Add a new Exploit Guard payload configuration to an existing profile

Create Windows Exploit guard policy payload

Endpoints

post /api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy

Copy full URL

Request URL

https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy

Scope

MDMDeviceMgmt.CREATECopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory

application/jsonCopied!

AcceptstringMandatory

application/jsonCopied!

- Path Parameters

profile_idstringMandatory

Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response

- Request Body

application/json

JSON Object

Hide Sub-Attributes

configure_network_guardintegerOptional

Configure Network Guard

enable_folder_protectionintegerOptional

Enable Folder Protection

data_file_idlongOptional

File ID from the Response of API

asr_rulesJSON ArrayOptional

Asr Rules

Show Sub-Attributes

JSON Object

Show Sub-Attributes

guidstringOptional

ASR Rule Guid

modeintegerOptional

Mode for the ASR Rule Guid 0 - Disable, 1 - Block, 2 - Audit, 6 - Warn

folder_rulesJSON ArrayOptional

Folder Rules

Show Sub-Attributes

JSON Object

Show Sub-Attributes

valuestringOptional

Full Folder Path

rule_typeintegerOptional

Rule for the Folder path 2 - Protected Folder, 3 - Excluded app list to Allow protected folder

asr_exclude_rulesJSON ArrayOptional

Asr Exclude Rules

Show Sub-Attributes

JSON Object

Show Sub-Attributes

valuestringOptional

Full Folder Path

rule_typeintegerOptional

Rule for the Folder path 1 - ASR Excluded App Folder

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"data_file_id":"9007199254741072","asr_exclude_rules":[{"rule_type":1,"value":"C:\\Winodws\\App.exe"}],"enable_folder_protection":0,"configure_network_guard":"1","folder_rules":[{"rule_type":2,"value":"C:\\windows"},{"rule_type":3,"value":"C:\\windows\\app.exe"}],"asr_rules":[{"mode":"1","guid":"56a863a9-875e-4185-98a7-b882c64b5ce5"},{"mode":"1","guid":"7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c"},{"mode":"1","guid":"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2"},{"mode":"1","guid":"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84"},{"mode":"1","guid":"26190899-1602-49e8-8b27-eb1d0a1ce869"},{"mode":"1","guid":"e6db77e5-3df2-4cf1-b95a-636979351e5b"}]}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy"))
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .header("Authorization", " d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.ofString("{\"data_file_id\":\"9007199254741072\",\"asr_exclude_rules\":[{\"rule_type\":1,\"value\":\"C:\\\\Winodws\\\\App.exe\"}],\"enable_folder_protection\":0,\"configure_network_guard\":\"1\",\"folder_rules\":[{\"rule_type\":2,\"value\":\"C:\\\\windows\"},{\"rule_type\":3,\"value\":\"C:\\\\windows\\\\app.exe\"}],\"asr_rules\":[{\"mode\":\"1\",\"guid\":\"56a863a9-875e-4185-98a7-b882c64b5ce5\"},{\"mode\":\"1\",\"guid\":\"7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c\"},{\"mode\":\"1\",\"guid\":\"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2\"},{\"mode\":\"1\",\"guid\":\"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84\"},{\"mode\":\"1\",\"guid\":\"26190899-1602-49e8-8b27-eb1d0a1ce869\"},{\"mode\":\"1\",\"guid\":\"e6db77e5-3df2-4cf1-b95a-636979351e5b\"}]}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"data_file_id\":\"9007199254741072\",\"asr_exclude_rules\":[{\"rule_type\":1,\"value\":\"C:\\\\Winodws\\\\App.exe\"}],\"enable_folder_protection\":0,\"configure_network_guard\":\"1\",\"folder_rules\":[{\"rule_type\":2,\"value\":\"C:\\\\windows\"},{\"rule_type\":3,\"value\":\"C:\\\\windows\\\\app.exe\"}],\"asr_rules\":[{\"mode\":\"1\",\"guid\":\"56a863a9-875e-4185-98a7-b882c64b5ce5\"},{\"mode\":\"1\",\"guid\":\"7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c\"},{\"mode\":\"1\",\"guid\":\"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2\"},{\"mode\":\"1\",\"guid\":\"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84\"},{\"mode\":\"1\",\"guid\":\"26190899-1602-49e8-8b27-eb1d0a1ce869\"},{\"mode\":\"1\",\"guid\":\"e6db77e5-3df2-4cf1-b95a-636979351e5b\"}]}"

headers = {
    'Content-Type': "application/json",
    'Accept': "application/json",
    'Authorization': " d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Content-Type", "application/json");
    headersMap.put("Accept", "application/json");

