RiskyRules

device

String

Device name.

ruleid

String

ID of rule.

ruleNum

String

Rule number or name.

source

Array of String

List of names of hosts.

destination

Array of String

List of names of host.

application

Array of String

List of names of applications.

service

Array of String

List of names of services.

action

String

Rule action.

documentation

A Documentation Object

Each field in the object is the name of a documentation field and each field's value is the value of the documentation field.

risks

Array of Risk Objects

Each risk object has the following fields:

• risk code : String
• severity : String
• title : String

totalBySeverity

List of RuleSeverity

List of risk severity levels and the total number of rules at each level:

• HIGH : Integer
• SUSP_HIGH : Integer (Suspected high risks)
• MEDIUM : Integer
• LOW : Integer

trafficCount

Integer

Count of traffic meeting rule.

Device

String

Device name.

Rule

String

Name of rule.

Id

String

ID of rule.

Source

String

Source.

Destination

String

Destination.

Application

String

Name of application.

Service

String

Name of service.

Action

String

Rule action.

Comment

String

Comment

Traffic count

String

Count of traffic meeting rule.

Documentation

String

Name of documentation fields.

High Risks

Integer

Number of rules at high risk level.

Suspected High Risks

Integer

Number of rules at suspected high risk level.

Medium Risks

Integer

Number of rules at medium risk level.

Low Risks

Integer

Number of rules at low risk level.