{"info":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","description":"

Welcome the the Airlock Digital API reference. All requests will require an API key to authenticate with each endpoint listed in the left hand column of this documentation.

This documentation applies to v6.1.2+ of the Airlock Digital product

Other Documentation Versions:

v6.1.0 - v6.1.1
v6.0.x
v5.3.4 - v5.3.6
v5.3.0 - v5.3.3

The {{Server}} parameter in this documentation should be configured in the format:
https://server.name:3129 (where 3129 is the default port of the REST API)

NOTE: The previous version of this documentation had all requests in the body rather than parameters. This is still accepted by the API. In the event parameters are not found it will fall back to searching if a JSON key exists in the body with the same name. Certain endpoints that require arrays to be provided do not support parameters, these endpoints have an example Body explicitly specified in the document.

\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"13151680","collectionId":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","publishedId":"2sB3dWrS1z","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"104284"},"publishDate":"2025-12-22T04:39:20.000Z"},"item":[{"name":"Allowlist","item":[{"name":"/v1/application","id":"1c5e58b8-046b-4afa-9c2f-e8da51f630b8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/application","description":"

Returns a listing of all Allowlists within Airlock, including their 'applicationid' and 'name'

Returns a listing of all Allowlist categories within Airlock

(Required) Name of the Allowlist Category

\n","type":"text/plain"},"key":"name","value":"Browser Extensions"},{"description":{"content":"

(Optional) Existing Parent CategoryID to Create Child Category Underneath

\n","type":"text/plain"},"key":"categoryid","value":"1748637709"}],"variable":[]}},"response":[{"id":"2ca9e493-a0e7-4444-8cd7-9666aa6ff45a","name":"/v1/application/categories/new","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/application/categories/new?name=Browser Extensions&categoryid=1748637709","host":["{{Server}}"],"path":["v1","application","categories","new"],"query":[{"key":"name","value":"Browser Extensions","description":"(Required) Name of the Allowlist Category"},{"key":"categoryid","value":"1748637709","description":"(Optional) Existing Parent CategoryID to Create Child Category Underneath"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Tue, 08 Jul 2025 19:03:48 GMT"},{"key":"Content-Length","value":"61"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"subcategoryid\": \"1752001426\"\n }\n}"}],"_postman_id":"9965a1bf-a64d-4e39-89b9-fb125a979f97"},{"name":"/v1/application/categories/delete","id":"39f44ad8-fd6b-4d42-8306-54c6ab4f5c1d","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/application/categories/delete?categoryid=1748637709","description":"

Returns a listing of all Allowlist categories within Airlock

(Required) CategoryID to Delete

\n","type":"text/plain"},"key":"categoryid","value":"1748637709"}],"variable":[]}},"response":[{"id":"25e92c3e-cc82-46c5-a6ca-bb0403c3d910","name":"/v1/application/categories/delete","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/application/categories/delete?categoryid=1748637709","host":["{{Server}}"],"path":["v1","application","categories","delete"],"query":[{"key":"categoryid","value":"1748637709","description":"(Required) CategoryID to Delete"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Tue, 08 Jul 2025 19:07:45 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"39f44ad8-fd6b-4d42-8306-54c6ab4f5c1d"},{"name":"/v1/application/new","id":"e896c3c4-a85e-41a3-9b7e-cef581679383","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/application/new?name&version&categoryid","description":"

Creates a new Allowlist

name of application group

\n","type":"text/plain"},"key":"name","value":null},{"description":{"content":"

Version of application group

\n","type":"text/plain"},"key":"version","value":null},{"description":{"content":"

categoryid to add new application group to

\n","type":"text/plain"},"key":"categoryid","value":null}],"variable":[]}},"response":[{"id":"7ce1f9fa-2859-448b-8e65-cdb0aa8788e6","name":"/v1/application/new","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/application/new?name=newappcap&version=1&categoryid=1565551450","host":["{{Server}}"],"path":["v1","application","new"],"query":[{"key":"name","value":"newappcap","description":"(Required) Name of application group"},{"key":"version","value":"1","description":"(Required) Version of application group"},{"key":"categoryid","value":"1565551450","description":"(Required) Categoryid to add new application group to"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 06:49:29 GMT"},{"key":"Content-Length","value":"61"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"applicationid\": \"1714632569\"\n }\n}"}],"_postman_id":"e896c3c4-a85e-41a3-9b7e-cef581679383"},{"name":"/v1/application/delete","id":"af572b77-dc2d-4248-86da-b1d5f617d8eb","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/application/delete?applicationid","description":"

Deletes an Allowlist group by its applicationid

Application ID, via /application

\n","type":"text/plain"},"key":"applicationid","value":null}],"variable":[]}},"response":[{"id":"9abe7efa-114a-454b-bc05-fa8c5c6a41ab","name":"/v1/application/delete","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/application/delete?applicationid=1714632569","host":["{{Server}}"],"path":["v1","application","delete"],"query":[{"key":"applicationid","value":"1714632569","description":"Application ID, via /application"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 06:51:10 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"af572b77-dc2d-4248-86da-b1d5f617d8eb"},{"name":"/v1/application/export","id":"c43cb790-34eb-4e53-b759-6a1262cb867f","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/application/export?applicationid=1570641682","description":"

Export the contents of an Allowlist by specifying the applicationid. The response will be returned in XML format

(Required) Application ID, via /application

\n","type":"text/plain"},"key":"applicationid","value":"1570641682"}],"variable":[]}},"response":[{"id":"126a91a3-b3ff-4901-8455-07189a26e96d","name":"/v1/application/export","originalRequest":{"method":"POST","header":[],"url":{"raw":"https://al100.ci.managedwhitelisting.com:3129/v1/application/export?applicationid=1570641682","protocol":"https","host":["al100","ci","managedwhitelisting","com"],"port":"3129","path":["v1","application","export"],"query":[{"key":"applicationid","value":"1570641682","description":"(Required) Application ID, via /application"}]}},"status":"OK","code":200,"_postman_previewlanguage":"xml","header":[{"key":"Content-Disposition","value":"attachment; filename=\"Airlock Enforcement Agents.xml\""},{"key":"Content-Type","value":"application/xml"},{"key":"Last-Modified","value":"Thu May 2 16:21:49 +0930 ACST 2024"},{"key":"Date","value":"Thu, 02 May 2024 06:51:49 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"\n\n \n \n \n f748915b-48dc-45db-b957-53ef18a6685b\n \n \n \n \n \n \n \n 1570641682\n 4\n \n \n \n \n \n d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be\n 78c82a80ebf9c8bf0c996dd8bc26087679f77fea\n 006f8a615020a4a17f5e63801485df46\n 570988d66642eba3549e4deb6a199e7f34d3c3454aa9891845b50f93b5573638907cc9ddf9e4610974c2805c87b2bb5a\n c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76\n 78152\n 1268917866\n 1268917866\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7\n e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1\n eb881e3dddc84b20bd92abcec444455f\n 713fcea3eab1fbbdab7244379e56a25ad0e043914a60d935e341e3d24e54b1118bfea800507fa5f54839e08aa2ade5be\n 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75\n 295248\n 1268917870\n 1268917870\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 9dd9d76b4ef71188b09f3d074cd98b2de6ea741530e4ea19d539ae3f870e8326\n 308aeebeb1e1663aca26ce880191f936d0e4e683\n 407cdb7e1c2c862b486cde45f863ae6e\n 40d54160d521755449eaa4cec1dffb297d490e3966e645316b4d50dddb75cf057759a85376bc2b17e2f7d8e25657c769\n 7b4f43fc24eb30c234f2713c493b3c13928c591c77a3017e8dd806a41ccfedd53b0f748b5072052f8f9ac43236e8320b19d708903e3f06c59c6ed3c12722494e\n 14168\n 1268917886\n 1268917886\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 6db75fdc6cbb380ee2644ae09f57378c761568b10912db6baa069f0fbf482f1a\n 5f3b45c5f073d3583c6d70765d7b392554d4431c\n c19bc1a54b8ea1fd0241b4a8827851b8\n dda7b03e64c0950fe97106869c60122350ca0b724652b90735b14177bf4d658c88e6a3e7f2babfb39458fafd5301b2c2\n 03f88f279b2e778bf68a34bf45e0e6d8dda48d0e7b0077e953f3bac6f169628a20786a9a9e2b1ca2e3e588d989cc9971336ea5b526058bcf535fba0837a4720e\n 36680\n 1601122589\n 1601122589\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n b1264823b8ef58869a92f1385617ebb8d1044aba55b7780abc563e06ee3b611e\n 9e89afffb590ae30d5a88a62cf406d4c91c10e0a\n e6371b9fc394d0d4b31e5cf12f2857bf\n 3729ee31170b6f3ae9d8f109eb31f6604d2d19db319c6f5f6650701d8f77dca6b329bae3a2e180f395981cd6e6d93d82\n 4e36a1c863e8089737f30de1ba85b1ed055761754d2697b42bb38513e7bb4d1c4f2dc1a05c4dff40f42ab689dd72bf66e13f9bf411baad9698c0a670af46a82c\n 1225472\n 0\n 1625878936\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 8caf8793e99991e0ad76b5bc8b4f2b3780292a3f1f9226409b4186fb95f14443\n a5caba38c10db9d7ee492d257f8d4a66ca83f009\n d8967d399806541e83ed688578a2493f\n 8c5a0babc220275e43840500fdd59e91659ef1b42a4e5dd3fe3d8890fa9db4f64425efb7669d5fba1788a0a0de8fef69\n dd4653049371cb177889a1c0058158aac2ee94987fbcb00c1a23ab8e51d85fd8969c0c27bb6f055996472f04a6af2e61a5bdbe7a990cfd84dae9b1729adf174a\n 1057824\n 0\n 1625878935\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n origname\n contains\n powershell\n powershell\n \n \n group\n member\n BUILTIN\\\\Administrators | DomainTest\\\\AirlockHelpdesk\n S-1-5-32-544|S-1-5-21-1807265678-162013799-2377482582-1107\n \n \n \n \n \n \n iginnfkhmmfhlkagcmpgofnjhanpmklb\n 1\n 1\n \n \n \n \n \n glnpjglilkicbckjpbgcfkogebgllemb\n 1\n 1\n \n \n \n \n \n jaleebmaoohbjjohjlfmihkkopgfibne\n 1\n 3\n \n \n"}],"_postman_id":"c43cb790-34eb-4e53-b759-6a1262cb867f"},{"name":"/v1/application/metarule","id":"b27ee639-0b48-4647-ac61-393abab3fb80","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/application/metarule?applicationid=1766217757&include_criteria=0","description":"

Returns a listing of metarules within an allowlist package and optionally obtain criteria details.

(Required) The ID of the Allowlist you want to query metarules for

\n","type":"text/plain"},"key":"applicationid","value":"1766217757"},{"description":{"content":"

(Optional) 0 = Do not include metarule criteria in response, 1 = Include metarule criteria in response

