Adds a custom application rule to the rule repository

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Creates a new application rule based on vendor name, product name, executable file hash, or COM component. The newly created rule can then be added to any application group for allow or block enforcement.

Endpoints

Request URL

https://{server-hostname}:8383/dcapi/appctrl/customrule

Scope

AppControl.CREATECopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

content-typestringOptional

- Request Body

application/json
JSON object
Hide Sub-Attributes
appRuleTypestringMandatory

Rule type (1=Vendor, 2=Product, 3=Executable, 4=FileHash, 20=Component)

isVerifiedstringMandatory

Verification status (1=verified, 0=unverified)

platformIDstringMandatory

Platform ID (1=Windows, 2=Mac)

vendorNamestringMandatory

Name of the software vendor

productNamestringOptional

Name of the software product. Required when appRuleType is 2 (Product).

fileNamestringOptional

Name of the executable file (e.g. myapp.exe). Required when appRuleType is 3 (Executable) or 4 (FileHash).

sha256HashstringOptional

SHA-256 hash of the file. Required when appRuleType is 4 (FileHash).

hashTypestringOptional

Refers to the type of hash (1=SHA-256, 2=CDHash)

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request POST \
  --url https://appdomain/dcapi/appctrl/customrule \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: SOME_STRING_VALUE' \
  --data '{"appRuleType":"1","isVerified":true,"platformID":"1","vendorName":"Adobe Systems"}'
Show full

Sample Request Body

Create a vendor-based rule

Copied!
  {
    "appRuleType": "1",
    "isVerified": true,
    "platformID": "1",
    "vendorName": "Adobe Systems"
  }
                
Show full

Create a Product-based rule

Copied!
  {
    "appRuleType": 2,
    "isVerified": false,
    "platformID": 1,
    "vendorName": "Google",
    "productName": "glc"
  }
                
Show full

Create a Verified Executable rule

Copied!
  {
    "appRuleType": 3,
    "fileName": "dfsgsdfydhgfd",
    "platformID": 1,
    "vendorName": "fsdzfgdfsgrdgf",
    "productName": "fsdgfdghfhfd"
  }
                
Show full

Create a file hash rule for a Windows executable

Copied!
  {
    "appRuleType": "4",
    "fileName": "myapp.exe",
    "sha256Hash": "a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890",
    "isVerified": false,
    "platformID": "1",
    "hashType": 1
  }
                
Show full

Response Parameters

- HTTP code 200

Response Body - application/json
JSON object
Hide Sub-Attributes
appRuleTypeinteger

Rule type ID (1=Vendor, 2=Product, 3=Executable, 4=FileHash, 20=Component)

appRuleIDlong

Unique identifier for the created rule

appRuleNamestring

Display name of the created rule

ruleDetailsJSON object

Detailed attributes of the created rule — structure varies by appRuleType

Show Sub-Attributes
fileNamestring

Name of the executable file (e.g. myapp.exe). Present when appRuleType is 3 (Executable) or 4 (FileHash).

sha256Hashstring

SHA-256 hash of the file. Present when appRuleType is 4 (FileHash).

- HTTP code 401

Response Body - application/json
JSON object
Hide Sub-Attributes
errorCodelong

Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required)

errorMsgstring

Authentication failure reason

Possible Response Codes

200HTTP code
401HTTP code

Sample Response: HTTP 200

Successfully created custom rule

Copied!
  {
    "appRuleType": 4,
    "appRuleID": 700,
    "ruleDetails": {
      "fileName": "myapp.exe",
      "sha256Hash": "a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890"
    },
    "appRuleName": "myapp.exe"
  }
                
Show full

Sample Response: HTTP 401

Authentication credentials missing or invalid

Copied!
  {
    "errorMessage": "Authentication credentials are missing or invalid",
    "errorCode": "UNAUTHORIZED"
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.