Defining custom rules

Creating a rule

You can use the Security and Compliance Center UI to define the configuration rules that you want monitor for your IBM Cloud resources. For more information about which services you can configure rules for, see What can I evaluate?.

You can either use the rule builder or edit the JSON directly.

1. In the IBM Cloud console, click the Menu icon > Security and Compliance > Controls > Rules, and click Create.

2. Give your rule a meaningful name and description.

3. Optional: Add one or more labels that you can use to organize and search for similar rules and click Next.

4. Target your resource.

   1. From the Target service drop-down, select a service. For example, Cloud Object Storage.

   2. From the Resource type drop-down, select the type of resource that you want to create a rule for. For example, Bucket.

   3. Optional: Add additional target attributes to further qualify the resources that you want to target.

      For example, to target all of your Cloud Object Storage buckets in the US South location, you would make the following selections: Attribute: Location, Value: string_equals, and enter us_south for Value.

   4. Click Add to rule.

5. Configure your properties.

   To add additional properties to your rule, repeat this step. You can select up to 5 different conditions and 16 properties to create your rule.

   1. Select a Condition.

      • And: When you select And as your condition, all the property configurations that you add to your rule must evaluate to true in order for the rule to be compliant.
      • Or: When you select Or as your condition, only part of your rule must evaluate to true for it to be compliant.

   2. Define the rule by specifying a Property, Operator, and Value.

      To see all the properties that are available for the service that you selected, you can click Available Properties in the Definition step.

   3. Click Add to rule.

6. Click Next.

7. Review your selections and click Create.

Creating a rule with the API

You can use the Security and Compliance Center API to define the configuration rules that you want monitor for your IBM Cloud resources. For more information about which services you can configure rules for, see What can I evaluate?.

curl -X POST 
   --location --header "Authorization: Bearer {iam_token}" 
   --header "Accept: application/json" 
   --header "Content-Type: application/json" 
   --data '{ 
               "account_id": "130003ea8bfa43c5aacea07a86da3000", 
               "description": "Example rule", 
               "rule_type": "user_defined", 
               "import": { 
                  "parameters": [ 
                     { 
                        "name": "hard_quota", 
                        "display_name": "The Cloud Object Storage bucket quota.", 
                        "description": "The maximum bytes that are allocated to the Cloud Object Storage bucket.", 
                        "type": "numeric" 
                        } 
                     ] 
                  }, 
               "target": { 
                  "service_name": "cloud-object-storage", 
                  "resource_kind": "bucket", 
                  "additional_target_attributes":  ] 
               }, 
               "required_config": { 
                  "description": "The Cloud Object Storage rule.", 
                  "and": [ 
                     { 
                        "property": "hard_quota", 
                        "operator": "num_equals", 
                        "value": "{hard_quota}" 
                        } 
                     ] 
                  }, 
               "labels":  
            ], 
            "version": "1.0.0" 
         }' 
"https://us-south.compliance.cloud.ibm.com/instances/{instance_id}/v3/rules"

(securityAndComplianceCenterApi *SecurityAndComplianceCenterApiV3) CreateRule(createRuleOptions *CreateRuleOptions) (result *Rule, response *core.DetailedResponse, err error)

AdditionalTargetAttribute additionalTargetAttributeModel = new AdditionalTargetAttribute.Builder()
  .name("location")
  .operator("string_equals")
  .value("us-east")
  .build();
TargetPrototype targetPrototypeModel = new TargetPrototype.Builder()
  .serviceName("cloud-object-storage")
  .resourceKind("bucket")
  .additionalTargetAttributes(java.util.Arrays.asList(additionalTargetAttributeModel))
  .build();
RequiredConfigItemsRequiredConfigBase requiredConfigItemsModel = new RequiredConfigItemsRequiredConfigBase.Builder()
  .property("hard_quota")
  .operator("num_equals")
  .value("{hard_quota}")
  .build();
RequiredConfigAnd requiredConfigModel = new RequiredConfigAnd.Builder()
  .description("The Cloud Object Storage rule.")
  .and(java.util.Arrays.asList(requiredConfigItemsModel))
  .build();
Parameter parameterModel = new Parameter.Builder()
  .name("hard_quota")
  .displayName("The Cloud Object Storage bucket quota.")
  .description("The maximum bytes that are allocated to the Cloud Object Storage bucket.")
  .type("numeric")
  .build();
Import importModel = new Import.Builder()
  .parameters(java.util.Arrays.asList(parameterModel))
  .build();
CreateRuleOptions createRuleOptions = new CreateRuleOptions.Builder()
  .description("Example rule")
  .target(targetPrototypeModel)
  .requiredConfig(requiredConfigModel)
  .version("1.0.0")
  .xImport(importModel)
  .labels(java.util.Arrays.asList())
  .build();

Response<Rule> response = securityAndComplianceCenterApiService.createRule(createRuleOptions).execute();
Rule rule = response.getResult();

System.out.println(rule);

// Request models needed by this operation.

