dlp_web_rules

The following methods allow for interaction with the ZIA DLP Web Rules API endpoints.

Methods are accessible via zia.dlp_web_rules

Copyright (c) 2023, Zscaler Inc.

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

class DLPWebRuleAPI

Bases: APIClient

A Client object for the DLP Web Rule resource.

add_rule(**kwargs)

Adds a new DLP policy rule.

Parameters:

  • name (str) – The name of the filter rule. 31 char limit.

  • action (str) – The action for the filter rule.

Keyword Arguments:

  • order (str) – The order of the rule, defaults to adding rule to bottom of list.

  • rank (str) – The admin rank of the rule.

  • state (str) – The rule state. Accepted values are ‘ENABLED’ or ‘DISABLED’.

  • auditor (list of int) – IDs for the auditors this rule applies to.

  • cloud_applications (list) – IDs for cloud applications this rule applies to.

  • description (str) – Additional information about the rule

  • departments (list of int) – IDs for departments this rule applies to.

  • dlp_engines (list of int) – IDs for DLP engines this rule applies to.

  • excluded_groups (list of int) – IDs for excluded groups.

  • excluded_departments (list of int) – IDs for excluded departments.

  • excluded_users (list of int) – IDs for excluded users.

  • file_types (list) – List of file types the DLP policy rule applies to.

  • groups (list of int) – IDs for groups this rule applies to.

  • icap_server (list of int) – IDs for the icap server this rule applies to.

  • labels (list of int) – IDs for labels this rule applies to.

  • locations (list of int) – IDs for locations this rule applies to.

  • location_groups (list of int) – IDs for location groups this rule applies to.

  • notification_template (list of int) – IDs for the notification template.

  • time_windows (list of int) – IDs for time windows this rule applies to.

  • users (list of int) – IDs for users this rule applies to.

  • url_categories (list) – IDs for URL categories the rule applies to.

  • dlp_content_locations_scopes (list) – Specifies one or more content locations

  • external_auditor_email (str) – Email of an external auditor for DLP notifications.

  • dlp_download_scan_enabled (bool) – True enables DLP scan for file downloads.

  • min_size (str) – Minimum file size (in KB) for DLP policy rule evaluation.

  • match_only (bool) – If true, matches file size for DLP policy rule evaluation.

  • ocr_enabled (bool) – True allows OCR scanning of image files.

  • without_content_inspection (bool) – True indicates a DLP rule without content inspection.

  • zcc_notifications_enabled (bool) – True enables Zscaler Client Connector notification.

Returns:

The new dlp web rule resource record.

Return type:

Tuple

Examples

Add a rule to allow all traffic to Google DNS (admin ranking is enabled):

>>> zia.web_dlp.add_rule(rank='7',
...    file_types=['BITMAP', 'JPEG', 'PNG'],
...    name='ALLOW_ANY_TO_GOOG-DNS',
...    action='ALLOW',
...    description='TT#1965432122')

Add a rule to block all traffic to Quad9 DNS for Finance Group:

>>> zia.web_dlp.add_rule(rank='7',
...    file_types=['BITMAP', 'JPEG', 'PNG'],
...    name='BLOCK_GROUP-FIN_TO_Q9-DNS',
...    action='BLOCK_ICMP',
...    groups=['95016183'],
...    description='TT#1965432122')
delete_rule(rule_id)

Deletes a DLP policy rule. This endpoint is not applicable to SaaS Security API DLP policy rules.

Parameters:

rule_id (str) – Unique id of the Web DLP Policy Rule that will be deleted.

Returns:

Response message from the ZIA API endpoint.

Return type:

Tuple

Examples

Delete a rule with an id of 9999.

>>> results = zia.web_dlp.delete_rule(rule_id=9999)
... print(results)
get_rule(rule_id)

Returns a DLP policy rule, excluding SaaS Security API DLP policy rules.

Parameters:

rule_id (str) – The unique id for the Web DLP rule.

Returns:

The Web DLP Rule resource record.

