argument instead.

Outputs


There are no outputs for this script.

commonfields:
  id: FPSetRule
  version: -1
name: FPSetRule
script: ''
type: python
subtype: python3
tags:
- forcepoint
- triton
comment: Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value.
system: true
args:
- name: policy
  required: true
  default: true
  description: Policy/action assigned to the rule - "allow" or "deny" only.
- name: type
  required: true
  description: The Triton rule type - "dest_domain", "dest_ip", "dest_host" or "url_regex".
- name: value
  required: true
  description: The value to match for this rule (domain, regex, etc. depending on the type).
- name: remoteaccessname
  description: If the Forcepoint Triton instance is configured as a RemoteAccess integration instance ‐ insert its name here. Replaces argument "tritonsystem".
- name: tritonsystem
  description: System name of the linux host on which Forcepoint Triton is installed. Only use if not working with Triton as a RemoteAccess integration instance ‐ if so, use the "remoteaccessname" argument instead.
scripttarget: 0
dependson:
  must:
  - ssh
timeout: 0s
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)