Topics on this page
Patch unprotected computers
Workload Security creates Intrusion Prevention rules that patch your computers against CVE's. You can use the API to determine which Intrusion Prevention rule protects against a specific CVE, determine if the rule is applied to your computers, and apply the rule if required.
- Use an
IntrusionPreventionRulesApiobject to obtain the intrusion prevention rules via search.
- For each computer, obtain an
IntrusionPreventionComputerExtensionobject and determine if the rule is applied to the computer.
- For each vulnerable computer, determine the policy that it uses, add the rule to the policy, and update the computers with the change.
The following example searches for the Intrusion Prevention rules that protect against a specific CVE. Intrusion Prevention rule objects include a CVE field that contains the names of the CVE that the rule applies to. The CVE field is searchable so you can easily find the rules for a specific CVE. From the rules that are returned from the search, obtain the rule IDs.
For detailed information about searching, see Search for Resources.
# Set search criteria search_criteria = api.SearchCriteria() search_criteria.field_name = "CVE" search_criteria.string_value = "%" + cve_id + "%" search_criteria.string_test = "equal" # Create a search filter search_filter = api.SearchFilter() search_filter.search_criteria = [search_criteria] # Search for all intrusion prevention rules for the CVE ip_rules_api = api.IntrusionPreventionRulesApi(api.ApiClient(configuration)) ip_rules_search_results = ip_rules_api.search_intrusion_prevention_rules(api_version, search_filter=search_filter) # Get the intrusion prevention rule IDs for the CVE from the results for rule in ip_rules_search_results.intrusion_prevention_rules: rule_id_s.append(rule.id) return rule_id_s
Also see the Search Intrusion Prevention Rules operation in the API Reference.
The following example determines which computers in a list do not have an Intrusion Prevention rule applied. For each computer, the IDs of the rules that are assigned to the computer are obtained. The assigned rule IDs are compared to the ID of the rule(s) that protect against the CVE.
unprotected_computers =  for computer in computers_list.computers: computer_ip_list = computer.intrusion_prevention if computer_ip_list.rule_ids: if rule_id in computer_ip_list.rule_ids: unprotected_computers.append(computer) return unprotected_computers
The following example adds an Intrusion Prevention rule to a policy. The source code on which this example is based also determines the policy that is assigned to the computers. Once the policy is found, the rule is assigned to the policy if it is not already assigned. Care must be taken to preserve the rules that are already applied.
# Get the current list of rules from the policy policies_api = api.PoliciesApi(api.ApiClient(configuration)) current_rules = policies_api.describe_policy(policy_id, api_version, overrides=False) # Add the rule_id if it doesn't already exist in current_rules if current_rules.intrusion_prevention.rule_ids == None: current_rules.intrusion_prevention.rule_ids = rule_id elif rule_id not in current_rules.intrusion_prevention.rule_ids: current_rules.intrusion_prevention.rule_ids.append(rule_id) # Add the new and existing intrusion prevention rules to a policy intrusion_prevention_policy_extension = api.IntrusionPreventionPolicyExtension() intrusion_prevention_policy_extension.rule_ids = current_rules.intrusion_prevention.rule_ids policy = api.Policy() policy.intrusion_prevention = intrusion_prevention_policy_extension