Get Data Collection Rule Configs
GET {{cb_url}}/policyservice/v1/orgs/{{cb_org_key}}/policies/{{cb_policy_id}}/rule_configs/data_collection
Fetch configured Core Prevention rule configs.
RBAC PERMISSIONS REQUIRED
| Permission (.notation name) | Operation(s) |
|---|---|
| org.policies | READ |
RESPONSES
status: OK
{"results":[{"id":"91c919da-fb90-4e63-9eac-506255b0a0d0","name":"Authentication Events","description":"Turns on Windows authentication events at the sensor","inherited_from":"","category":"data_collection","parameters":{"enable_auth_events":false}},{"id":"d67f36ca-97c2-11ed-a8fc-0242ac120002","name":"Enterprise EDR Event Collection","description":"Enterprise EDR Event Collection","inherited_from":"psc:region","category":"data_collection","parameters":{"ubs_opt_in":false}},{"id":"491dd777-5a76-4f58-88bf-d29926d12778","name":"Prevalent Module Exclusions","description":"Collects events created when a process loads a common library. Enabling this will increase the number of events reported for expected process behavior.","inherited_from":"psc:region","category":"data_collection","parameters":{"enable_prevalent_module_event_collection":false}}]}