\n","type":"text/plain"},"key":"include_criteria","value":"0"}],"variable":[]}},"response":[{"id":"aebb1e0b-783b-48d1-8e70-0fb3997838bd","name":"/v1/application/metarule","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/application/metarule?applicationid=1766217757&include_criteria=1","host":["{{Server}}"],"path":["v1","application","metarule"],"query":[{"key":"applicationid","value":"1766217757","description":"(Required) The ID of the Allowlist you want to query metarules for"},{"key":"include_criteria","value":"1","description":"(Optional) 0 = Do not include metarule criteria in response, 1 = Include metarule criteria in response"}]}},"status":"OK","code":200,"_postman_previewlanguage":null,"header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sat, 20 Dec 2025 12:11:33 GMT"},{"key":"Content-Length","value":"490"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"metarules\": [\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cae45675-732b-44e3-8a3e-c264ed0e0b52\",\n \"field\": \"publisher\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Adobe Inc. | Adobe Systems Incorporated\"\n },\n {\n \"criteriaid\": \"db763e51-5e4a-471a-89d9-ae4fe060670f\",\n \"field\": \"group\",\n \"index\": 1,\n \"operation\": \"member\",\n \"value\": \"BUILTIN\\\\\\\\Administrators\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"034b21fc-07c8-4352-b08d-44030a0bbed1\",\n \"name\": \"Allow Administrators to use Adobe Products\",\n \"os\": \"windows\"\n }\n ]\n }\n}"}],"_postman_id":"b27ee639-0b48-4647-ac61-393abab3fb80"},{"name":"/v1/application/metarule/new","id":"eb97fd53-b807-4589-be29-60a461c4056b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"/*\r\n * POST /v1/application/metarule/new - Create Allowlist Metarule\r\n *\r\n * ============================================================================\r\n * REQUEST BODY\r\n * ============================================================================\r\n *\r\n * applicationid (string, required) - Allowlist package timestamp ID\r\n * name (string, required) - Metarule name, max 128 chars\r\n * os (string, required) - \"windows\" | \"linux\" | \"mac\"\r\n * criteria (array, required) - 1-5 criteria objects (see below)\r\n * settings (object, optional) - Settings object (see below)\r\n *\r\n * ============================================================================\r\n * CRITERIA OBJECT\r\n * ============================================================================\r\n *\r\n * Each criteria object has: { \"field\": \"...\", \"operation\": \"...\", \"value\": \"...\" }\r\n * All criteria are processed as AND conditions.\r\n * Maximum 5 criteria per metarule.\r\n *\r\n * ----------------------------------------------------------------------------\r\n * VALID FIELDS BY OS\r\n * ----------------------------------------------------------------------------\r\n *\r\n * FIRST CRITERIA (position 0) - Must use positive identification fields:\r\n *\r\n * WINDOWS:\r\n * publisher - Code signing publisher name\r\n * path - File execution path\r\n * origname - Original filename (PE header)\r\n * digest - Authenticode hash\r\n * thumbprint - Certificate thumbprint\r\n * description - File description (PE header)\r\n * productname - Product name (PE header)\r\n * productversion - Product version\r\n *\r\n * LINUX:\r\n * publisher - Code signing publisher name (if signed)\r\n * path - File execution path\r\n * origname - Original filename\r\n *\r\n * MAC:\r\n * publisher - Code signing publisher name\r\n * path - File execution path\r\n * origname - Original filename\r\n * productname - Product name\r\n * productversion - Product version\r\n *\r\n * SUBSEQUENT CRITERIA (positions 1-4) - All first criteria fields PLUS:\r\n *\r\n * WINDOWS:\r\n * pprocess - Parent process name\r\n * gprocess - Grandparent process name\r\n * username - Executing username\r\n * group - Domain security group (DOMAIN\\GroupName)\r\n * csgroup - Cloud security group (Tenant\\GroupName)\r\n * os - Operating system string\r\n * commandline - Process command line\r\n * hostname - Endpoint hostname\r\n * tbshash - TBS hash\r\n * sha256 - SHA256 file hash\r\n * extensionid - Browser extension ID\r\n *\r\n * LINUX:\r\n * pprocess - Parent process name\r\n * gprocess - Grandparent process name\r\n * username - Executing username\r\n * os - Operating system string\r\n * commandline - Process command line\r\n * hostname - Endpoint hostname\r\n * sha256 - SHA256 file hash\r\n * extensionid - Browser extension ID\r\n *\r\n * MAC:\r\n * pprocess - Parent process name\r\n * gprocess - Grandparent process name\r\n * username - Executing username\r\n * os - Operating system string\r\n * commandline - Process command line\r\n * hostname - Endpoint hostname\r\n * sha256 - SHA256 file hash\r\n * extensionid - Browser extension ID\r\n *\r\n * ----------------------------------------------------------------------------\r\n * VALID OPERATIONS BY FIELD\r\n * ----------------------------------------------------------------------------\r\n *\r\n * origname - contains, notcontains*, match\r\n * path - contains, notcontains*, match, wildcard\r\n * publisher - contains, notcontains*, match\r\n * digest - match\r\n * thumbprint - match\r\n * description - contains, notcontains*, match\r\n * productname - contains, notcontains*, match\r\n * productversion - greater, less, match\r\n * pprocess - contains, notcontains*, match\r\n * gprocess - contains, notcontains*, match\r\n * username - contains, notcontains*, match\r\n * group - member, notmember*\r\n * csgroup - member, notmember*\r\n * os - contains, notcontains*, match\r\n * commandline - contains, notcontains*, match\r\n * hostname - contains, notcontains*, match, wildcard\r\n * tbshash - match\r\n * sha256 - match\r\n * extensionid - match\r\n *\r\n * * notcontains and notmember are ONLY valid for criteria 2-5 (not first)\r\n *\r\n * ----------------------------------------------------------------------------\r\n * VALUE FORMATS\r\n * ----------------------------------------------------------------------------\r\n *\r\n * JSON ESCAPING:\r\n * Backslashes must be escaped in JSON: C:\\example becomes \"C:\\\\example\"\r\n *\r\n * PIPE-SEPARATED VALUES (OR logic):\r\n * All fields support pipe-separated values for OR matching within a single criteria.\r\n * Examples (shown with JSON escaping):\r\n * publisher - \"Adobe Inc.|Microsoft Corporation|JetBrains s.r.o.\"\r\n * path - \"C:\\\\Program Files\\\\App1\\\\*|C:\\\\Program Files\\\\App2\\\\*\"\r\n * group - \"DOMAIN\\\\Admins|DOMAIN\\\\DevOps|DOMAIN\\\\QA\" (max 50 groups)\r\n * csgroup - \"Tenant\\\\Group1|Tenant\\\\Group2\" (max 50 groups)\r\n * hostname - \"SRV-*|WKS-*|DEV-*\"\r\n *\r\n * WILDCARD PATTERNS (for path, hostname fields with \"wildcard\" operation):\r\n * * - Single wildcard, matches any characters within one directory level (non-recursive)\r\n * Examples: C:\\example\\* | C:\\example\\*\\temp.exe | C:\\*system*\\*.exe\r\n * ** - Double wildcard, matches any characters recursively through subdirectories\r\n * Examples: C:\\example\\** | C:\\example\\**\\*.dll\r\n * ? - Question mark, matches exactly one character\r\n * Examples: C:\\example\\explore?.exe | ?:\\test.exe | C:\\example\\explorer.???\r\n *\r\n * All values max 2048 characters\r\n *\r\n * NOTE: Multiple criteria = AND logic. Pipe-separated values within a criteria = OR logic.\r\n *\r\n * ============================================================================\r\n * SETTINGS OBJECT\r\n * ============================================================================\r\n *\r\n * upload (int, optional) - Upload execution events, 0 = Disabled, 1 = Enabled (default: 0)\r\n *\r\n * ============================================================================\r\n * EXAMPLE REQUEST\r\n * ============================================================================\r\n */\r\n{\r\n \"applicationid\": \"1766217757\",\r\n \"name\": \"JetBrains IDE Suite - Controlled Developer Access\",\r\n \"os\": \"windows\",\r\n \"criteria\": [\r\n {\r\n \"field\": \"publisher\",\r\n \"operation\": \"match\",\r\n \"value\": \"JetBrains s.r.o.\"\r\n },\r\n {\r\n \"field\": \"group\",\r\n \"operation\": \"member\",\r\n \"value\": \"BUILTIN\\\\Administrators\"\r\n },\r\n {\r\n \"field\": \"path\",\r\n \"operation\": \"wildcard\",\r\n \"value\": \"C:\\\\Program Files\\\\JetBrains\\\\*\"\r\n },\r\n {\r\n \"field\": \"productversion\",\r\n \"operation\": \"greater\",\r\n \"value\": \"2023.0.0\"\r\n },\r\n {\r\n \"field\": \"hostname\",\r\n \"operation\": \"wildcard\",\r\n \"value\": \"DEV-WS-*\"\r\n }\r\n ],\r\n \"settings\": {\r\n \"upload\": 1\r\n }\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/application/metarule/new","description":"

Create a new Allowlist metarule within an existing Allowlist

Update an existing Allowlist Metarule

Delete an existing Allowlist Metarule

Returns a listing of a Metarules associated crtieria

Adds a new criteria to an existing metarule

Updates field, operation, and/or value for an existing criteria

Deletes a single criteria within a metarule

Updates the settings for an Allowlist Metarule

Endpoints for interacting with Allowlists (formerly Application Captures). These endpoints allow you to list, create, delete and export Allowlists. Please note that if you want to add and remove hashes from existing allowlists, please see the Hash category.

\n","_postman_id":"bb743671-e14f-4fbd-a19d-0a61a8ea42bd","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Agent","item":[{"name":"/v1/agent/find","id":"5cc5cbcc-68d2-40b5-af4f-fbea3fb251a8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/agent/find?agentid&hostname=&username&domain&groupid&ip&os=&status=1","description":"

Returns a listing of Agents and their details

(Optional) Target agentid

\n","type":"text/plain"},"key":"agentid","value":null},{"description":{"content":"

(Optional) hostname of PC

\n","type":"text/plain"},"key":"hostname","value":""},{"description":{"content":"

(Optional) Username last logged in to PC

\n","type":"text/plain"},"key":"username","value":null},{"description":{"content":"

(Optional) Domain name

\n","type":"text/plain"},"key":"domain","value":null},{"description":{"content":"

(Optional) Group ID in airlock

\n","type":"text/plain"},"key":"groupid","value":null},{"description":{"content":"

(Optional) IP Address of PC

\n","type":"text/plain"},"key":"ip","value":null},{"description":{"content":"

(Optional) Operating System name

\n","type":"text/plain"},"key":"os","value":""},{"description":{"content":"

(Optional) 0 = Offline,1 = Online,3 = Safemode

\n","type":"text/plain"},"key":"status","value":"1"}],"variable":[]}},"response":[{"id":"65b31428-2def-43e3-8645-12ed56e207d7","name":"/v1/agent/find","originalRequest":{"method":"POST","header":[],"url":{"raw":"https://al100.ci.managedwhitelisting.com:3129/v1/agent/find?agentid&hostname=DESKTOP-GDAFETE&username&domain&groupid&ip&os=Windows 10 x64 (Release: 21H2)&status","protocol":"https","host":["al100","ci","managedwhitelisting","com"],"port":"3129","path":["v1","agent","find"],"query":[{"key":"agentid","value":null,"description":"(Optional) Target agentid"},{"key":"hostname","value":"DESKTOP-GDAFETE","description":"(Optional) hostname of PC"},{"key":"username","value":null,"description":"(Optional) Username last logged in to PC"},{"key":"domain","value":null,"description":"(Optional) Domain name"},{"key":"groupid","value":null,"description":"(Optional) Group ID in airlock"},{"key":"ip","value":null,"description":"(Optional) IP Address of PC"},{"key":"os","value":"Windows 10 x64 (Release: 21H2)","description":"(Optional) Operating System name"},{"key":"status","value":null,"description":"(Optional) 0 = Offline,1 = Online,3 = Safemode"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 08:17:03 GMT"},{"key":"Content-Length","value":"397"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"agents\": [\n {\n \"agentid\": \"675f1647-f395-48e6-9663-a4c95512128d\",\n \"clientversion\": \"5.3.0.0\",\n \"domain\": \"DESKTOP-GDAFETE\",\n \"freespace\": \"54\",\n \"groupid\": \"b4bac2e5-8a96-440f-b03a-6272206e3eb5\",\n \"hostname\": \"DESKTOP-GDAFETE\",\n \"ip\": \"174.53.158.214\",\n \"localip\": \"192.168.0.229\",\n \"lastcheckin\": \"2024-04-29T16:03:39.507Z\",\n \"os\": \"Windows 10 x64 (Release: 21H2)\",\n \"policyversion\": \"9.1\",\n \"status\": 3,\n \"username\": \"patrick\"\n }\n ]\n }\n}"}],"_postman_id":"5cc5cbcc-68d2-40b5-af4f-fbea3fb251a8"},{"name":"/v1/agent/config","id":"55b4cd99-7923-4c70-a42d-25dcc2106dcf","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/agent/config?groupid=b4bac2e5-8a96-440f-b03a-6272206e3eb5","description":"

Retrieves an Enforcement Agent XML configuration file for a specified policy group. The response from this endpoint will be returned as an XML object that should be written to file. NOTE: To use this file with an Airlock Enforcement Agent it must be named 'AirlockClientAgentConfig.xml'