// AdditionalTargetAttribute
const additionalTargetAttributeModel = {
  name: 'location',
  operator: 'string_equals',
  value: 'us-east',
};

// Target
const targetModel = {
  service_name: 'cloud-object-storage',
  resource_kind: 'bucket',
  additional_target_attributes: [additionalTargetAttributeModel],
};

// RequiredConfigItemsRequiredConfigBase
const requiredConfigItemsModel = {
  property: 'hard_quota',
  operator: 'num_equals',
  value: '{hard_quota}',
};

// RequiredConfigRequiredConfigAnd
const requiredConfigModel = {
  description: 'The Cloud Object Storage rule.',
  and: [requiredConfigItemsModel],
};

// Parameter
const parameterModel = {
  name: 'hard_quota',
  display_name: 'The Cloud Object Storage bucket quota.',
  description: 'The maximum bytes that are allocated to the Cloud Object Storage bucket.',
  type: 'numeric',
};

// Import
const importModel = {
  parameters: [parameterModel],
};

const params = {
  description: 'Example rule',
  target: targetModel,
  requiredConfig: requiredConfigModel,
  version: '1.0.0',
  _import: importModel,
  labels: [],
};

let res;
try {
  res = await securityAndComplianceCenterApiService.createRule(params);
  console.log(JSON.stringify(res.result, null, 2));
} catch (err) {
  console.warn(err);
}

profile_controls_prototype_model = {
  'control_library_id': control_library_id_link,
  'control_id': '1fa45e17-9322-4e6c-bbd6-1c51db08e790',
}

default_parameters_prototype_model = {
  'assessment_type': 'Automated',
  'assessment_id': 'rule-a637949b-7e51-46c4-afd4-b96619001bf1',
  'parameter_name': 'session_invalidation_in_seconds',
  'parameter_default_value': '120',
  'parameter_display_name': 'Sign out due to inactivity in seconds',
  'parameter_type': 'numeric',
}

response = security_and_compliance_center_api_service.create_profile(
  profile_name='test_profile1',
  profile_description='test_description1',
  profile_type='custom',
  controls=[profile_controls_prototype_model],
  default_parameters=[default_parameters_prototype_model],
)
profile = response.get_result()

print(json.dumps(profile, indent=2))

A successful response returns the list of rules, along with other metadata. For more information about the required and optional request parameters, check out the API docs.

Creating a rule with the CLI

You can use the Security and Compliance Center CLI to define the configuration rules that you want monitor for your IBM Cloud resources. For more information about which services you can configure rules for, see What can I evaluate?.

ibmcloud security-compliance rule create
--description='Example rule'
--target='{
  "service_name": "cloud-object-storage",
  "service_display_name": "exampleString",
  "resource_kind": "bucket",
  "additional_target_attributes": [
    {
      "name": "location",
      "operator": "string_equals",
      "value": "us-east"
      }
    ]
  }'
--required-config='{
  "description": "The Cloud Object Storage rule.",
  "and": [
    {
      "description": "exampleString",
      "property": "hard_quota",
      "operator": "num_equals",
      "value": "${hard_quota}"
      }
    ]
  }'
--type=user_defined
--version=1.0.0
--import='{
  "parameters": [
    {
      "name": "hard_quota",
      "display_name": "The Cloud Object Storage bucket quota.",
      "description": "The maximum bytes that are allocated to the Cloud Object Storage bucket.",
      "type": "numeric"
      }
    ]
  }'
--labels=foo,bar
--x-correlation-id=exampleString
--x-request-id=exampleString

See the CLI reference for more information.

Creating a rule with Terraform

You can use Terraform to define the configuration rules that you want monitor for your IBM Cloud resources. For more information about which services you can configure rules for, see What can I evaluate?.

resource "ibm_scc_rule" "scc_rule_instance" {
  description = "Example rule"
  import {
		parameters {
			name = "name"
			display_name = "display_name"
			description = "description"
			type = "string"
		}
  }
  required_config {
		description = "description"
		and {
			description = "description"
			or {
				description = "description"
				property = "property"
				operator = "string_equals"
				value = "anything as a string"
			}
		}
  }
  target {
		service_name = "service_name"
		service_display_name = "service_display_name"
		resource_kind = "resource_kind"
		additional_target_attributes {
			name = "name"
			operator = "string_equals"
			value = "value"
		}
  }
  version = "1.0.0"
}

For more information, check out the Terraform reference.