> Source: [sk147834](https://support.checkpoint.com/results/sk/sk147834) # sk147834 - Create a new CloudGuard Compliance ruleset and run an assessment with it | Property | Value | |----------|-------| | Solution ID | sk147834 | | Date Created | 2019-02-24 | | Last Modified | 2023-02-09 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81.20, R82 | ## Solution This article illustrates how to use the CloudGuard API to create a new Posture Management ruleset and then run an assessment with it on a cloud account. This uses the CloudGuard API [CompliancePolicy](https://docs.cloudguard.dome9.com/reference/continuous-compliance-policy-v2) and [Assessment](https://docs.cloudguard.dome9.com/reference/assessment) resources. This example runs a single assessment. Use the [ContinuousCompliancePolicy](https://api-v2-docs.dome9.com/#Dome9-API-ContinuousCompliancePolicy) resource to run assessments continuously. See also -------- [Posture Management](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/CloudGuard-PM-Admin-Guide/Default.htm#cshid=Posture_Management) [Continuous Posture](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/CloudGuard-PM-Admin-Guide/Default.htm#cshid=Continuous_posture) Prerequisites ============= Before you can use CloudGuard API, prepare: * the GSL statements for the rules in the ruleset * the cloud account ID to be assessed by the ruleset (use the [GET CloudAccounts](https://docs.cloudguard.dome9.com/reference/cloudaccounts_get_get_v2cloudaccounts)method for this) Create a Ruleset ================ Use the [CompliancePolicy](https://docs.cloudguard.dome9.com/reference/continuous-compliance-policy-v2) method. Request ------- ``` POST https://api.dome9.com/v2/ContinuousCompliancePolicyV2 ``` This is an example of the request block. ``` { "name":"Example Bundle", "description":"Test bundle", "rules":[ { "name":"RDS storage should be encrypted", "description":"You should encrypt your Amazon RDS instances and snapshots at rest by enabling the encryption option for your Amazon RDS DB instance.", "severity":"High", "logic":"RDS should have isStorageEncrypted = 'true' and kmsKeyId", "remediation":"Consider migrating your RDS to an at rest encrypted RDS; Follow AWS recommendations at: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", "complianceTag":"Encryption and Key Management" } ], "cloudVendor":"aws" } ``` ### Parameters Set these fields **name** and (optionally) **description** of the bundle For each rule: **name** \& (optionally) **description**of the rule **severity -**the severity of the rule (High/Medium/Low) **logic** - the GSL statement for the rule, as a text string **remediation** - free text of the remediation instructions. Ignore these parameters: complianceTag, domain,priority, controlTitle, ruleId, id, logicHash Response -------- This is an example of the response. The bundle id value (in the exampe above, 30263) is used to run assessments with the bundle. ``` { "rules":[ { "name":"RDS storage should be encrypted", "severity":"High", "logic":"RDS should have isStorageEncrypted = 'true' and kmsKeyId", "description":"You should encrypt your Amazon RDS instances and snapshots at rest by enabling the encryption option for your Amazon RDS DB instance.", "remediation":"Consider migrating your RDS to an at rest encrypted RDS; Follow AWS recommendations at: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", "complianceTag":"Encryption and Key Management", "domain":"", "priority":"", "controlTitle":"", "ruleId":"", "logicHash":"HtVz32xiB0iFPv74rGyirg", "isDefault":false } ], "accountId":"*****", "createdTime":"2018-08-20T05:00:38.2769723Z", "updatedTime":"0001-01-01T00:00:00", "id":30263, "name":"Example Bundle", "description":"Test bundle", "isTemplate":false, "hideInCompliance":false, "minFeatureTier":"Premium", "section":0, "tooltipText":"", "showBundle":true, "systemBundle":false, "cloudVendor":"aws", "version":1, "language":"en" } ``` ### Code sample curl -X POST https://api.dome9.com/v2/CompliancePolicy \ --basic -u : \ -H 'Content-Type: application/json' \ -H 'Accept: application/json' -d '{ "name":"Example Bundle", "description":"Test bundle", "rules":[ { "name":"RDS storage should be encrypted", "description":"You should encrypt your Amazon RDS instances and