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"b4bac2e5-8a96-440f-b03a-6272206e3eb5"}],"variable":[]}},"response":[{"id":"4d3ff0ea-4914-4b01-86a3-ef34a4d84841","name":"/v1/agent/config","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/agent/config?groupid=b4bac2e5-8a96-440f-b03a-6272206e3eb5","host":["{{Server}}"],"path":["v1","agent","config"],"query":[{"key":"groupid","value":"b4bac2e5-8a96-440f-b03a-6272206e3eb5","description":"(Required) Target groupid"}]}},"status":"OK","code":200,"_postman_previewlanguage":"xml","header":[{"key":"Accept-Ranges","value":"bytes"},{"key":"Content-Disposition","value":"attachment; filename=\"AirlockClientAgentConfig.xml\""},{"key":"Content-Length","value":"7590"},{"key":"Content-Type","value":"application/xml"},{"key":"Last-Modified","value":"Thu, 02 May 2024 12:11:59 GMT"},{"key":"Date","value":"Thu, 02 May 2024 12:11:59 GMT"}],"cookie":[],"responseTime":null,"body":"\n\n company.server.com\n 26.26.26.109\n 443\n b4bac2e5-8a96-440f-b03a-6272206e3eb5\n -----BEGIN CERTIFICATE-----\nMIIExjCCAq6gAwIBAgIEXVBp1jANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJB\nVTEYMBYGA1UECAwPU291dGggQXVzdHJhbGlhMREwDwYDVQQHDAhHb29kd29vZDEg\nMB4GA1UECgwXQWlybG9jayBEaWdpdGFsIFB0eSBMdGQxCzAJBgNVBAsMAklUMRIw\nEAYDVQQDDAlBaXJsb2NrQ0EwHhcNMTkwODExMTkxNzQyWhcNMjkwODA4MTkxNzQy\nWjB+MQswCQYdystbvwJBVTEYMBYGA1UECAwPU291dGggQXVzdHJhbGlhMREwDwYD\nVQQHDAhHb29kd29vZDEgMB4GA1UECgwXQWlybG9jayBEaWdpdGFsIFB0eSBMdGQx\nCzAJBgNVBAsMAklUMRMwEQYDVQQDDApjbGllbnRjZXJ0MIIBIjANBgkqhkiG9w0B\nAQEFAAOCAQ8AMIIBCgKCAQEApBf685ryZSWKHmggH2cm6mNT/8RU3RTsU7NmeB4O\n84jEt9puB5LrSOV1PcTFSr2nSOXdwRNBpmy0AECgodzGYoBrdlHocE6tPQ5IWlm6\n1p5lv5kk1Iv5KmoCpH/xKB6n9O3ddvwiQUKPavPF+r/CbQa1PFDrXmtskOCUf/FK\niT5u81dpCHtBk1kO6QMvSETHZO2ISPdQs3hyvySwaSkQhau3lWx77udIggsjZfdB\n/3HAQqmileGyf+NfgHTL+lwEH/mMVZM0R02N84JuwuuKDWpE09E4IYXPNc7VoYm2\neXWN/8r5zVRxQWjWJMMi8pMB1vmKBTMaKjSoxqXA436ffwIDAQABo00wSzAJBgNV\nHRMEAjAAMAsGA1UdDwQEAwIF4DAxBgNVHREEKjAogiBhbDEwMC5jaS5tYW5hZ2Vk\nd2hpdGVsaXN0aW5nLmNvbYcEDU1PbTANBgkqhkiG9w0BAQsFAAOCAgEAMGKcGxoL\nu4sgBhvrewdEdAqECeqqSdTyacdovJ08hK8SIS3uz79IwiswZgN0r0cH2FncGnFg\nPU3OP+KnRDJjIQjFPUMh3ZEfMC3dqKBqBuPPRJmjtmCUrG5qokzYW7W8LtLVRsTm\nrOVYyf70TOApAgFGKCZlAeRsKCeoVOQgW0DgzmGiLaFRwcZLzWCFQ1F5TLd5QI38\nipxef+oErA06shbRPQXqAbknHtI5kjUoCjWwRz1fMHTo7WXKWGUkrlxuCuuNFtfY\neqoAacw8Ok6fPdvc+FY0B3zTleZ2B5t+9BJ4DHmbc6kF9BDrGspKGbQsAwbmPBrn\nHAy2LwFg/gwmoxbrCmFuURTUYuwmkafkkn3YT83NunkN99ewwFs5NUTKO4Oj7d7C\nW6vtl9hXjwqPR0t+2UySHUVuIYZ3qnKFm05jjRAVSk5z5/0yuqBEfKX/l2VAcPhK\nd5tQSjhRk2kSwsHN9SEHg6perMD07P+9zT7zdtHwyJwsP0upjX3D9mkUIvsVLV7q\n4XIUfWgRQoVGSsyAqy+istkWHr20iSkK+QFelcjo9ddyrcHmvbPZF+GqRs0zYH3Q\nPo4VLg1V7bJi7nVzUZgbD0q5Hs6eIHtkrGklaFIPSL65TDzSHKv6bxku/GG4VP8I\n43V4n5MDbHRmlrTEwaFPoHpGi86/x65uvKU=\n-----END CERTIFICATE-----\n\n -----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEApBf685ryZSWKHmggH2cm6mNT/8RU3RTsU7NmeB4O84jEt9pu\nB5LrSOV1PcTFSr2nSOXdwRNBpmy0AECgodzGYoBrdlHocE6tPQ5IWlm61p5lv5kk\n1Iv5KmoCpH/xKB6n9O3ddvwiQUKPavPF+r/CbQa1PFDrXmtskOCUf/FKiT5u81dp\nCHtBk1kO6QMvSETHZO2ISPdQs3hyvySwaSkQhau3lWx77udIggsjZfdB/3HAQqmi\nleGyf+NfgHTL+lwEH/mMVZM0R02N84JuwuuKDWpE09E4IYXPNc7VoYm2eXWN/8r5\nzVRxQWjWJMMi8pMB1vmKBTMaKjSoxqXA436ffwIDAQABAoIBAQCINgOxLWCih2vE\nW8i2aIjMLZFvkQik0BZwUE3xzXm5vEEXIHEPRmyagSY2FN10ckOnZnASMirfvAIa\n54qvcbUX1OPfPpSEjTqOoQl8Plmyh5+MUNJawKofBAqXhECpffELhlu8xgSlSVwF\ner9Pqtf4aoYMwFrwcJmZFWMPZTrq+px3B3nMkVehAzsy2MlHdcHN2GI03nL5jSEs\nJqzBO0Ot3n0+uLGAkrU64HRO+LECzzymTG9GMo+pwWpGghHph/nQ0cf66+LuZwKI\n0KDzB/lzHszrJhAtjGKdiN6owxqfQY1ffGD/4QObzAoIR2MscDLSSJUtgUFtIO+d\nR9hxKmBhAoGBANnMGiIqGusofw/4j8bF8a83zY/+PCfmSY4Q9PVUVQ/W9VRkMcsJ\n8u2nhENHpzIxGJoLTwrPWXNunp86VB+pRhMZPxVFF+3RsW+02nAAP3XMyVBttQF/\nrBgmWQOrlEm7dQIDX+9HHoqUKjVlLZwUER/OsOONJPcNmzZN0U12aXhRAoGBAMDg\nY6E/etDvkdwWeBD+hkTLNeOlerIG9xRCZ9ajkaa/1zu/UPxqmlMU475UK6rNnh/q\n14nZHIk6s+WpbrKr46dbpqxn7hLlisvhSasoq7DjnhRKUCsm49r04mL8WHdCCVpl\naj5ZFPe2bWPlb39GW5meB5v6tai7IZnlaMT7cXbPAoGATvsbBwSp2llHKq2CxhyG\nNnpQC0Ww3u8+AUzY6BZ6+lGDieUDwZOMCu7SoetcEHGJcGNleJAU6i1VTHzEgO7L\nwKVJIRd7Q/zlEZNOG4ubd8aZwpbmKvL3n5JYeWJBVjOqjN5Ybdcmli6A1/gnABCu\n3RABSaOnogfHH3w8yJCGUuECgYAgoFR6HFDcMwpLXomk5kk0LePJxF5C6ya0iJ8k\nEbs7p8vy0WQTrry4PRphQb+5Ptr2rzUSnmVTWVjBCq4tDyKNVtWU6Ge/TpDx+AQM\nLe8NFxPQftmc0xFMIoyBDgqw8by/S9RzA4KmfHd4pID92Jr6G19SJVDBYBZJACN+\n3sHMxQKBgQCOdYIksPdb+i1L45rNmMhI+zV8c8OllsimT9HloB+56b5aa+aGZ8LG\nqlPo1UnXPvj/YMbItvtP/s9Y9HB0+ykQ1AqlMBrHiBTd1HU0AYXSZDm2e+WIs6hK\nM+ChAZusEQUIcc7uJ6OcQtM/89D0UB0kvumCq6kX8xkqZwF8fReOYw==\n-----END RSA PRIVATE KEY-----\n\n -----BEGIN CERTIFICATE-----\nMIIE3TCCAsWgAwIBAgIEXVBp1TANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJB\nVTEYMBYGA1UECAwPU291dGggQXVzdHJhbGlhMREwDwYDVQQHDAhHb29kd29vZDEg\nMB4GA1UECgwXQWlybG9jayBEaWdpdGFsIFB0eSBMdGQxCzAJBgNVBAsMAklUMRIw\nEAYDVQQDDAlBaXJsb2NrQ0EwHhcNMTkwODExMTkxNzQyWhcNMjkwODA4MTkxNzQy\nWjCBlDELMAkGA1UEBhMCQVUxGDAWBgNVBAgMD1NvdXRoIEF1c3RyYWxpYTERMA8G\nA1UEBwwIR29vZHdvb2QxIDAeBgNVBAoMF0FpcmxvY2sgRGlnaXRhbCBQdHkgTHRk\nMQswCQYDVQQLDAJJVDEpMCcGA1UEAwwgYWwxMDAuY2kubWFuYWdlZHdoaXRlbGlz\ndGluZy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp8TT+JAfN\nskvDQHFqad9Jjow/h/IDtpdhURnHgd3USX91nbsmHAMu4s5iGQVLhvfEPX2FZNYi\nqLN8BYB58dOo6oKqY/u6f/1yN+xuETGAy2YaeF7Uuy+B1LKM0OqKHrTYktj/zOP0\n0wKaQXJnzuGTXCfNSAOCGuYEqQcHL8/847ecBoeyUgnGQ5ZfkgobDp7AxV/Hrcsp\nx8VBp2l28OR9FwRRsQk9rgqJCslAF/lL4YzvnLY5oERKk3LwTXe3uZ3/oilbqjAI\n4raFP3SFLGPOgFWIAh+fjS6GIA226Im9RRhHenIcBOqkHm5wjK1MBwEJYKAorS5k\nm/HT4Gmms4khAgMBAAGjTTBLMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMDEGA1Ud\nEQQqMCiCIGFsMTAwLmNpLm1hbmFnZWR3aGl0ZWxpc3RpbmcuY29thwQNTU9tMA0G\nCSqGSIb3DQEBCwUAA4ICAQBt92gGOOcLT2gUHse3cwApVRqdmdQjnvnc/SyRckvN\nHExRjWS6nhjgsLZSw3k0kyNKpA8zazYykAakXh59yn6scEq+yD2RXH1i5g/m1fos\n7nQDK/Gmy/fokq12dQcZV8HjGHtVVmvzfTNKGJxYQUwRQ+jxzIlOgZT4INyE+GfI\nJBzhxYyKYoAypgAsONlgHM25I3+PixBtux9vNeu+AHCsS3o4K4NJvAKBpqYMUqFr\nRQTtNStgGylLX/1Z/mqJNeHG0zUXXCOGBEE5ZZ5M4UXpdspVXRuqwBcFKstU+gnQ\nADLavUdzgV15s8wltqsxjJeZsAzIA+ungwld+OPQv9Yy2D8JrbZ8MG6hld/1Ar/d\n5octAyzIhpGLJGmQyzflid4Du7eVOJlGtor8/lU+OLf+5jXjixQ6atCkVSBx/XST\npDcaRdM3F4zL7s0jwlXDiAgB7MoyWa3InuQpftgTHyY1hN14Z76sveT16xDi6Mg3\n23RCxNmYQnDMToz7BzH93SuurRx1HqWbyzhXZXvM9GkZInxDgeK4/3XnsWG9w7uP\nk6gvhHjghBH3ljKKO63Ghqi8fyBKY7DKVw2A33/Hx+meRrETsAY6lhSVuPY53SFJ\nm7fwFpsynMNzu75JuR2SWliXIxEV2uTmM5s5hiChD+1K3UkX/wgDekrCoDw6QAB3\nTg==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFzTCCA7WgAwIBAgIJAKLpZNb4FI0PMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV\nBAYTAkFVMRgwFgYDVQQIDA9Tb3V0aCBBdXN0cmFsaWExETAPBgNVBAcMCEdvb2R3\nb29kMSAwHgYDVQQKDBdBaXJsb2NrIERpZ2l0YWwgUHR5IEx0ZDELMAkGA1UECwwC\nSVQxEjAQBgNVBAMMCUFpcmxvY2tDQTAeFw0xOTA4MTExOTE3NDFaFw0yOTA4MDgx\nOTE3NDFaMH0xCzAJBgNVBAYTAkFVMRgwFgYDVQQIDA9Tb3V0aCBBdXN0cmFsaWEx\nETAPBgNVBAcMCEdvb2R3b29kMSAwHgYDVQQKDBdBaXJsb2NrIERpZ2l0YWwgUHR5\nIEx0ZDELMAkGA1UECwwCSVQxEjAQBgNVBAMMCUFpcmxvY2tDQTCCAiIwDQYJKoZI\nhvcNAQEBBQADggIPADCCAgoCggIBAJuor4jRqtwN0MLikzXAjCiSzSc8EbOq5jd3\nS7hWE6iE/dzqJzO7ESk/StrV1pkJtu2Uo4HJMC2AvOsrt1AObmKEHukFQpIUw7n7\nxrTqoJWdoXp8ZSfGSA60BpW3sCcUzKVfpR+OlZ7af6sXgX1CwYf4MujUFRqWAZzI\nKhKnAPR2nAE4ROH41tTbxyx+8BE4lPs18HZbrRlblNlLQFHW0wQ9LeAAHpdKnhM/\nfGLg01j6ghPFea5E6zLxp1APHkRcErKpyrmhPZ3mbymX306KyaGBx2kOHq5p4+ri\nUjcOF+5h9ZNB9kG1lmRjwBTjcHfmCEoUlIJ98DMlrkWJhyP3XPlgc/q0q1ycz6JZ\n3+DyCfNVdf7zpEFcaHKwf+EDCuNhDDnKMsp8MxtIMhiu6Jrh2i2fr6UUFDBm7JH9\nWGdSRtLcC2Pv/BFZlDfNGHm6hfF6JZ792SYcJpy1xA+B/kJHrzSCLzUbYsNFg4ku\nwSfdxECNPV6VzCZpz54RM9/BAzwmNEbcP5K52vHomXCDBUxqpzJiOXad1qUvs3mK\nepLJBS8HIUBNwdnfXiYX58T5bo42UE0Puo1rNqGQ69zz9MYAsXeNa5/JWBijpG29\nvFUMLXLCSQs0JuhqWo95T5K32kv8e6N9YONIbdA19cr9dTCKAlLuyC0lMvK4m4Sn\n+j4RjIhPAgMBAAGjUDBOMB0GA1UdDgQWBBQ5jDUvBNA7qIhBas+G9DIZCmDnBDAf\nBgNVHSMEGDAWgBQ5jDUvBNA7qIhBas+G9DIZCmDnBDAMBgNVHRMEBTADAQH/MA0G\nCSqGSIb3DQEBCwUAA4ICAQCMxVYwLUe2HWDrr/ptrXH4EAc84HRXPdMBPeKR83Jl\n/EhzfFoPnsvSY9PUrJMDP/nN7QA0lksakSJhiJ97YDtHJd3IKgPW+iGKbPpCOSGw\nqQf6V8ypgeCQpziBqJP/Td2yfdLM6D+lTFL5x1JQJH5hWCLPZLF0g4covfOxnJuM\n0Hn3tS3SxfgNzItx09BT2UTHjmD1aeCDd/f4i1qzVn7ak8/Efq0D3TMGOfCogPPm\nn3yhvwj17K4BwKsJ2IsWNAN8152Kq4FPqUo0vLy4Zv2fMcyzUyV9AszKpKqf7Kz3\n4KTsdeIcql1B0Q7FAsGGaqHYtQ7BOidukQLNN7qZW/Bd68gpHB95UIk2MU2M8kxt\n2caIYiY1prmQEzvtLzIHS6ISFCuaMssSLcK/DbAqYnkBs6m9BHqZPMfwg4c2B4/i\ngyE45z2/RACt01nxTyPcLLrmuX0w9QbH+wAGSjb2+vuHf0AGaSrrtAfgZyMzd/9H\nec+Ut63tUK0gUtAb3YqjrAoM1xqIYCPLDTxEOOeuixx5L4VMR49EpOv1xyPW7/8D\nCGN+Z2+eg8gQDUppMG4L/LZoN80tssGBH8ZAnJmlcm2DHq9GKlpqzGafGPWkV7Mk\n/eQHRm/6IE74PUZYKVQC1gVW7P70nWLoiABkTs2PgSE+yZ10YHZumu1XbAJQdzZ3\nHw==\n-----END CERTIFICATE-----\n\n"}],"_postman_id":"55b4cd99-7923-4c70-a42d-25dcc2106dcf"},{"name":"/v1/agent/move","id":"c04a7de1-727b-45c9-8ef5-29eae42901c0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"d007c30c-6cf9-42d6-90da-5a524b9045ef\", //(Required) Destination GroupID\r\n \"agentid\": [ //(Required) An array of agent ids or a single agent to move\r\n \"bd7f4b4e-7331-44ee-af7e-bc7aac101190\",\r\n \"2f7079f3-998a-4eb8-bdcc-28b29142d39e\"\r\n ]\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/agent/move","description":"

Move an agent within Airlock by specifying the 'agentid' you wish to move and the destination 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint and unique 'agentid' parameters can be obtained from the /agent/find endpoint. More than one 'agentid' can be supplied to move multiple agents in a single request within an array.

Download an Airlock enforcementagent by specifying the 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint.

NOTE: This REST API endpoint will respond with an 'application/octect-stream' content type, which is the Agent data in a response. When calling this endpoint, your remote script must be configured to detect this content type and write this data to file.

This endpoint returns the target filename in the response header. This can be used to write the file to disk with the intended filename. The response header content is Key: Content-Disposition Value: attachment; filename=\"AEA_[groupname]_[server name]-[discoveryid].msi /.rpm

(Required) groupid to download the Airlock enforcement agent from

\n","type":"text/plain"},"key":"groupid","value":"b4bac2e5-8a96-440f-b03a-6272206e3eb5"},{"description":{"content":"

(Required) Platform of the Enforcement Agent you want to download. 0 = Windows, 1 = Linux RPM, 2 = Linux DEB, 3 = macOS

\n","type":"text/plain"},"key":"platform","value":"0"}],"variable":[]}},"response":[],"_postman_id":"86a3c63f-0852-47b5-9507-71c19857b9f9"},{"name":"/v1/agent/remove","id":"b6be82be-3daf-4e25-8dce-a968c6336b05","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"agentid\": [ //(Required) An array of agent ids or a single agent to remove\r\n \"63924652-a642-4401-8630-527a77480b9e\",\r\n \"0d54f047-f221-4012-b005-723489bc9426\"\r\n ]\r\n}\r\n\r\n\r\n","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/agent/remove","description":"

Remove an agent registration from Airlock by specifying the 'agentid' you wish to remove. 'agentid' parameters can be obtained from the /agent/find endpoint. More than one 'agentid' can be supplied to remove multiple agents in a single request using an array.