Return type:

Tuple

Examples

Get information on a Web DLP item by ID

>>> results = zia.web_dlp.get_rule(rule_id='9999')
... print(results)
list_rules(query_params=None)

List dlp web rules in your organization. If the search parameter is provided, the function filters the rules client-side.

Parameters:

{dict} (query_params) – Map of query parameters for the request. [query_params.search] {str}: Search string for filtering results by rule name.

Returns:

A tuple containing (list of DLP Web Rules instances, Response, error)

Return type:

tuple

Examples

Get a list of all Web DLP Items

>>> results = zia.web_dlp.list_rules()
... for item in results:
...    print(item)
list_rules_lite(query_params=None)

Lists name and ID for all DLP policy rules, excluding SaaS Security API DLP policy rules

Parameters:

{dict} (query_params) – Map of query parameters for the request. [query_params.search] {str}: Search string for filtering results by rule name.

Returns:

List of Web DLP name/ids.

Return type:

Tuple

Examples

Gets a list of all dlp web rules.

>>> rules, response, error = zia.dlp_web_rules.list_rules_lite():
... if error:
...     print(f"Error listing IP source rules: {error}")
...     return
... print(f"Total rules found: {len(rules)}")
... for rule in rules:
...     print(rule.as_dict())

Gets a list of all dlp web rules name and ID.

>>> rules, response, error = zia.dlp_web_rules.list_rules_lite(query_params={"search": 'Rule01'}):
... if error:
...     print(f"Error listing dlp web rules: {error}")
...     return
... print(f"Total rules found: {len(rules)}")
... for rule in rules:
...     print(rule.as_dict())
update_rule(rule_id, **kwargs)

Updates an existing DLP policy rule. Not applicable to SaaS Security API DLP policy rules.

Parameters:

  • rule_id (str) – ID of the rule.

  • **kwargs – Optional keyword args.

Keyword Arguments:

  • order (str) – Rule order, defaults to bottom of list.

  • rank (str) – Admin rank of the rule.

  • state (str) – Rule state (‘ENABLED’ or ‘DISABLED’).

  • auditor (list) – IDs for auditors this rule applies to.

  • cloud_applications (list) – IDs for cloud applications rule applies to.

  • description (str) – Additional information about the rule.

  • departments (list) – IDs for departments rule applies to.

  • dlp_engines (list) – IDs for DLP engines rule applies to.

  • excluded_groups (list) – IDs for excluded groups.

  • excluded_departments (list) – IDs for excluded departments.

  • excluded_users (list) – IDs for excluded users.

  • file_types (list) – List of file types the rule applies to.

  • groups (list) – IDs for groups rule applies to.

  • icap_server (list) – IDs for the ICAP server rule applies to.

  • labels (list) – IDs for labels rule applies to.

  • locations (list) – IDs for locations rule applies to.

  • location_groups (list) – IDs for location groups rule applies to.

  • notification_template (list) – IDs for the notification template.

  • time_windows (list) – IDs for time windows rule applies to.

  • users (list) – IDs for users rule applies to.

  • url_categories (list) – IDs for URL categories rule applies to.

  • external_auditor_email (str) – Email of external auditor for DLP notifications.

  • dlp_download_scan_enabled (bool) – True enables DLP scan for file downloads.

  • min_size (str) – Minimum file size (in KB) for rule evaluation.

  • match_only (bool) – If true, uses min_size for rule evaluation.

  • ocr_enabled (bool) – True allows OCR scanning of image files.

  • without_content_inspection (bool) – True for DLP rule without content inspection.

  • zcc_notifications_enabled (bool) – True enables ZCC notification for block action.

Returns:

The updated web dlp rule resource record.

Return type:

Tuple

Examples

Update a Web DLP Policy Rule:

>>> zia.web_dlp.get_rule('9999')
... name="updated name."
... description="updated name."

Update a web dlp policy rule to update description:

>>> zia.web_dlp.update_rule('976597', description="TT#1965232866")