anomaly_policy

The following methods allow for interaction with the ZCell Anomaly Policy API endpoints. Includes listing, creating, updating, deleting anomaly policies, toggling their status, and retrieving policy logs and violations.

Methods are accessible via zcell.anomaly_policy

Copyright (c) 2023, Zscaler Inc.

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

class AnomalyPolicyAPI

Bases: APIClient

create_anomaly_policy(id=None, **kwargs)

Create a new Anomaly Policy.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • **kwargs – Request body fields.

Returns:

(result, Response, error)

Return type:

tuple

Examples

Create a new GeoFencing anomaly policy:

>>> added_policy, _, error = client.zcell.anomaly_policy.create_anomaly_policy(
...     id='gi754cvqb07r0',
...     policy_name='PolicyRule01_2451',
...     policy_type='GEOFENCING',
...     sim_location_groups_ids=['219'],
... )
>>> if error:
...     print(f"Error adding anomaly policy: {error}")
...     return
>>> print(f"Anomaly Policy added successfully: {added_policy.as_dict()}")
delete_anomaly_policy(id=None, policy_id=None)

Delete an Anomaly Policy.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • policy_id (str) – Path parameter.

Returns:

(None, Response, error)

Return type:

tuple

Examples

Delete an anomaly policy:

>>> _, _, error = client.zcell.anomaly_policy.delete_anomaly_policy(
...     id='gi754cvqb07r0',
...     policy_id=added_policy.id,
... )
>>> if error:
...     print(f"Error deleting anomaly policy: {error}")
...     return
get_anomaly_policy_violations(id=None, policy_id=None, iccid=None, query_params=None)

Get violations for a specific ICCID.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • policy_id (str) – Path parameter.

  • iccid (str) – Path parameter.

  • days (int) – Convenience shorthand — sets a [now - days, now] start_date_time/end_date_time epoch-seconds window.

  • query_params (dict) – Map of query parameters for the request. [query_params.start_date_time] {int}: Required [query_params.end_date_time] {int}: Required [query_params.page] {int}: Page number (0-based) [query_params.size] {int}: Page size (1-100) [query_params.sort_by] {str}: Field to sort by. Default: timestamp. Sortable fields: policyId, policyType, timestamp [query_params.sort_dir] {str}: ASC or DESC. Default: DESC

Returns:

(result, Response, error)

Return type:

tuple

The returned response supports resp.search(<jmespath>) for client-side filtering/projection of the current page.

Examples

Get the violations for a specific ICCID under an anomaly policy:

>>> fetched_iccid, _, error = client.zcell.anomaly_policy.get_anomaly_policy_violations(
...     id='gi754cvqb07r0',
...     policy_id='208',
...     iccid='89852350525020079331',
...     days=14,
... )
>>> if error:
...     print(f"Error fetching ICCID violations: {error}")
...     return
>>> print(f"Total ICCID violations found: {len(fetched_iccid)}")
>>> for violation in fetched_iccid:
...     print(violation.as_dict())
list_anomaly_policy(id=None, start_date_time=None, end_date_time=None, query_params=None)

Get all Anomaly Policies.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • start_date_time (int) – Window start as epoch seconds. Required unless days is supplied.

  • end_date_time (int) – Window end as epoch seconds. Required unless days is supplied.

  • days (int) – Convenience shorthand — sets a [now - days, now] start_date_time/end_date_time epoch-seconds window.

  • query_params (dict) – Map of query parameters for the request. [query_params.policy_type] {str} [query_params.page] {int}: Page number (0-based) [query_params.size] {int}: Page size (1-100) [query_params.sort_by] {str}: Field to sort by. Default: policyName. Sortable fields: id, policyType, policyName, violations [query_params.sort_dir] {str}: ASC or DESC. Default: ASC

Returns:

(result, Response, error)

Return type:

tuple

The returned response supports resp.search(<jmespath>) for client-side filtering/projection of the current page.