Endpoints for interacting with installed Agents, allowing you to find, download Agent configurations and Agents, move Agents and remove Agents.

\n","_postman_id":"15455457-e91c-4631-83dc-8bb0d78e5d4b","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Baseline","item":[{"name":"/v1/baseline","id":"f1a64d78-67a0-4349-b52d-9875d5e6ce27","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/baseline","description":"

Returns a listing of all Baselines within Airlock, including their 'baselineid' and 'name'

Create an empty Baseline

(Required) name of baseline

\n","type":"text/plain"},"key":"name","value":"My Company Baseline Windows Desktops"}],"variable":[]}},"response":[{"id":"efdfb93e-ffc2-484d-a60a-63108e40c755","name":"/v1/baseline/new","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/baseline/new?name=My Company Baseline Windows Desktops","host":["{{Server}}"],"path":["v1","baseline","new"],"query":[{"key":"name","value":"My Company Baseline Windows Desktops","description":"(Required) name of baseline"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 12:24:56 GMT"},{"key":"Content-Length","value":"58"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"baselineid\": \"1714652696\"\n }\n}"}],"_postman_id":"fa22b313-4b79-44f5-bda2-5a950926dc21"},{"name":"/v1/baseline/delete","id":"8cfeb4da-5c47-4ee6-ba6d-a1ace7714f42","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/baseline/delete?baselineid=1714652696","description":"

Delete a Baseline

(Required) Baseline ID to Delete

\n","type":"text/plain"},"key":"baselineid","value":"1714652696"}],"variable":[]}},"response":[{"id":"e15621cb-a9e4-4e60-b67d-3d5fe4e64938","name":"/v1/baseline/delete","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/baseline/delete?baselineid=1714652696","host":["{{Server}}"],"path":["v1","baseline","delete"],"query":[{"key":"baselineid","value":"1714652696","description":"(Required) Baseline ID to Delete"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 12:25:30 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"8cfeb4da-5c47-4ee6-ba6d-a1ace7714f42"},{"name":"/v1/baseline/export","id":"1cd5f7f9-d7f6-4aed-8e5f-3108f829b36f","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/baseline/export?baselineid=1691110600","description":"

Export the contents of an Baseline by specifying the baselineid. The response will be returned in XML format

(Required) Baseline ID to export

\n","type":"text/plain"},"key":"baselineid","value":"1691110600"}],"variable":[]}},"response":[{"id":"2176f9d9-bed5-4de2-b8fc-2601d7239040","name":"/v1/baseline/export","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/baseline/export?baselineid=1691110600","host":["{{Server}}"],"path":["v1","baseline","export"],"query":[{"key":"baselineid","value":"1691110600","description":"(Required) Baseline ID to export"}]}},"status":"OK","code":200,"_postman_previewlanguage":"xml","header":[{"key":"Content-Disposition","value":"attachment; filename=\"CentOS 8.1 Minimal x86_x64 RTM (Reference).xml\""},{"key":"Content-Type","value":"application/xml"},{"key":"Last-Modified","value":"Thu May 2 22:00:30 +0930 ACST 2024"},{"key":"Date","value":"Thu, 02 May 2024 12:30:30 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"\n\n \n \n \n \n \n \n \n \n \n \n \n 2cbc98b3dd0f93ed9043e23cdd76d049ebf1b31de19b628eed8d505dd946205c\n 09c58ff6169460e366233cd1b3bc82f6489d2019\n 2c0e1a36d445bbdd84f158250085b9a0\n 2da06607c0958455886ecf62f616b3902896e14ef1750310e16f7228822a8c60bf10bf594bedec9403629500f30b02c6\n dde8bef944e174df2b454a6b9f58e8c6ed35f8a3e2b200b3ae944aa9f6a90a61bf57e3838d9dea9408487bcece8345bc511ed48d7ab6f398019840bb89fd16af\n 24712\n 0\n 1563858555\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n cf908ad35d6457e30f9ffd5a8c501b0ec631e5d06eefab405f80ce934708c4c9\n dfe0973caaa1eff7ba94b19d195dbee926fa0f0b\n c5c5b52287b556d931f76fc6190e8b0d\n 4a92526ba4de5e29d124603d2ee3431583bc828797e99c3f9c07abb16d88d09b6cd34f396fa71b216deee82892d5a639\n e6aded536ba72591c112e6deba3150d966cae04bc7a4f6b224741e21f26f14df218a85a068e6415ef8662bd0540a891ebfedb7dcb4fdd53be6b184565b271b63\n 25744\n 0\n 1559722740\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n d6fad6212f15e17c7d7249b86b0a3b342f9f5f8c3abdf577290f2192868813d4\n e579bfe0e63c2943491dfa926a11cb16c4834cf1\n f0efb4688180e7d514c71f27a7283d17\n b63d9289ed6b48ee1ac2dad177cfb5486d9bcadb53ec41c00eedebc37e14c31b4f0bdbbb0dd04da3339a7cc374951b4c\n f1d38bf8adc4ac9b9190955b0ccf7412552c5993e2be2254539721caafc03b673f3881b2c13448dadb1b924cea2e8ce819cfe40e99141bc84734e08034b82574\n 47512\n 0\n 1569059115\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n f71052d4f6ee906b3301d415808ca1531ab5b53168b344ee28f6538409cf6c5d\n 81bb3970e22f5644b628f02dfefe74134ecb1fce\n 4c4285dc12a083370fa17981e68b8f15\n 9a3eb2fd7720d3115b435ab5c1d50ae9ab24bebca623c9d94698c4800543447c2aeda9b434aceaf6289238f7f3c50efc\n db727e791e8ff9e7fe5883f88b97d54f9f64782c55b05950c5ef94846c8ffd819c15a8dbe8cb7c5138a4efe7d03ac39c5af2dcb773d8e34a162c3e5779af8cc1\n 29024\n 0\n 1565315455\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 9da7b7579a66af7f044513c14a8584ab40855e8d3113bfd6ae344de213624032\n f843ec67daef23ddd8261fa450bfaf2198125373\n c6654da5072550b9285e227f477fcf10\n 86fc121516b55875ea5259a4007214ca576ef94341330f2cb15fcc4d19aca6ea3d6e9801e1aea36c62918510d7967a58\n 3511ed4028ae08df9ca45cc2e37fda68afa851f862e7cd67a88791e3dc438ea1f006e1d6fdf435f9d04849773828bb428f542d600d59d67b15e3cc694cb51704\n 3222512\n 0\n 1558021404\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n d59317f3dfa52b5849e2a0b0ca988b68bf6679f577d3372ebd112c5155f74271\n 03154e87343b2b2033be0f795662113464a87b04\n 17e6ff8ee9da4b9ead03de46ced63618\n 0827daffe974e23092d4ee510f1798f44515f7e790793a40f35ec541133a245bf2719053d2af06c51d22fa4bb8145bec\n eb55d90ba182fafebad9c0ae84ad6c63d7e32b4304ae7527c0c7c79ca095687043c23dcce5ae79e1448fd8897f90a63a22f4094cfe807a6ba8307df66fd6a9ce\n 174\n 0\n 1539005913\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 410ba46b9d9a748508243a557ddd4369f351197890c52c3e3dc1bc37c0a7306d\n 1f86767657b755052ba6a6db054e53aa20d20dac\n 551ed9a594a70bb394ec7a6165229b6d\n 4a99737649b0f6503daacb6a325f89b5ab9a046fa5405c62548b45522d930dae1637cd7eb8c52d7c105485a561d074db\n 92b68eba5928d88eb312faf26053c010f4d3c74c131f100cbafbd2b0d6b10ebec8c6fb1178b349414078bf733fb10bf4558dbe538e074466721e61d1fef8eecc\n 29512\n 0\n 1544189758\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n f0cf9cc9bf50f09b2248903fcabd84362e88908b47090f3afee600253de7cea4\n 0fb5277723455dd506391eb9ffddc6a82889b623\n 0201214014a57da876f0a8b9fb07bc7e\n a467558b14a4e85fe2ff4a7938de29715a791c072d29ef3a9688ca73a52a821ae1f1f01d6fe0abfdb76f8dac117a7403\n 0f2071eb7a79452607dee700575a7e8dc06de18a17791a7eb413e210129dc0e09de22b73feaf3dd0b1d7d5ce5a0c48ca57afbdeb23f0c94ded845146ab6f373f\n 7768\n 0\n 1570806518\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n a8eb00b344a22a0cf3b270665e710586146c65f801ff937b562b8c824476961c\n cc4e1a4f9a3e97c2f6982dec3bc807606557f46a\n d066d6234eb57674f492025a893d2a61\n fae8a0f66aa1deef9c592186726a71ee076c8d0674980546c9ccc1bbacd66183a135d56b9c755310b49218ae4636cb62\n e10b33666f028db119759042973d0c0009a193e3acb03404e63ac20d52d1490ee148a693d83f2abca567c469bbe25f97226351f69009287fcb984bfc7f7d7444\n 326200\n 0\n 1567598756\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 6cc87c6d64bd09450f8078b0a9276944cc0a3bc96b6a5a1c8601c2748e171b21\n ec5bb09bafa9889ca32550420647a738b7763b80\n e8c5cb185a0b6f40a97c15e3642d6de9\n 5148cdb4e28bf708779288ca02d9f300797d59ea931f684ce01f6bd69d3b6d4a107a5375ace80a05ee86a219990d0d04\n 723e098f85857dcbe84773ae936845e31d466426c5d117b8ea9d3829631546f3124a0e47c472a047ef88e405fe391a60a15b53578e9a0e93e514daec4e269dfb\n 58664\n 0\n 1547219747\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 3f5fda24735e73b7703c4432028c5c63d495ab6837cc5926da8972e9969890b4\n 47d49fb6a77aec5666963fe077586afa0c68a756\n db9be925fa7ec745a7f97ad8a23cbbee\n 7d3b4dba68c445b00d62bd89a746e0acac1cc9175224a4603383bd33d0bf7d0ff24a3e2bfce65255f314c83e228e6adb\n 109e70757fe98c8e77980968823974d827aa2274c8ce00c94eb8a29103cd9f5b286ddf3b8d22352b3e32dd4460a5f7836eb2756c2f491982e7622a14ec5d23bf\n 26392\n 0\n 1559053605\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n abd90c56dd5fae54cc69a0fd38fac5ec1c2d242159b6371b7c3931d9d7b1e255\n 1b9f0c882068110ae942de2af81affaa0c83f94b\n f0b6ad7ce5be3c8412b08d1c78e28dad\n cc37df34745cafc116cc80b57385f6051b9324ef0bbc2274bc6a3df22b15df3febe2dd87936d4dfa918a13a727191736\n eabcb2c2cfdc811d2a65c27afa8d68306ae917d62d8f0fe707399f3c02ce20c101fb90372dfa7436794b3672360690f2832275daeafcc0b72cda85af995a31e5\n 2408\n 0\n 1569518311\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 3c31b69e6bf939eb5d7519be4608ffc97d71f5b18a736c5ca92457b7fd0ad156\n 00e6f123ab8d01a7c7b424313e99be21ab72b90f\n 72ff43707e03f63c55a5e32e35cd824a\n 63d39cb5168bbc09f10302ee7bdb0e122a94e8c742206e36533e8a5de50af22905241b5151e8ac34da59be41aa2f5d7f\n 0699319cb00d8130e3d17b6977c3b95092d87c8d1473cf1949109f466d8ad4c00c0116bd49a0384e2b057c759f61cce75e94751536d0798ceab0e1509749a25b\n 55584\n 0\n 1539070911\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n caf7038739f7d6eaf64f2918fed68c69eee0bd6762be861cb42263765b13a4b5\n 91d2250ee6c84284980ea046d27360fde51eb35e\n 8b1841ad9586fbefe0d5ad786eac1691\n 6fbb66e750a0b57fa79503bcb5ceb809cc408abebe6910f5a27f3ff1e318dea788e9f4958fff19ea9aa1e405624beee9\n e0829500527a5997890b44fbce09c0354120bc06147a02dd7a2218fdf805365a2b04cd5cac19a64f547649708c6642bb4b08759609c5b59cf604190acd83d04c\n 424712\n 0\n 1559332931\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n"}],"_postman_id":"1cd5f7f9-d7f6-4aed-8e5f-3108f829b36f"},{"name":"/v1/baseline/reference","id":"3a34ac6f-ab09-4abe-ba47-35bf59d8bbe8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/baseline/reference","description":"

List Reference Baselines

Import Reference Baselines

(Required) Name of reference baseline

\n","type":"text/plain"},"key":"name","value":"macOS Ventura-13.0-M1-November 2022.tar.gz"}],"variable":[]}},"response":[{"id":"5779c83f-08b2-46bc-976a-3e0f4f6e7fd7","name":"/v1/baseline/import_reference","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/baseline/import_reference?name=macOS Ventura-13.0-M1-November 2022.tar.gz","host":["{{Server}}"],"path":["v1","baseline","import_reference"],"query":[{"key":"name","value":"macOS Ventura-13.0-M1-November 2022.tar.gz","description":"(Required) Name of reference baseline"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 12:34:04 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"a92bc90c-dffe-45c6-a196-88f0fb8ea9ad"}],"id":"41083139-73d5-4ee7-8c94-dcbcfb0c7a9c","description":"

Endpoints for interacting with Baselines, enabling the creation, deletion, exporting and management of Reference Baselines.