snapshots at rest by ena bling the encryption option for your Amazon RDS DB instance.", "severity":"High", "logic":"RDS should have isStorageEncrypted = 'true' and kmsKeyId", "remediation":"Consider migrating your RDS to an at rest encrypted RDS; Follow AWS recommendations at: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", "complianceTag":"Encryption and Key Management" } ], "cloudVendor":"aws" } ' curl -X POST https://api.dome9.com/v2/CompliancePolicy \ --basic -u : \ -H 'Content-Type: application/json' \ -H 'Accept: application/json ``` { "name":"Example Bundle", "description":"Test bundle", "rules":[ { "name":"RDS storage should be encrypted", "description":"You should encrypt your Amazon RDS instances and snapshots at rest by enabling the encryption option for your Amazon RDS DB instance.", "severity":"High", "logic":"RDS should have isStorageEncrypted = 'true' and kmsKeyId", "remediation":"Consider migrating your RDS to an at rest encrypted RDS; Follow AWS recommendations at: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", "complianceTag":"Encryption and Key Management" } ], "cloudVendor":"aws" } ``` Run an Assessment with the ruleset ================================== Use the [AssessmentBundleV2](https://docs.cloudguard.dome9.com/reference/assessment_runbundlev2async_post_v2assessmentbundlev2)method. Request ------- ``` POST https://api.dome9.com/v2/assessment/bundleV2 ``` ``` { "id":30263, "name":"Example Bundle", "description":"Test bundle", "dome9CloudAccountId":"********-****-****-****-************", "externalCloudAccountId":"************", "cloudAccountId":"************", "cloudAccountType":"Aws", "requestId":"00000000-0000-0000-0000-000000000000" "shouldMinimizeResult":"true" } ``` ### Parameters **id** - This is the ruleset id, returned from the POST CompliancePolicy request above (in this example, 30263) **dome9CloudAccountId** - This is the CloudGuard account number (can be retrieved using the GET CloudAccounts) **externalCloudAccountId** and **cloudAccountId** - These are both the cloud account ID in the cloud platform (in this case, the AWS account ID)
Response -------- The response shows the results of the tests (in this case, one test) when the bundle was run on the selected account and region. In this example, the test passed. ``` { "request":{ "id":30263, "name":"Example Bundle", "dome9CloudAccountId":"********-****-****-****-************", "externalCloudAccountId":"************", "cloudAccountId":"************", "cloudNetwork":"string", "cloudAccountType":"Aws", "requestId":"85742614-360b-4b53-b51d-afe57acb41f5" }, "tests":[ { "error":null, "testedCount":0, "relevantCount":0, "nonComplyingCount":0, "entityResults":[ ], "rule":{ "name":"RDS storage should be encrypted", "severity":"High", "logic":"RDS should have isStorageEncrypted = 'true' and kmsKeyId", "description":"You should encrypt your Amazon RDS instances and snapshots at rest by enabling the encryption option for your Amazon RDS DB instance.", "remediation":"Consider migrating your RDS to an at rest encrypted RDS; Follow AWS recommendations at: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", "complianceTag":"Encryption and Key Management", "domain":"", "priority":"", "controlTitle":"", "ruleId":"", "logicHash":"HtVz32xiB0iFPv74rGyirg", "isDefault":false }, "testPassed":true } ], "locationMetadata":{ "account":{ "srl":"", "name":"AWS", "id":"********-****-****-****-************", "externalId":"************" }, "region":{ "srl":"", "name":"N. Virginia", "id":"us_east_1", "externalId":"us-east-1" }, "cloudNetwork":{ "srl":"", "name":"", "id":"string", "externalId":"string" } }, "testEntities":{ "rds":[ ] }, "assessmentPassed":true, "hasErrors":false, "id":35673387 } ``` ### Code sample curl -X POST https://api.dome9.com/v2/assessment/bundleV2 \ --basic -u : \ -H 'Content-Type: application/json' \ -H 'Accept: application/json' -d '{ "id":30263, "name":"Example Bundle", "description":"Test bundle", "isCft":false, "dome9CloudAccountId":"********-****-****-****-************", "externalCloudAccountId":"************", "cloudAccountId":"************", "region":"us_east_1", "cloudAccountType":"Aws", "requestId":"00000000-0000-0000-0000-000000000000" }' --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content