    data=Map();
    data.put("configure_network_guard","1");
    data.put("enable_folder_protection","1");
    data.put("data_file_id","1");
    data_asr_rules=List();
    data_asr_rules_item1=Map();
    data_asr_rules_item1.put("guid","value");
    data_asr_rules_item1.put("mode","1");
    data_asr_rules.add(data_asr_rules_item1);
    data.put("asr_rules",data_asr_rules);
    data_folder_rules=List();
    data_folder_rules_item1=Map();
    data_folder_rules_item1.put("value","value");
    data_folder_rules_item1.put("rule_type","1");
    data_folder_rules.add(data_folder_rules_item1);
    data.put("folder_rules",data_folder_rules);
    data_asr_exclude_rules=List();
    data_asr_exclude_rules_item1=Map();
    data_asr_exclude_rules_item1.put("value","value");
    data_asr_exclude_rules_item1.put("rule_type","1");
    data_asr_exclude_rules.add(data_asr_exclude_rules_item1);
    data.put("asr_exclude_rules",data_asr_exclude_rules);

    response = invokeUrl
    [
        url: "https://appDomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy"
        type: POST
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", " d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsexploitguardpolicy' -Method POST -Headers $headers -ContentType 'application/json' -Body '{"data_file_id":"9007199254741072","asr_exclude_rules":[{"rule_type":1,"value":"C:\\Winodws\\App.exe"}],"enable_folder_protection":0,"configure_network_guard":"1","folder_rules":[{"rule_type":2,"value":"C:\\windows"},{"rule_type":3,"value":"C:\\windows\\app.exe"}],"asr_rules":[{"mode":"1","guid":"56a863a9-875e-4185-98a7-b882c64b5ce5"},{"mode":"1","guid":"7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c"},{"mode":"1","guid":"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2"},{"mode":"1","guid":"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84"},{"mode":"1","guid":"26190899-1602-49e8-8b27-eb1d0a1ce869"},{"mode":"1","guid":"e6db77e5-3df2-4cf1-b95a-636979351e5b"}]}'

Sample Request Body

Add Exploit Guard payload to the profile

Copied!

  {
    "data_file_id": "9007199254741072",
    "asr_exclude_rules": [
      {
        "rule_type": 1,
        "value": "C:\\Winodws\\App.exe"
      }
    ],
    "enable_folder_protection": 0,
    "configure_network_guard": "1",
    "folder_rules": [
      {
        "rule_type": 2,
        "value": "C:\\windows"
      },
      {
        "rule_type": 3,
        "value": "C:\\windows\\app.exe"
      }
    ],
    "asr_rules": [
      {
        "mode": "1",
        "guid": "56a863a9-875e-4185-98a7-b882c64b5ce5"
      },
      {
        "mode": "1",
        "guid": "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c"
      },
      {
        "mode": "1",
        "guid": "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2"
      },
      {
        "mode": "1",
        "guid": "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84"
      },
      {
        "mode": "1",
        "guid": "26190899-1602-49e8-8b27-eb1d0a1ce869"
      },
      {
        "mode": "1",
        "guid": "e6db77e5-3df2-4cf1-b95a-636979351e5b"
      }
    ]
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

payload_idlong

Unique identifier for the created payload item

configure_network_guardinteger

Configure Network Guard

enable_folder_protectioninteger

Enable Folder Protection

data_blobstring

Data Blob

asr_rulesJSON Array

Asr Rules

Show Sub-Attributes

JSON Object

Show Sub-Attributes

guidstring

ASR Rule Guid

modeinteger

Mode for the ASR Rule Guid 0 - Disable, 1 - Block, 2 - Audit, 6 - Warn

folder_rulesJSON Array

Folder Rules

Show Sub-Attributes

JSON Object

Show Sub-Attributes

valuestring

Full Folder Path

rule_typeinteger

Rule for the Folder path 2 - Protected Folder, 3 - Excluded app list to Allow protected folder

asr_exclude_rulesJSON Array

Asr Exclude Rules

Show Sub-Attributes

JSON Object

Show Sub-Attributes

valuestring

Full Folder Path

rule_typeinteger

Rule for the Folder path 1 - ASR Excluded App Folder

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Exploit Guard payload successfully added

Copied!

  {
    "payload_id": "9007199254741295",
    "asr_exclude_rules": [
      {
        "rule_type": "1",
        "value": "C:\\Winodws\\App.exe"
      }
    ],
    "enable_folder_protection": "0",
    "configure_network_guard": "1",
    "folder_rules": [
      {
        "rule_type": "2",
        "value": "C:\\windows"
      },
      {
        "rule_type": "3",
        "value": "C:\\windows\\app.exe"
      }
    ],
    "data_blob": "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiP",
    "asr_rules": [
      {
        "mode": "1",
        "guid": "56a863a9-875e-4185-98a7-b882c64b5ce5"
      },
      {
        "mode": "1",
        "guid": "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c"
      },
      {
        "mode": "1",
        "guid": "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2"
      },
      {
        "mode": "1",
        "guid": "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84"
      },
      {
        "mode": "1",
        "guid": "26190899-1602-49e8-8b27-eb1d0a1ce869"
      },
      {
        "mode": "1",
        "guid": "e6db77e5-3df2-4cf1-b95a-636979351e5b"
      }
    ]
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.