\n","_postman_id":"41083139-73d5-4ee7-8c94-dcbcfb0c7a9c","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Blocklist","item":[{"name":"/v1/blocklist","id":"768f249e-c802-423b-a177-5119756bd195","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/blocklist","description":"

Returns a listing of all Blocklisting packages within Airlock, including their 'blocklistid' and 'name'

Create an empty Blocklist package

(Required) Blocklist group name

\n","type":"text/plain"},"key":"name","value":"My New Blocklist"}],"variable":[]}},"response":[{"id":"76deec0e-c8a6-4be0-b7d1-cc120e2e6b4f","name":"/v1/blocklist/new","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/blocklist/new?name=My New Blocklist","host":["{{Server}}"],"path":["v1","blocklist","new"],"query":[{"key":"name","value":"My New Blocklist","description":"(Required) Blocklist group name"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 12:37:25 GMT"},{"key":"Content-Length","value":"59"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"blocklistid\": \"1714653445\"\n }\n}"}],"_postman_id":"6cb03f93-4538-4c60-b21a-fc7d91a940fa"},{"name":"/v1/blocklist/delete","id":"75ff08c9-5e11-473a-9378-adbc0fcffb63","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/blocklist/delete?blocklistid=1618288066","description":"

Delete a Blocklist package

(Required) Blocklist ID to delete

\n","type":"text/plain"},"key":"blocklistid","value":"1618288066"}],"variable":[]}},"response":[{"id":"779da34e-eeaa-4a05-addc-dcc0f16a5fe0","name":"/v1/blocklist/delete","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/blocklist/delete?blocklistid=1618288066","host":["{{Server}}"],"path":["v1","blocklist","delete"],"query":[{"key":"blocklistid","value":"1618288066","description":"(Required) Blocklist ID to delete"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 12:39:32 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"75ff08c9-5e11-473a-9378-adbc0fcffb63"},{"name":"/v1/blocklist/export","id":"90c6bf34-ee39-451b-81af-3a5ec2628b30","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/blocklist/export?blocklistid=","description":"

Export the contents of a Blocklist by specifying the blocklistid. The response will be returned in XML format

(Required) Blocklist ID to export

\n","type":"text/plain"},"key":"blocklistid","value":""}],"variable":[]}},"response":[{"id":"9e441254-11d2-4306-b27d-ef3bb2d198f2","name":"/v1/blocklist/export","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/blocklist/export?blocklistid=1616643093","host":["{{Server}}"],"path":["v1","blocklist","export"],"query":[{"key":"blocklistid","value":"1616643093","description":"(Required) Blocklist ID to export"}]}},"status":"OK","code":200,"_postman_previewlanguage":"xml","header":[{"key":"Content-Disposition","value":"attachment; filename=\"Microsoft recommended block rules (main).xml\""},{"key":"Content-Type","value":"application/xml"},{"key":"Last-Modified","value":"Thu Nov 21 16:59:54 +1030 ACDT 2024"},{"key":"Date","value":"Thu, 21 Nov 2024 06:29:54 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"\n\n \n \n \n 1616643093\n \n \n ac6b35c904d388fd12c07c2f6a1a07f337d31895713bf01dcce7a7f187d7f4d9\n \n \n \n \n \n 5af75895bdc11a6b68c816a8677d7cf9692bf25a95c4378a43fbde740b18eeb1\n \n \n \n \n \n a0c71a925850d2d481c7e520f5d5a83305ec169eea4c5b8dc20c8d8afcd8a512\n \n \n \n \n \n 7bf44433d3a606104778f64b11b92c52fc99c4ba570c50b70438275d0b587b8e\n \n \n \n \n \n c3a5dab20947ca8fd092e75c25177e7bae7884ca58710f14827144c09ea1f94b\n \n \n \n \n \n 6c96e976dc47e0c99b77814e560e0dc63161c463c75fa15b7a7ca83c11720e82\n \n \n \n \n \n \n \n \n \n \n \n \n origname\n match\n AddInProcess.exe\n AddInProcess.exe\n \n \n \n \n \n \n \n \n \n \n origname\n match\n AddInProcess32.exe\n AddInProcess32.exe\n \n \n \n \n \n \n \n \n \n \n origname\n match\n AddInUtil.exe\n AddInUtil.exe\n \n \n \n \n \n \n \n \n \n \n origname\n match\n System.Management.Automation.ni.dll\n System.Management.Automation.ni.dll\n \n \n \n"}],"_postman_id":"90c6bf34-ee39-451b-81af-3a5ec2628b30"},{"name":"/v1/blocklist/metarule","id":"7f948dad-f5ab-46df-990a-6a46360ced72","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":" /*\r\n * POST /v1/blocklist/metarule - List Blocklist Metarules\r\n *\r\n * Returns all metarules for a blocklist with optional criteria details.\r\n *\r\n * ============================================================================\r\n * REQUEST BODY / QUERY PARAMETERS\r\n * ============================================================================\r\n *\r\n * blocklistid (string, required) - The timestamp ID of the blocklist\r\n * include_criteria (int, optional) - Include full criteria in response\r\n * 0 = Criteria count only (default)\r\n * 1 = Include full criteria details\r\n *\r\n * ============================================================================\r\n * EXAMPLE REQUESTS\r\n * ============================================================================\r\n */\r\n// Via JSON body\r\n{\r\n \"blocklistid\": \"1752869448\"\r\n}\r\n// Via JSON body with criteria\r\n{\r\n \"blocklistid\": \"1752869448\",\r\n \"include_criteria\": true\r\n}\r\n","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/blocklist/metarule","description":"

