​
Basic Parameters​

ParameterDescription
CursorSpecify the pagination cursor for the next page of predicates.
IncludesWhitelist of response properties to include as an array of strings.
LimitMax number of records to return.

​
Advanced Parameters​

ParameterDescription
AliasFilter by the alias of the predicate.
Correlation IDID to correlate multiple requests.
Transaction IDID for a transaction.

​
Example Output​

{    "_status": {        "status": 0,        "code": "string"    },    "_meta": {        "stats": {            "offset": 0,            "limit": 0,            "total": 0        },        "origin": {}    },    "data": [        {            "definition": {                "$and": [                    {                        "$stringStartsWith": {                            "message.kind": {                                "$value": "email",                                "$assignIfTrue": [                                    {                                        "$dstIndex": "condition.RoyalMessage.methodEmail",                                        "$srcMode": "const",                                        "$srcParam": true                                    }                                ],                                "$assignIfFalse": [                                    {                                        "$dstIndex": "condition.RoyalMessage.methodEmail",                                        "$srcMode": "const",                                        "$srcParam": false                                    }                                ]                            }                        }                    },                    {                        "$stringMatch": {                            "message.sender.email": {                                "$value": "@proofpoint[^\\.]*",                                "$assignIfTrue": [                                    {                                        "$dstIndex": "condition.RoyalMessage.emailHit",                                        "$srcMode": "match"                                    },                                    {                                        "$dstIndex": "condition.RoyalMessage.emailHitFirst",                                        "$srcMode": "first"                                    },                                    {                                        "$dstIndex": "condition.RoyalMessage.emailHitLast",                                        "$srcMode": "last"                                    },                                    {                                        "$dstIndex": "condition.RoyalMessage.emailHitRange",                                        "$srcMode": "array",                                        "$srcParam": [                                            {                                                "$srcMode": "first"                                            },                                            {                                                "$srcMode": "last"                                            }                                        ]                                    }                                ],                                "$assignIfFalse": [                                    {                                        "$dstIndex": "condition.RoyalMessage.emailMiss",                                        "$srcMode": "param",                                        "srcParam": "message.sender.email"                                    }                                ]                            }                        }                    },                    {                        "$stringBetween": {                            "message.sender.displayName": [                                "king",                                "queen"                            ],                            "$assignIfTrue": [                                {                                    "$dstIndex": "condition.RoyalMessage.title",                                    "$srcMode": "param",                                    "$srcParam": "message.sender.displayName"                                }                            ]                        }                    }                ]            },            "details": {                "name": "USA Part Codes",                "description": "Two-letter codes of all USA parts including states, territories and the DC",                "meta": {}            },            "alias": "USA_PART_CODES",            "iver": 319,            "kind": "it:predicate:custom:match",            "purposes": [                "it:purpose:detection:rule:condition",                "it:purpose:endpoint:policy:match",                "it:purpose:exploration:search:filter",                "it:purpose:authorization:abac:condition"            ],            "sver": "1.2.3",            "createdAt": "2018-04-12T16:36:51.700Z",            "createdBy": {                "principal": {                    "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"                },                "clients": [                    {                        "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"                    }                ]            },            "updatedAt": "2018-04-12T16:36:51.700Z",            "updatedBy": {                "principal": {                    "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"                },                "clients": [                    {                        "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"                    }                ]            },            "tenant": 123456789,            "extent": "tenant",            "status": "active",            "risk": {                "default": {}            },            "tags": [                "rules",                "windows",                "agent"            ],            "id": "b73fc7b3-af84-48b6-bb2f-f3afd115a453"        }    ]}

​
Workflow Library Example​

List Predicates with Proofpoint Itm and Send Results Via Email

Preview this Workflow on desktop