Examples

List all anomaly policies for a customer using the days shorthand (the @zcell_params decorator turns it into a startDateTime / endDateTime epoch-seconds window of [now - days, now]):

>>> list_policies, _, err = client.zcell.anomaly_policy.list_anomaly_policy(
...     id='gi754cvqb07r0',
...     days=7,
... )
>>> if err:
...     print(f"Error listing anomaly policies: {err}")
...     return
>>> print(f"Total anomaly policies found: {len(list_policies)}")
>>> for policy in list_policies:
...     print(policy.as_dict())

Filter by policy name (client-side name filter via query_params):

>>> policy_list, _, err = client.zcell.anomaly_policy.list_anomaly_policy(
...     id='gi754cvqb07r0',
...     query_params={'name': 'PolicyRule01_2451'},
...     days=7,
... )
list_anomaly_policy_logs(id=None, policy_id=None, query_params=None)

Get Past Anomaly Policy Logs.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • policy_id (str) – Path parameter.

  • query_params (dict) – Map of query parameters for the request. [query_params.page] {int} [query_params.size] {int}

Returns:

(result, Response, error)

Return type:

tuple

The returned response supports resp.search(<jmespath>) for client-side filtering/projection of the current page.

Examples

List the past logs for an anomaly policy:

>>> audit_log, _, err = client.zcell.anomaly_policy.list_anomaly_policy_logs(
...     id='gi754cvqb07r0',
...     policy_id='208',
... )
>>> if err:
...     print(f"Error listing anomaly policy logs: {err}")
...     return
>>> print(f"Total anomaly policy logs found: {len(audit_log)}")
>>> for entry in audit_log:
...     print(entry.as_dict())
list_anomaly_policy_violations(id=None, policy_id=None, start_date_time=None, end_date_time=None, query_params=None)

Get ICCIDs with violations for an anomaly policy.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • policy_id (str) – Path parameter.

  • days (int) – Convenience shorthand — sets a [now - days, now] start_date_time/end_date_time epoch-seconds window.

  • query_params (dict) – Map of query parameters for the request. [query_params.start_date_time] {int}: Required [query_params.end_date_time] {int}: Required [query_params.page] {int}: Page number (0-based) [query_params.size] {int}: Page size (1-100) [query_params.sort_by] {str}: Accepted but ignored on this endpoint [query_params.sort_dir] {str}: Accepted but ignored on this endpoint

Returns:

(result, Response, error)

Return type:

tuple

The returned response supports resp.search(<jmespath>) for client-side filtering/projection of the current page.

Examples

List the ICCIDs with violations for an anomaly policy (days shorthand sets the required start/end window):

>>> violations, _, err = client.zcell.anomaly_policy.list_anomaly_policy_violations(
...     id='gi754cvqb07r0',
...     policy_id='208',
...     days=14,
... )
>>> if err:
...     print(f"Error listing anomaly policy violations: {err}")
...     return
>>> print(f"Total violations found: {len(violations)}")
>>> for violation in violations:
...     print(violation.as_dict())
update_anomaly_policy(id=None, policy_id=None, **kwargs)

Update an existing Anomaly Policy.

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • policy_id (str) – Path parameter.

  • **kwargs – Request body fields.

Returns:

(result, Response, error)

Return type:

tuple

Examples

Update an existing anomaly policy:

>>> updated_policy, _, error = client.zcell.anomaly_policy.update_anomaly_policy(
...     id='gi754cvqb07r0',
...     policy_id=added_policy.id,
...     policy_name='PolicyRule01_2451',
...     sim_location_groups_ids=['219'],
... )
>>> if error:
...     print(f"Error updating Anomaly Policy: {error}")
...     return
>>> print(f"Anomaly Policy updated successfully: {updated_policy.as_dict()}")
update_anomaly_policy_status(id=None, policy_id=None, enabled=None)

Update Anomaly Policy Status (Enable/Disable).

Parameters:

  • id (str) – Optional. The ZCell customer ID. Defaults to the zcellCustomerId config value or the ZCELL_CUSTOMER_ID environment variable when omitted.

  • policy_id (str) – Path parameter. The anomaly policy ID.

  • enabled (bool) – Required query parameter. True enables the policy, False disables it.

Returns:

(result, Response, error)

Return type:

tuple

Examples

Enable an anomaly policy:

>>> _, response, error = client.zcell.anomaly_policy.update_anomaly_policy_status(
...     id='gi754cvqb07r0',
...     policy_id='208',
...     enabled=True,
... )
>>> if error:
...     print(f"Error updating anomaly policy status: {error}")
...     return

Disable an anomaly policy:

>>> _, response, error = client.zcell.anomaly_policy.update_anomaly_policy_status(
...     id='gi754cvqb07r0',
...     policy_id='208',
...     enabled=False,
... )