List Blocklist Metarules

\n","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}},"urlObject":{"path":["v1","blocklist","metarule"],"host":["{{Server}}"],"query":[],"variable":[]}},"response":[{"id":"c5bee704-17e3-4c73-be20-5befaccbeb60","name":"/v1/blocklist/metarule","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":" /*\r\n * POST /v1/blocklist/metarule - List Blocklist Metarules\r\n *\r\n * Returns all metarules for a blocklist with optional criteria details.\r\n *\r\n * ============================================================================\r\n * REQUEST BODY / QUERY PARAMETERS\r\n * ============================================================================\r\n *\r\n * blocklistid (string, required) - The timestamp ID of the blocklist\r\n * include_criteria (int, optional) - Include full criteria in response\r\n * 0 = Criteria count only (default)\r\n * 1 = Include full criteria details\r\n *\r\n * ============================================================================\r\n * EXAMPLE REQUESTS\r\n * ============================================================================\r\n */\r\n// Via JSON body\r\n{\r\n \"blocklistid\": \"1752869448\"\r\n}\r\n// Via JSON body with criteria\r\n{\r\n \"blocklistid\": \"1752869448\",\r\n \"include_criteria\": true\r\n}\r\n","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/blocklist/metarule"},"status":"OK","code":200,"_postman_previewlanguage":null,"header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 21 Dec 2025 03:34:26 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"metarules\": [\n {\n \"criteria\": [\n {\n \"criteriaid\": \"94d4da73-d298-4d94-9f9e-106def059797\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"asmmap.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"8a995f2f-d993-4f4d-8ebb-c5835cd80129\",\n \"name\": \"ID_DENY_ASMMAP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"fb94c0c3-71e4-4649-98a1-f90faff23d1b\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"asmmap64.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"527e84a6-e9e6-4070-b038-fb3fb5d1b5a7\",\n \"name\": \"ID_DENY_ASMMAP_64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"e777a201-abbf-4632-9ef7-a98824af1393\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"dbk32.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"fa904fb2-bf6c-485b-b978-79cdd014ffe8\",\n \"name\": \"ID_DENY_DBK_32\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"929be42a-af7e-4b29-8987-335abbea6b43\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"dbk64.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"e25049e1-3cd0-4847-94b1-6ec97eb2c862\",\n \"name\": \"ID_DENY_DBK_64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ff5f802f-8d18-4498-a8e0-8f16e0af5db3\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"gdrv.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"25212d97-e389-43a6-b41b-927433ddd72f\",\n \"name\": \"ID_DENY_GDRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"497dfef7-a602-45b6-a5db-4c86d53fa54b\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"PCHunter.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"055eea4b-867a-4916-bec4-94b0795cd6c5\",\n \"name\": \"ID_DENY_PCHUNTER_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f266d555-b761-4bfe-9238-6a32ff4f2317\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"安全专用\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"a7ca2996-58c2-4bbf-844c-0eb30f61f383\",\n \"name\": \"ID_DENY_PCHUNTER_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"23a2ad2b-0419-4a40-b882-3ee05cda79da\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"phymemx64.sys\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"f04d33bd-1504-48a9-9130-cbafba6900cd\",\n \"name\": \"ID_DENY_PHYMEMX_64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4b1d4c1e-6fd0-488a-9a9f-c5fd73b39e5c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"d6b058d7-fb31-4707-9d79-83a0831df2dd\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AODDriver2.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"835005f7-c7a9-4664-9b7c-80be4561e2ed\",\n \"name\": \"ID_FILEATTRIB_AODDRIVER_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"e2e1c187-fa85-4286-9961-1f646483997e\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"053550eb-1b52-49f4-85c5-bff558c49d1a\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AODDriver.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"71ab4ca1-b1ac-4577-9e24-53259ca66a7d\",\n \"name\": \"ID_FILEATTRIB_AODDRIVER_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"0977c7e8-9f88-44f9-865e-3d5abf0d779f\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"65f11e52-7a67-469f-92c5-604a76939c3c\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AsrAutoChkUpdDrv.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"55c89479-6750-4917-b8af-a5cc0896ce52\",\n \"name\": \"ID_FILEATTRIB_ASR_AUTOCHECK_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7b7dad2e-53b2-4741-9bb1-0e70d7703811\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"f19d887a-e522-4603-ade3-b6ee8a470be5\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AsrAutoChkUpdDrv_1_0_32.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"94411a97-1ed8-42da-a0e6-69c3f52c7f7a\",\n \"name\": \"ID_FILEATTRIB_ASR_AUTOCHECK_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c35bdcd0-642c-42fb-91fc-fcae549733e2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 | 4843a82ed3b1f2bfbee9671960e1940c942f688d | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 47f4b9898631773231b32844ec0d49990ac4eb1e\"\n },\n {\n \"criteriaid\": \"2c3b77fa-7aa8-4343-9cf0-0e22b4f96479\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"atidsmxx.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"8b24bc4a-275b-425b-a01b-af0d1802553a\",\n \"name\": \"ID_FILEATTRIB_ATIDSMXX\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"bc969696-523b-4623-93a7-fb9bce6eb1a3\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"6fc79a3c-be92-48ec-8281-ece51e7fda16\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"atillk64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"efd8698c-c6d8-4832-8667-9f203fa78349\",\n \"name\": \"ID_FILEATTRIB_ATILLK\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cdd737a7-8e13-41cc-bf43-c4bbfc47b880\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"524818b5-86bd-461c-bc97-d2f250eb0f9a\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"atlAccess.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"fe2e9106-d473-40ae-90db-d04f2d7aca1a\",\n \"name\": \"ID_FILEATTRIB_ATLACCESS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1c2c58e3-ea7e-4c8e-b757-845323aa4fb1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4cdc38c800761463749c3cbd94a12f32e49877bf\"\n },\n {\n \"criteriaid\": \"eb5974b2-dc85-4e24-9276-759c05d10ca9\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ATSZIO.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"86da57a5-0947-49fc-b52f-1f47baf9e0f5\",\n \"name\": \"ID_FILEATTRIB_ATSZIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"78eaa85f-77bc-45cc-8767-8ba368aae3e1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"1dd84897-c5c5-42c9-bf09-d4c64d363289\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AVALUEIO.SYS\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"ad208b9d-51d6-4112-91f8-c62eb9c94c6d\",\n \"name\": \"ID_FILEATTRIB_AVALUEIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"6dc4250a-7359-447c-9ae7-f07df430e56c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"8564624c-7bb3-46ca-98c8-b66627048515\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Bs_Def64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"61b3b9c7-78e5-418d-b2da-7f899c05e717\",\n \"name\": \"ID_FILEATTRIB_BS_DEF\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"565835a0-4fee-4dfa-b943-46bdd6816677\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"a7baaa0e-1c75-4472-96bb-220fa74a7af9\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Bs_Def.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"33518f13-cba3-4a46-b2c9-8e72f330834b\",\n \"name\": \"ID_FILEATTRIB_BS_DEF_64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"64ba18e7-f116-49bf-9126-618d23940bb8\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"88ed03ab-558c-4f1b-982f-504b36e7ac06\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BS_RCIO64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"5cf76e87-4c57-426b-9ef7-e74f20566a4e\",\n \"name\": \"ID_FILEATTRIB_BS_RCIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"66ef3d35-6815-4601-baba-58018b183223\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"740af5ad-00d4-4316-b4d7-b111f0aac803\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BS_RCIO64_W10.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"da41a3a8-5fc7-4752-99d9-a1c8223bce6e\",\n \"name\": \"ID_FILEATTRIB_BS_RCIO_W10\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"afdb7b46-6d59-43e5-b237-1b65f4bbe97c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"bea7e072-32dc-425d-a76e-469c185d7e79\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cg6kwin2k.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"9c3145d9-14a4-497b-b9e0-1555c8626b92\",\n \"name\": \"ID_FILEATTRIB_CGWIN\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7422356c-efa7-41a9-9444-d1f54ce2432a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"3bdf9783-e49c-4ad0-bf18-925cb4680359\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ComputerZ.Sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"62c2f38d-badc-46c8-ab28-054d8617fe5a\",\n \"name\": \"ID_FILEATTRIB_COMPUTERZ\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"fa2ce095-003e-41e7-9a47-cb66c20c12de\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"e5b18493-9070-4359-81bb-1a7ad3c92cbd\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"CP2X72C.SYS\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"64c05815-862b-46e4-ad25-f0aeb4e58003\",\n \"name\": \"ID_FILEATTRIB_CP2X72C_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7a48a5a6-4037-4f25-86a5-3c3d2a8532ea\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"a8d1ce0b-e027-4cda-962c-5e1c7ac66c06\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"CP2X72C\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"e33711b1-3e48-4ad6-9168-67ff51430bfe\",\n \"name\": \"ID_FILEATTRIB_CP2X72C_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f6891397-4906-48aa-9144-8140c702a740\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4cdc38c800761463749c3cbd94a12f32e49877bf\"\n },\n {\n \"criteriaid\": \"27dae380-4a0f-4279-a606-e9cf99ebe14d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Driver7\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"a3d9afd3-373c-4534-8d43-205802457703\",\n \"name\": \"ID_FILEATTRIB_DRIVER7\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"bd4c6e45-b26d-4b42-9c90-998e08f8bb92\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"879269f3f467a6d59641960a62fe9cb419355ff6\"\n },\n {\n \"criteriaid\": \"49352b57-7191-4f5d-8a49-7d7b7c6ecc68\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ECSIoDriver.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"dfb93a44-c3b3-424f-83d4-bd29fee8b6ec\",\n \"name\": \"ID_FILEATTRIB_ECSIODRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9d39e8c6-546a-4c8b-b197-9321b684910a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf\"\n },\n {\n \"criteriaid\": \"c756b427-17c7-479e-886f-6dc5810bb2f8\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"EIO.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"4d65b310-a2ec-42b7-81d3-600f2240857e\",\n \"name\": \"ID_FILEATTRIB_EIO64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7cbe34fc-d547-4a86-aa2d-f568b24ca91b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"a249a924-c1e8-4535-a2e1-15839dc78dd5\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"FPCIE2COM.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"8f6a2b81-200c-47c9-b2ac-cb015b29726c\",\n \"name\": \"ID_FILEATTRIB_FPCIE\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2a74174e-400e-44e9-9ea3-e90c1101565d\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"15875e14-b644-498b-a0d4-b4e9636de9e8\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"gdrv.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"a97998e9-f785-4335-b165-942b30a33e48\",\n \"name\": \"ID_FILEATTRIB_GDRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"daf3b76e-8b96-4cce-8b45-41f8baf87062\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589a7d4df869395601ba7538a65afae8c4616385\"\n },\n {\n \"criteriaid\": \"bbb90ce4-e802-4201-b30e-2a984d42c615\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"gmer64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"55eba191-6696-4466-9427-0da34f70e300\",\n \"name\": \"ID_FILEATTRIB_GMER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"211f5542-17b6-41fc-8551-8b462d3f53c9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"041750993d7c9e063f02dfe74699598640911aab\"\n },\n {\n \"criteriaid\": \"2bb6ab94-ff1f-4cfc-964b-2e7e2de86309\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"hwdetectng.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"fa885251-6fd3-4a97-ae73-5682525ff123\",\n \"name\": \"ID_FILEATTRIB_HWDETECTNG\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"76db7647-2e8d-4044-9bd5-bff9de4b47e7\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 4843a82ed3b1f2bfbee9671960e1940c942f688d | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"066de0d6-f0fd-4a48-adc8-8292eed69c6d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HwRwDrv.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"3721df37-3fd5-4c04-9a7a-523d4a99c714\",\n \"name\": \"ID_FILEATTRIB_HWRWDRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4d17de9e-ed3a-426f-b5bc-5833beb0253a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"9e5930df-47d7-40fd-805d-240b4dd0f7ba\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"iomem.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"d035d569-40ea-427d-bb4e-8897aa1b350a\",\n \"name\": \"ID_FILEATTRIB_IOMEM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c82edb59-c3fd-437b-a9ab-bbe415e519a5\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"0a5d5e00-ea21-4163-a28f-7e70a7fd9b66\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ItlsFFN.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"80ed8d48-f308-4062-bfa8-22ec7f16dd44\",\n \"name\": \"ID_FILEATTRIB_ITLSFFN\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"abef5f80-7d60-4dbf-a0d5-93cf422c7a74\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"ee191a62-4593-455a-94d5-56204c118fff\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"kEvP64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"d9c54c76-7ac7-4519-8ede-a5f2dba8cd26\",\n \"name\": \"ID_FILEATTRIB_KEVP64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"38375907-9df3-4035-99b8-dd780595912b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"43890d6a-7d2c-4703-9ba2-d9a80befd1bb\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"LDiagIO_legacy.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"81b20b57-07bc-4dcd-8d4a-396d9db39540\",\n \"name\": \"ID_FILEATTRIB_LDIAGO_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"26b6f0b4-10a5-4dcc-a4a9-ac4d05c7b878\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"2d0edcda-757d-41ab-be81-43d16ea10936\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"LDiagIO_uefi.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"1be70902-8038-4a07-aa8b-b253759dcc15\",\n \"name\": \"ID_FILEATTRIB_LDIAGO_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c8be4e56-1294-44f1-b03b-942858edfa8c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 7f25cbd37dcdc0e0d93e0d477c4bc0c54231379e6caf1023841e1f0d96467a6c | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 7f25cbd37dcdc0e0d93e0d477c4bc0c54231379e6caf1023841e1f0d96467a6c\"\n },\n {\n \"criteriaid\": \"bf11c287-675e-4822-a634-5194ce6a39fe\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"LDiagIO.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"e91de97a-f56f-4510-ac08-41e8677d9018\",\n \"name\": \"ID_FILEATTRIB_LDIAGO_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"32841988-8c6c-4359-bfdb-788b4b404a36\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"a772f9ec-7869-4e66-a3b7-4a146071025d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"LgCoreTemp.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"a3e0d4fa-f7e5-4fe7-9190-c3102c728042\",\n \"name\": \"ID_FILEATTRIB_LGCORETEMP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"269cdb7b-961a-4373-858a-be2c50b885c9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"1e2b3d81-820a-4d17-ad2c-bccde665e18b\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"LHA.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"3873f4ad-5bfc-454a-a2fc-f73526746e5c\",\n \"name\": \"ID_FILEATTRIB_LHA\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"a74a6a90-69e7-4a59-a3c6-42a77dab35b4\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"89e51d88-2d16-4c8f-8308-3fc5fe1d28e0\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Lv561av.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"7af5424b-2cb3-4a2b-a1e4-63057620e37e\",\n \"name\": \"ID_FILEATTRIB_LV561V64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9ab1e860-de80-40d3-93bb-8b71618d5762\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64\"\n },\n {\n \"criteriaid\": \"58fc5bd9-9f06-49fd-8821-f9c82eaeb8c7\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"MsIo64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"cd949c70-b158-46eb-ab8d-61570ee2eadf\",\n \"name\": \"ID_FILEATTRIB_MSIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"288e8329-550f-4889-83c5-28d0812f9209\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d | bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"bdb11eca-dbdd-486c-bc19-748fbbbf2d98\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"mydrivers.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"53ca0dfc-1191-4f14-b5bb-82b9a63ac4cc\",\n \"name\": \"ID_FILEATTRIB_MYDRIVERS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d46e4de6-c4d3-49a8-b47f-6fa16e2a504e\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"1d7e838accd498c2e5ba9373af819ec097bb955c\"\n },\n {\n \"criteriaid\": \"351a6e91-dc9a-4aa2-92d5-8f91733a5bee\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ngiodriver.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"d325835d-f9ee-40b1-8330-b2d7f03b9b76\",\n \"name\": \"ID_FILEATTRIB_NGIODRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"3c4c88e4-fd8f-4328-9ea8-d2da47d7dc3d\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"041750993d7c9e063f02dfe74699598640911aab\"\n },\n {\n \"criteriaid\": \"d0dd642f-3fb2-484f-b41f-cdf7d433e1eb\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"OpenLibSys.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"00c7f9f1-37e1-4ced-8a5d-ceea6b1db59d\",\n \"name\": \"ID_FILEATTRIB_OPENLIBSYS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"39d1ac4d-cce7-4f1c-aeff-ac06139d6892\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"62292bea-259b-489f-8894-3bbdfa3339de\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"phymem.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"f98e20ab-8ec1-4f2c-b9d3-2c318391c982\",\n \"name\": \"ID_FILEATTRIB_PHYMEM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"35e6232b-b480-4b69-9894-5d47dcdd6b95\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589a7d4df869395601ba7538a65afae8c4616385\"\n },\n {\n \"criteriaid\": \"c42f856c-d7eb-4493-846c-b19983e9565f\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"physmem.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"f14edab8-7883-415e-90f2-31441011671b\",\n \"name\": \"ID_FILEATTRIB_PHYSMEM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"83a001be-3ec2-4961-b7a7-f5fd01d366fa\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"bcd6e8e3-5bf6-44d5-9dac-09e453a809c0\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"RadHwMgr.