Forum Discussion
- Kurt_EricksonEmployee
Need to see what you are using, however adding a signature might require using PATCH and it sounds as though you are using a POST.
- Ivan_ChernenkiiEmployee
Yes, it is possible.
You can do it only for user-defined (not factory) signature set with "type": "manual".
Also, you can update only single signature-set by ID. Update operation is not supported for all signature-sets.
In addition, if you want to add signature to existing signatures (not replace all with new one), then you need to use additional appendnested=1 parameter in query string.
You request should look like next:
PATCH /mgmt/tm/asm/signature-sets/Mwgb4CF1d-FEFuioDxLD9w?appendnested=1 HTTP/1.1
Host: my.host.com
Content-Type: application/json
Content-Length: 115
{
"signatures": [
{
"signatureId": 200101558
}
],
"type": "manual"
}
What RESTAPI request do you send?
Thanks, Ivan
I had the same question. I create a custom signature set with all the recommended Log4J Signatures with this JSON body
{ "name": "attack-signatures-log4j", "assignToPolicyByDefault": true, "defaultAlarm": true, "type": "manual", "isUserDefined":true, "accuracyValue": "high", "signatureReferences": [ { "link": "https://localhost/mgmt/tm/asm/signatures/FzyRtmjEB-RDeYxdV22Wcg" }, { "link": "https://localhost/mgmt/tm/asm/signatures/6GEkbeeViqG1i1bCMLXdOA" }, { "link": "https://localhost/mgmt/tm/asm/signatures/TDtAdP40B84UaYXLhMgIew" }, { "link": "https://localhost/mgmt/tm/asm/signatures/rYiJHZdAYt0dhXlbxFVXFQ" }, { "link": "https://localhost/mgmt/tm/asm/signatures/tOd2EOQdCzetaf2U3fHdKg" }, { "link": "https://localhost/mgmt/tm/asm/signatures/r1KtsZ7eOufX3tm3P1rhUA" }, { "link": "https://localhost/mgmt/tm/asm/signatures/NQyazwn_x4RzMCHvqv4GBw" }, { "link": "https://localhost/mgmt/tm/asm/signatures/T-E0ExygzH1O3DNShs3QtA" }, { "link": "https://localhost/mgmt/tm/asm/signatures/MFZSx7kIuGwhZDl8Vq85gA" } ], "defaultLearn": false, "defaultBlock": true }