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"54f765a2-67af-4a58-b145-815bd01d0f28\",\n \"name\": \"ID_FILEATTRIB_RADHWMGR\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"70d23757-e60e-42d0-aad9-437ff372fef2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | 4cdc38c800761463749c3cbd94a12f32e49877bf | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"93396107-33d8-451d-9ca8-86e8419c920a\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"rtkio.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"f674eeb8-09ec-4712-805a-2e6397ea1fbe\",\n \"name\": \"ID_FILEATTRIB_RTKIO_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b3352e66-44d5-44d9-ab34-ff090f0ebe62\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | 4cdc38c800761463749c3cbd94a12f32e49877bf | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46\"\n },\n {\n \"criteriaid\": \"f4b9cc89-5da2-4297-ba9b-1a995be1e0f8\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"rtkio64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"6b52c12d-b470-49a6-ad85-5771766b0b94\",\n \"name\": \"ID_FILEATTRIB_RTKIO64_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4b69373a-ee15-4fe7-b3eb-178a46cd201a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75\"\n },\n {\n \"criteriaid\": \"6227c050-39cc-41f8-a504-5fed94b73d53\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"rtkiow8x64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"3f208c26-d2ad-447d-ba29-a185206cc9d2\",\n \"name\": \"ID_FILEATTRIB_RTKIOW8X64_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"739bc468-8eb3-4110-9d12-66f0dfcecba2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"668b4eee-3661-4a8f-8c15-4ee08e78311d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"rtkiow10x64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"8a10b75d-8795-4ac1-bda6-06e31b3454af\",\n \"name\": \"ID_FILEATTRIB_RTKIOW10X64_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"24b496eb-d138-4241-8f62-57ff0fbdb43b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"80ef1e17-7360-4b60-b74d-750726e34014\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"rtport.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"a103f121-a52d-47b9-88e1-9de90099aeb1\",\n \"name\": \"ID_FILEATTRIB_RTPORT\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"08e8d2f6-d35a-4897-af45-f01bdfb1c53b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"99d39188-927b-4bc2-9b4c-c22dc53e49b7\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"RwDrv.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"7d3e341b-1a71-4b01-bd84-78ec2805a5b7\",\n \"name\": \"ID_FILEATTRIB_RWDRV_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"5c1d2aa5-3b8a-451a-a6c1-caf17d245084\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"8e4cf139-8086-45e9-a7e2-feb6aca1cbac\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Rzpnk.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"2e24a49e-fad2-45d7-a2f2-4875154237e3\",\n \"name\": \"ID_FILEATTRIB_RZPNK\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"df635d20-0877-4037-9f19-3f36501bd991\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d | 4678c6e4a8787a8e6ed2bce8792b122f6c08afd8\"\n },\n {\n \"criteriaid\": \"7769ff88-ba03-4beb-b592-0cab38e90183\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"sandbox.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"e01d0f20-5ff4-4014-af95-f96ef7e855e8\",\n \"name\": \"ID_FILEATTRIB_SANDBOX_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"8d14fa79-a9ed-4990-9809-87959ae9d313\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d | 4678c6e4a8787a8e6ed2bce8792b122f6c08afd8\"\n },\n {\n \"criteriaid\": \"1bca05be-50a3-4b0e-8967-666ca9c70832\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SandBox.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"27f6e1ad-d9c6-499a-a39f-6f80f30b6e88\",\n \"name\": \"ID_FILEATTRIB_SANDBOX_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9b5d737b-dacb-4bab-81db-554bfb71e3a6\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"8b0fc5ed-b14a-4862-8d96-ff37b26d43aa\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SBIOSIO64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"df6205dd-eaf4-4a10-a5bc-81ca83bc157b\",\n \"name\": \"ID_FILEATTRIB_SBIOS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"63b66e41-d82e-404b-ab5f-e330d59860a8\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"239c558b-7f00-49a8-9d1a-087fe7fb3aef\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SMARTEIO64.SYS\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"cdafdfed-0411-4533-ae45-17a2dcd6ceeb\",\n \"name\": \"ID_FILEATTRIB_SMARTEIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ee1d4c59-2099-443a-9ef3-3ca3f7714d32\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"f56832bc9412c372f9a8744591258f8bb11af2d8\"\n },\n {\n \"criteriaid\": \"c0c0f004-ca76-471b-80d9-eee2de267572\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"stdcdrvws64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"3863bbca-bbf4-415a-ba09-371416f0f67f\",\n \"name\": \"ID_FILEATTRIB_STDCDRVWS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"e0864faa-c1f4-406c-953e-1b12475b3ed8\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"191eb6de-febc-4d7d-86ce-8831ade3c32e\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysInfoDetector.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"782d3c02-c39a-444a-a4ab-7c981ce0b4ac\",\n \"name\": \"ID_FILEATTRIB_SYSDETECTOR_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1085eff3-31bd-4164-979e-20199c92abca\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"1ec0e197-3174-4788-9ce5-4c74957f40a6\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysInfoDetectorAEx64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"dd4718a6-18fd-43ae-bc38-c8119c2e8e04\",\n \"name\": \"ID_FILEATTRIB_SYSDETECTOR_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cbe8534d-9de6-4dba-bc7d-9b102d8095fc\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"488e13c9-e6b6-4f62-9205-4d6dcc11b7e4\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysInfoDetectorX64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"d4fe910a-dbed-417d-b38e-fa9ba9fc7958\",\n \"name\": \"ID_FILEATTRIB_SYSDETECTOR_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"12318de6-d39c-447e-841e-2723e481d3a9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"8fd4b551-c53e-4302-ab91-51a2917366f7\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysInfoDetectorProX64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"c5e63680-09f2-4ac3-90bf-a6daadab701d\",\n \"name\": \"ID_FILEATTRIB_SYSDETECTOR_4\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cb810ad2-dd48-4921-94b8-5e8023c02ca5\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"d80900b3-d012-4c20-b7b3-fb518150bf1e\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysInfoDetectorAE.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"1f6c9a75-e811-46af-b968-8f2dcf66314f\",\n \"name\": \"ID_FILEATTRIB_SYSDETECTOR_5\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9c75703a-b1d6-4ed1-87f3-568a1f055754\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"f3ebb73d-c713-4425-b8d1-13e5f63286ee\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysInfoDetectorPro.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"a2c0dbfe-e518-4a00-9f6d-eac56d1c4e6e\",\n \"name\": \"ID_FILEATTRIB_SYSDETECTOR_6\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f19d18a2-973a-4c25-9a64-c84c2c71d244\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"54f20e3c-a917-40ef-a1c2-43a42c977f68\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"VdBSv64.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"1624e705-1fa5-4aa9-8bdb-726b67279d97\",\n \"name\": \"ID_FILEATTRIB_VDBSV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7b976fb4-0cd1-41ad-ba55-c90f64762f49\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"46748b85-87cd-4998-8ed0-de145004f19e\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"CPU Driver\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"22bd5817-d726-497b-a104-7ecfb4bc7307\",\n \"name\": \"ID_FILEATTRIB_WCPU\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"51cf0038-a79c-4e8c-91f5-d1b96917497a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"562937f2-e7ec-4b08-9313-e237fa1aef98\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"WindowsKernelExplorer.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"8680e2ba-b7a4-4936-94ab-ab7febf558bf\",\n \"name\": \"ID_FILEATTRIB_WINKERNEXP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"65466e8d-5343-49ca-aa2c-3d17acbdc42a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"452eb9ba-cc45-42d1-8d5c-552992c49259\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"WiRwaDrv.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"152c3179-8318-4d21-8957-14b041a416c3\",\n \"name\": \"ID_FILEATTRIB_WIRWADRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1d4d2839-8f90-4aec-aa4a-f2522736fc48\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"880dc21b-99d3-4719-891e-06df69cc24de\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"WiseUnlo.sys\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"1c9ed564-d905-47a7-b062-3d57e97f8455\",\n \"name\": \"ID_FILEATTRIB_WISEUNLO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ce4cf527-d159-4fa3-91b5-81cad62812b9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 121af4b922a74247ea49df50de37609cc1451a1fe06b2cb7e1e079b492bd8195 | 1d7e838accd498c2e5ba9373af819ec097bb955c | de1da11668f0a8d5e13346ed3ab2755f5d25bebffcfd1d0bde5b9f87bc292c91 | 8de6eae4e1479f02dc58281ad5c035e629345ff74a177e559192d03bd23e0f9f\"\n },\n {\n \"criteriaid\": \"e0f63e07-e5d1-4112-b5d5-2f201017b430\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ZAM.exe\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"ec1ee095-fa72-4add-9179-96e4610502b8\",\n \"name\": \"ID_FILEATTRIB_ZAM_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"99985fa5-e9dd-4dcf-82b0-6bacf8458c7d\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 4805a7e23d6c8ff5e149f197b744bcb2346e73f19a48835a2f64129183981109256b75ea371a331746d01fd4e135ab6e | c45627b5584bf62327df60d6185744a2d2f2bcbf\"\n },\n {\n \"criteriaid\": \"66810df6-cfb8-413c-ae31-90357632afc7\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ALSysIO.sys\"\n },\n {\n \"criteriaid\": \"455b53de-acdb-446d-9c61-21d17fa7c262\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.0.11.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"f1e09d8c-5ffb-4326-b7e2-be6621268153\",\n \"name\": \"ID_FILEATTRIB_ALSYSIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2d067a13-92ac-4868-8942-b9d5fa18a8da\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"b3b86916-c4a2-45bd-91b0-bff53d831081\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AMDRyzenMasterDriver.sys\"\n },\n {\n \"criteriaid\": \"f431a7e3-bfd6-43f3-9e7a-93c9046b1f41\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.5.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"de16e317-03bf-4c93-92a1-bfbdc87e9c40\",\n \"name\": \"ID_FILEATTRIB_AMD_RYZEN\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c1e0ca98-39df-4cbe-b87e-bf0200174214\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 | 13baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9\"\n },\n {\n \"criteriaid\": \"60447dc0-28f6-44b6-90db-d2d7f27662b2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AMDPowerProfiler.sys\"\n },\n {\n \"criteriaid\": \"f640574d-8861-4882-b15b-e4d186cf6c75\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"6.1.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"105ed551-9473-468c-9918-abf65a3556eb\",\n \"name\": \"ID_FILEATTRIB_AMDPP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"8f39a8e6-8e79-49fc-b5a2-f087971cce03\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4e80be107c860de896384b3eff50504dc2d76ac7151df3102a4450637a032146\"\n },\n {\n \"criteriaid\": \"af10f82c-5fca-41e2-a4b6-c8ed1e883511\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"appid.sys\"\n },\n {\n \"criteriaid\": \"7ee14da7-d6f8-4627-a29e-c2d268f96f00\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.0.17763.5458\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"66c12d3e-a46a-4044-90e0-b1c370506315\",\n \"name\": \"ID_FILEATTRIB_APPID_8\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"0f549f05-e40b-42ea-9219-01fc3855998a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"b07a19fa-9fe7-49f2-b7e2-f99cad083574\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"AsHitIo_Drv.sys\"\n },\n {\n \"criteriaid\": \"d77f3bd1-43b5-41a6-9d43-0dc64104945c\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"27.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"27df3400-ccdf-4454-b91c-d81f7fbea9ad\",\n \"name\": \"ID_FILEATTRIB_ASHITIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"561a6000-183f-43d9-a3b5-155f8c937a27\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"1d7e838accd498c2e5ba9373af819ec097bb955c | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65 | 1d7e838accd498c2e5ba9373af819ec097bb955c | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65\"\n },\n {\n \"criteriaid\": \"48a25469-bf68-47a5-a872-8a96538f644d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"aswArPot.sys\"\n },\n {\n \"criteriaid\": \"1e2613d1-a19d-4e9b-9e1b-ffe4b1beccc3\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"21.5.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"c7dd39bd-ed4d-46b0-a2ea-2acc36fb75f3\",\n \"name\": \"ID_FILEATTRIB_ASWARPOT\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"329dce73-7e6c-4eaf-be26-94720583e695\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65 | 1d7e838accd498c2e5ba9373af819ec097bb955c\"\n },\n {\n \"criteriaid\": \"c8039faf-73be-4326-92ac-70e2a375f7fe\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"aswSP.sys\"\n },\n {\n \"criteriaid\": \"af0d900d-d359-4106-91db-a2cd3dbdcbdc\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"20.8.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"34c202c0-02d0-4a62-bf27-5e6d21d63c00\",\n \"name\": \"ID_FILEATTRIB_ASWSP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"6ca072be-e515-4dbd-9835-071ba17cb735\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64 | 11533efd6b326a4e065a936de300fe0586a479f93d569d2403bd62c7ad35f1b2199daee3adb510f429c4fc97b4b024e3 | 1d7e838accd498c2e5ba9373af819ec097bb955c | 47f4b9898631773231b32844ec0d49990ac4eb1e | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65\"\n },\n {\n \"criteriaid\": \"bf881206-2f5c-4506-807c-a936364d69ee\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"aswSnx.sys\"\n },\n {\n \"criteriaid\": \"5b0b6fc1-d980-46a0-88e0-6ea6610d4c0b\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"17.2.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"22446fc1-f584-4710-92fb-b59843d1a634\",\n \"name\": \"ID_FILEATTRIB_ASWSNX\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c2d3e914-3c94-47c8-9596-f4ffe61c4c97\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 | 47f4b9898631773231b32844ec0d49990ac4eb1e | 11533efd6b326a4e065a936de300fe0586a479f93d569d2403bd62c7ad35f1b2199daee3adb510f429c4fc97b4b024e3\"\n },\n {\n \"criteriaid\": \"e138e989-22b3-4216-92d3-9ad82e3bae94\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Atools2.sys\"\n },\n {\n \"criteriaid\": \"98984ee9-9f17-4acb-8f45-36635c34e74a\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.0.23.714\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"9c815f6b-156a-4cf2-b4dc-dccac7bb0533\",\n \"name\": \"ID_FILEATTRIB_ATOOLS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"362dde54-dca5-434c-a450-670dc1f7e06e\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 121af4b922a74247ea49df50de37609cc1451a1fe06b2cb7e1e079b492bd8195 | 1d7e838accd498c2e5ba9373af819ec097bb955c | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65\"\n },\n {\n \"criteriaid\": \"a3ee3f5d-76c6-4505-9f4a-b0af7995d903\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"aswElam.sys\"\n },\n {\n \"criteriaid\": \"613b4515-5565-43a8-b0ae-f254ca85803a\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"21.6.401.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"3be83667-f57a-43bf-817f-e8051c39a63a\",\n \"name\": \"ID_FILEATTRIB_AVGELAM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"efd993c1-a6b6-4bcb-bc51-d1d754920505\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"6db682fc-7272-490a-a1d7-718a142e0419\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BSMI.sys\"\n },\n {\n \"criteriaid\": \"7facb5e0-00db-4850-8895-1bb801460351\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.0.0.4\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"1c3fb649-c55c-4c0e-953e-5cdbd71bcb11\",\n \"name\": \"ID_FILEATTRIB_BSMI\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4ce9750f-fe8d-4fe1-9d33-277b72b27f3e\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"a46a7d7e-7e15-4c7a-83c6-3eaa7178838a\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BS_HWMIO64_W10.sys\"\n },\n {\n \"criteriaid\": \"9afbe6bb-3bbf-4f58-ad22-68bb90fa38ee\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.0.1806.2201\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"e1fd6a42-fa81-4513-aa2d-c0a3fe00c9f1\",\n \"name\": \"ID_FILEATTRIB_BS_HWMIO64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"123b68ba-8397-40fd-baf6-6e05dd236969\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"b258d78d-bfc9-4485-aa5a-ec90c40549ff\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BS_I2cIo.sys\"\n },\n {\n \"criteriaid\": \"93394b2b-44b1-4205-9e81-8d60a53bc3a7\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.1.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"fc691a00-2dfb-4ac1-8488-38a2bff54780\",\n \"name\": \"ID_FILEATTRIB_BS_I2CIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2d7c9814-5e25-4ea3-a76e-051ee632e00d\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"da6442af-3ff0-4e9f-8a05-6bb1b71845d8\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BSMEM64_W10.sys\"\n },\n {\n \"criteriaid\": \"c7f76e7b-2a2d-47b1-899c-c8d315a9e282\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.0.1806.2202\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"d58265d3-d40e-4958-8abf-06b61d807fdf\",\n \"name\": \"ID_FILEATTRIB_BS_MEM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1f8e94c7-368d-4212-858c-55f7460d5c6b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"b4c8ce6b-1d19-4e37-8eba-a26ffe65394f\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Corsair LL Access\"\n },\n {\n \"criteriaid\": \"e4e9c944-808d-4555-b4d0-495dfe58270a\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.0.24.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"f320fd1c-14b7-4da7-8392-ef800ca1d474\",\n \"name\": \"ID_FILEATTRIB_CORSAIRLLACCESS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"438697be-0dd1-40c2-8399-3e8482e14810\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"11bf5f78-a41e-4f13-ae2f-932fe184964a\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"CtiIo64.sys\"\n },\n {\n \"criteriaid\": \"4c5b18ed-a66f-41e3-b5f2-55d75d545c3b\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.1.23.406\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"ccb3ff1b-8384-4e8d-9a8f-1c43a32663ef\",\n \"name\": \"ID_FILEATTRIB_CTIIO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ebde7b12-f7fe-44aa-93ec-19f9126c6a07\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | 56f431d13fd6f7974905196a6367d252a955c5fe34db1e48cfa3eb569707809d63de4a0ff8fef57be69c23284d9144ea\"\n },\n {\n \"criteriaid\": \"c1f0b3f0-554f-4ef7-83b3-5964cb4e2332\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cpuz.sys\"\n },\n {\n \"criteriaid\": \"d9fb21c0-ba05-499c-b8bc-f366af8872f7\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.0.4.4\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"7195b282-40c5-4715-bacd-79bf6c324eae\",\n \"name\": \"ID_FILEATTRIB_CPUZ_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"437146bd-79e5-456c-84e9-33b06e8e81ff\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 121af4b922a74247ea49df50de37609cc1451a1fe06b2cb7e1e079b492bd8195\"\n },\n {\n \"criteriaid\": \"9c0f774f-5cf9-4add-81cf-b0fa0052c9d6\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eelam.sys\"\n },\n {\n \"criteriaid\": \"414587a6-6090-48a8-92ce-84ed5dacc9b7\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.0.16.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"ae36e9ee-5c2f-4a88-a3df-10d9b37de145\",\n \"name\": \"ID_FILEATTRIB_EELAM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"44e2b82d-d373-4f3b-8cc4-a870399618ae\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"041750993d7c9e063f02dfe74699598640911aab\"\n },\n {\n \"criteriaid\": \"665aef5f-7439-48c7-bac7-3809421bb90e\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ElbyCDIO.sys\"\n },\n {\n \"criteriaid\": \"e7bec8ae-1523-4463-b46e-4f6d13b9d81d\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"6.0.3.3\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"f187edb0-6b88-45e4-a42c-0f151fee31fe\",\n \"name\": \"ID_FILEATTRIB_ELBY_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"6a1f064e-f30d-400a-a00a-b00a36da7615\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64\"\n },\n {\n \"criteriaid\": \"2cee23ad-2a49-4243-bf98-22789f7de3eb\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"etdsupp.sys\"\n },\n {\n \"criteriaid\": \"aa7795cb-729e-4e2e-ac06-313a40b01abf\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"21.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"d4551efa-9812-4341-8f7a-cac66869fe6a\",\n \"name\": \"ID_FILEATTRIB_ETDSUPPORT\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d9ca1e65-2e70-484e-bae2-11da36cd3920\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19 | ee6c8048e2aa17a6506ecc99d41b1ba6794c3252 | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"cca461a2-844c-46b9-b233-42fc1621122b\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HaXM.sys\"\n },\n {\n \"criteriaid\": \"5e11b161-c1f0-4b8b-83e7-7ab693d98520\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"1b54fd83-483d-49ff-a907-5cfd837ebfd3\",\n \"name\": \"ID_FILEATTRIB_HAXM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"09abcd18-7e58-4120-b9fa-f5ade05f19d6\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 90c9669670e75989159e6eef69625eb6ad17cba6209ed56f5665d55450a05212 | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65\"\n },\n {\n \"criteriaid\": \"16939cc9-fdaf-455f-96c9-b6477bf0ebd4\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HpPortIox64.sys\"\n },\n {\n \"criteriaid\": \"1d016bb5-4177-4c66-ab38-5035dd929e23\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.2.0.10\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"1bd46d19-b26b-4cd9-96dc-755054298aed\",\n \"name\": \"ID_FILEATTRIB_HPPORTIOX64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"741f0478-1c5a-4ac3-80cc-3622d851fe31\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | de1da11668f0a8d5e13346ed3ab2755f5d25bebffcfd1d0bde5b9f87bc292c91 | 589a7d4df869395601ba7538a65afae8c4616385 | bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7 | 879269f3f467a6d59641960a62fe9cb419355ff6\"\n },\n {\n \"criteriaid\": \"fc616e37-2c48-4aa1-a2c7-e16214350add\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HW.sys\"\n },\n {\n \"criteriaid\": \"c3a496fa-34a6-4275-a06d-fc52b540635d\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"5.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"aba0ea9a-55a3-4550-86b3-b48fad5672ef\",\n \"name\": \"ID_FILEATTRIB_HW\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"5ef0ecf7-bf11-4fef-87aa-33aaddaaf516\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | f478f0e790d5c8ec6056a3ab2567404a991d2837 | 879269f3f467a6d59641960a62fe9cb419355ff6 | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 06936bac8d2f85d9ce6f7348ea421a1a949219182845192667b0e671fe0e4285 | 589a7d4df869395601ba7538a65afae8c4616385\"\n },\n {\n \"criteriaid\": \"f31dd3f9-4a98-450b-a4ec-fe6fc5bb728c\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HWiNFO32.SYS\"\n },\n {\n \"criteriaid\": \"6570ad58-1a0e-43b4-9e6e-1aebfe17bb15\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"8.98.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"2b54ddc5-dba8-47aa-a87d-5c7bd021fc5b\",\n \"name\": \"ID_FILEATTRIB_HWINFO_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"829d5161-fcdb-4cf4-96d1-56c09d6e5ee0\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | f478f0e790d5c8ec6056a3ab2567404a991d2837 | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | 06936bac8d2f85d9ce6f7348ea421a1a949219182845192667b0e671fe0e4285 | 589a7d4df869395601ba7538a65afae8c4616385\"\n },\n {\n \"criteriaid\": \"22343106-0787-460d-a983-bb094f5c44b6\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HWiNFO64A.SYS\"\n },\n {\n \"criteriaid\": \"59c2562a-403f-4d65-9f60-c0e753dad7a2\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"8.98.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"7ded9ee1-a1e4-4efa-bea7-e59942177c30\",\n \"name\": \"ID_FILEATTRIB_HWINFO_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c6790a81-9130-488b-ab0b-cfcd0e6cea0f\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"56f431d13fd6f7974905196a6367d252a955c5fe34db1e48cfa3eb569707809d63de4a0ff8fef57be69c23284d9144ea | 879269f3f467a6d59641960a62fe9cb419355ff6 | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf\"\n },\n {\n \"criteriaid\": \"53ec4bb4-d1d2-4cc4-8540-67f1fb488a35\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"HWiNFO64I.SYS\"\n },\n {\n \"criteriaid\": \"6aeff2ef-dcca-4e6b-a356-3595f62d68a9\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"8.98.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"cc55eabf-f64c-4b78-b4b8-51b70726a469\",\n \"name\": \"ID_FILEATTRIB_HWINFO_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"50836d44-e4bc-41e7-a68b-12ecdb6ca4ac\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | 4843a82ed3b1f2bfbee9671960e1940c942f688d | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"bbe04db6-73ce-4b0a-8787-7c877ff6966d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"IObitUnlocker.sys\"\n },\n {\n \"criteriaid\": \"fdd2a707-9d37-4f99-8c76-0ce129bef779\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.3.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"efe47d8f-76f4-443d-a54a-d3079dad55fc\",\n \"name\": \"ID_FILEATTRIB_IOBITUNLOCKER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f21b2808-21bf-4ab9-8040-96a87d7a2434\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4cdc38c800761463749c3cbd94a12f32e49877bf | 1d7e838accd498c2e5ba9373af819ec097bb955c\"\n },\n {\n \"criteriaid\": \"86861abc-eb66-4175-97f2-17d5a0e82ced\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"IOMap.sys\"\n },\n {\n \"criteriaid\": \"35a938bd-6eda-4b4d-a501-7ffd61626fe0\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"eeb40cfa-819a-4f21-bebb-83f134de51f1\",\n \"name\": \"ID_FILEATTRIB_IOMAP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4451e564-e0cb-4384-bf1f-9779b0b9d890\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4cdc38c800761463749c3cbd94a12f32e49877bf | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 53b052ba209c525233293274854b264bc0f68b73 | 7ce102d63c57cb48f80a65d1a5e9b350a7a618482aa5a36775323ca933ddfcb00def83796a6340dec5ebf7596cfd8e5d\"\n },\n {\n \"criteriaid\": \"68c2e2ed-62ba-485d-83db-a6095463f12e\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"iQVW64.SYS\"\n },\n {\n \"criteriaid\": \"4399af53-94ec-469c-aecc-32ed6078faea\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.4.0.22\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"ee2b9adf-f1de-46f7-93f4-56581add699d\",\n \"name\": \"ID_FILEATTRIB_IQVW64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"aef7e1a9-66f8-47e6-ba3e-19678364feb6\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 47f4b9898631773231b32844ec0d49990ac4eb1e | 15e7050789df807f3e3174294a01b637a1239f603e42f4b5db9398efa9da9996 | d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe | f478f0e790d5c8ec6056a3ab2567404a991d2837\"\n },\n {\n \"criteriaid\": \"fccbf9c4-bb1c-46f4-958c-05fdb2ed2459\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ksapi.sys\"\n },\n {\n \"criteriaid\": \"6ccba790-29e3-4ef2-9154-e1c854717a9d\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2021.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"5bb3005b-bddc-4962-9e77-8779bb53c732\",\n \"name\": \"ID_FILEATTRIB_KSAPI\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9016218d-01a1-4684-b53d-f13afc6d362b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"f7057b90-1282-4e67-8cc8-f3be0f5fc775\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"libnicm.sys\"\n },\n {\n \"criteriaid\": \"e5b981cd-8b37-48b1-b523-56dc2942cb44\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.1.11.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"d9e75eee-d3c5-4616-9fc6-77cc216bbcea\",\n \"name\": \"ID_FILEATTRIB_LIBNICM_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4da7c671-a802-46b5-940f-84700dc8cc46\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65 | 65b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64\"\n },\n {\n \"criteriaid\": \"4da14531-05a0-4d42-92de-bdc5346793f2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"LenovoDiagnosticsDriver.sys\"\n },\n {\n \"criteriaid\": \"a1950600-6c66-4131-b7da-c64bc2e96784\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"4065bef1-1017-4902-b5d8-c09585b5afa3\",\n \"name\": \"ID_FILEATTRIB_LV_DIAG\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"163a5090-3255-4cf2-88f6-7931284d32a3\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75 | 4843a82ed3b1f2bfbee9671960e1940c942f688d | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"9584748d-ca3f-4421-9df5-3ebfeb4285b4\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Monitor.sys\"\n },\n {\n \"criteriaid\": \"388011e7-a4a2-4b8b-b433-1614d5b06645\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"15.0.0.3\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"3285d6ba-1c41-4e8d-a2cf-d5413c71fefb\",\n \"name\": \"ID_FILEATTRIB_MONITOR\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2ee69be2-2bd6-40b9-aa57-51d4efad66b1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46\"\n },\n {\n \"criteriaid\": \"23538c98-4db0-486d-8eaa-15d497e19af7\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Keyboard Filter Driver\"\n },\n {\n \"criteriaid\": \"67cc5a9b-eb73-4aec-8db2-cb7ec383eae3\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.1.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"70e7427c-df22-46f9-8ff3-1efb4f2772cc\",\n \"name\": \"ID_FILEATTRIB_MSRHOOK\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"06bf7f5d-0292-4fb4-9e99-bc544728bbf1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | b3c925b4048c3f7c444d248a2b101186b57cba39596eb5dce0e17a4ee4b32f19\"\n },\n {\n \"criteriaid\": \"c5b06f9d-2547-42fa-aaff-4d0aa76a6119\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"mtcBSv64.sys\"\n },\n {\n \"criteriaid\": \"23ecd868-2225-4d4b-a290-c7895c09e86e\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"21.2.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"5c93cca9-be55-4130-b0ac-c2cce38a573a\",\n \"name\": \"ID_FILEATTRIB_MTCBSV64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"8733436c-bbbe-48cf-b0d9-c98e382ee3cb\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"799f8d10-ecd8-4d75-a68b-428cea67f0da\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"NCHGBIOS2x64.SYS\"\n },\n {\n \"criteriaid\": \"aaf4c63f-e838-448a-b279-eb452b4dfe28\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"4.2.4.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"58139ca4-a2f0-4b62-a3b4-2933adf47358\",\n \"name\": \"ID_FILEATTRIB_NCHGBIOS2X64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1297b14c-1e4e-4edd-9638-bf4f15d01313\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"8591166e-6c11-460c-85ec-9ee4e6c4c173\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"NCPL.SYS\"\n },\n {\n \"criteriaid\": \"315c9486-3a09-496b-901b-870212f43971\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.1.11.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"7a935dfa-23f6-4565-910b-0f00d7ac89e9\",\n \"name\": \"ID_FILEATTRIB_NCPL_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"42ed3907-403d-4eca-bf13-c4b62ce22e0c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"e96220a9-01c7-4cdf-b1fa-6d937d01e6d2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"NICM.SYS\"\n },\n {\n \"criteriaid\": \"f2f5af6f-56bb-4ae3-8305-f83ecc5ca721\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.1.11.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"fbf276a5-c075-4b7b-bc07-0d67f9aec07b\",\n \"name\": \"ID_FILEATTRIB_NICM_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"86fcbe30-20b0-4920-911c-434f26b7e164\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4cdc38c800761463749c3cbd94a12f32e49877bf | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"38c2bf7a-6562-457e-b956-883e9ad57cf2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"nscm.sys\"\n },\n {\n \"criteriaid\": \"ecab73f0-fd4a-4ea8-8550-416193320975\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.1.11.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"ec78ce1f-600a-410c-908a-e92caf396ec1\",\n \"name\": \"ID_FILEATTRIB_NSCM_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4a4b4232-eb05-4e56-a58f-2098a5c350b2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589a7d4df869395601ba7538a65afae8c4616385 | 041750993d7c9e063f02dfe74699598640911aab\"\n },\n {\n \"criteriaid\": \"7a9ae979-dd82-4b92-b298-03343fefe4cd\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"NTIOLib.sys\"\n },\n {\n \"criteriaid\": \"3163bc5e-9a46-4816-97f5-049c4365ff24\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"5c324f31-51bc-452a-be1e-e46b30b09f5f\",\n \"name\": \"ID_FILEATTRIB_NTIOLIB\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"fecfb82a-1aac-4625-8f06-46f8bede210b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d | 7f25cbd37dcdc0e0d93e0d477c4bc0c54231379e6caf1023841e1f0d96467a6c | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"0b01e997-5eca-4007-a48f-1b8ba137d493\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"nvflash.sys\"\n },\n {\n \"criteriaid\": \"57038a39-167f-424f-8912-a2f469d5385d\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.10.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"b2313a28-b682-4e91-9069-1a70e04302d2\",\n \"name\": \"ID_FILEATTRIB_NVFLASH\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b6811e64-7a59-44aa-8ee3-6008e77136c1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | 2d54c16a8f8b69ccdea48d0603c132f547a5cf75\"\n },\n {\n \"criteriaid\": \"8f1c8921-c05c-47c9-a1d3-6531e5f0d6ea\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"pcdsrvc\"\n },\n {\n \"criteriaid\": \"eb7161e6-6113-4321-b7d1-16b6efa90ab6\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"6.3.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"295f8a9b-a3e9-40cf-b7cc-c99c0c571802\",\n \"name\": \"ID_FILEATTRIB_PCDOC\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ffe49710-fe46-4a51-b2de-885122464ee9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 4cdc38c800761463749c3cbd94a12f32e49877bf | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5 | c5506bee3c29254dc5b5a0e6e7a14046522708ef | 4843a82ed3b1f2bfbee9671960e1940c942f688d | 6b3242a9a639b0da4d5882c7eeb402be6615ad0c\"\n },\n {\n \"criteriaid\": \"41380831-4736-42cc-add4-2e22bae1e32b\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"procexp.Sys\"\n },\n {\n \"criteriaid\": \"9fc5466f-aa18-400f-9390-c01142b91ae3\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"17.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"b5fcfa17-77c0-43a4-8f20-578bed2dc493\",\n \"name\": \"ID_FILEATTRIB_PROCEXP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"e3594ef4-b58a-4738-8237-fc6f0de86b95\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4cdc38c800761463749c3cbd94a12f32e49877bf | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"8d405a32-d7b2-4165-b628-ef909d2b772d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"rtif.sys\"\n },\n {\n \"criteriaid\": \"5a011c95-fbd7-4232-9adb-ec4ce164640e\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"7.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"1c923542-4f2d-4235-b0ba-9d99bfda94be\",\n \"name\": \"ID_FILEATTRIB_RTIF\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"566f720d-d8ba-4a8e-9996-e511091a6bbe\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"172f39bca3dda7c6d5169c96b34a5fe7e96ff0bd | f6297a00d3b2b4ce4750402b66e7ea018d54f683\"\n },\n {\n \"criteriaid\": \"8b53962d-18e5-4b08-8ca3-80a1d2e77ad2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SANDRA\"\n },\n {\n \"criteriaid\": \"01a63eb0-8a87-4955-8e56-3fd5390e1b36\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.12.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"56d036ac-5f73-4f59-a4fe-c99a7724482c\",\n \"name\": \"ID_FILEATTRIB_SANDRA\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9695390a-d91a-46d5-9779-ef0978e51e11\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"172f39bca3dda7c6d5169c96b34a5fe7e96ff0bd | f6297a00d3b2b4ce4750402b66e7ea018d54f683\"\n },\n {\n \"criteriaid\": \"c71eb890-be68-406e-b392-d3bdf74fa57c\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"sandra.sys\"\n },\n {\n \"criteriaid\": \"d6402050-5ddc-4b86-bc2b-7b40aa78c610\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.12.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"aa377fdc-fc9b-4aca-b909-3e64efc192b4\",\n \"name\": \"ID_FILEATTRIB_SANDRA_DRIVER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"a137da56-551c-42b7-893a-49315b5b73fd\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d\"\n },\n {\n \"criteriaid\": \"52b54ca7-60e3-4d00-971c-bcc92d4d2548\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"segwindrvx64.sys\"\n },\n {\n \"criteriaid\": \"1105f2cd-2391-48a2-86af-e7d1f168c836\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"100.0.7.3\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"5510ec8c-7aaf-4ab4-8afc-4a5927c0263b\",\n \"name\": \"ID_FILEATTRIB_SEGWINDRVX64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4700e7e8-43c6-4fa2-8ff7-20a5aab0b144\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4cdc38c800761463749c3cbd94a12f32e49877bf | 589a7d4df869395601ba7538a65afae8c4616385\"\n },\n {\n \"criteriaid\": \"af4d5b21-f3d5-4752-8915-8140fc4d9931\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"sfdrvx32.sys\"\n },\n {\n \"criteriaid\": \"4b2d9998-2677-44d3-a97b-f2a3cae206ce\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"4.43.4.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"103c7acf-fbe1-414b-b6f7-35eb7ea0994e\",\n \"name\": \"ID_FILEATTRIB_SFDRVX32\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"70c35c09-6958-4359-af39-90ae468a30a2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 7ce102d63c57cb48f80a65d1a5e9b350a7a618482aa5a36775323ca933ddfcb00def83796a6340dec5ebf7596cfd8e5d | 20adc5b59cb532e215f01ba09a9c745898c206555613512fea7c295ccfd17ced4fe2c5bc3274ca8a270fc68799b8343c | f56832bc9412c372f9a8744591258f8bb11af2d8\"\n },\n {\n \"criteriaid\": \"33e7dcba-5000-43c2-bb61-7c9c200d52d8\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"stdcdrv64.sys\"\n },\n {\n \"criteriaid\": \"6251dcf3-5d19-473c-9768-307c7220ff5f\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.0.0.0\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"46d738a8-0d2f-4029-87f7-3949b190554b\",\n \"name\": \"ID_FILEATTRIB_STDCDRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b8bc93ce-df42-4d26-ac3f-89e934ae55d0\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"ebc59a46-ff7c-4ed1-9d04-ddaf97cd5455\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"superbmc.sys\"\n },\n {\n \"criteriaid\": \"684b1876-f17c-4cad-8925-91e7305ff239\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.2.1.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"ec496b68-c29c-4f51-9eba-9cc466607c42\",\n \"name\": \"ID_FILEATTRIB_SUPERBMC\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"298fd5b0-c171-4a0b-b65c-3d6cefa690d9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 121af4b922a74247ea49df50de37609cc1451a1fe06b2cb7e1e079b492bd8195\"\n },\n {\n \"criteriaid\": \"82c6a479-3bc2-466d-bec7-9824f41253b9\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SymELAM.sys\"\n },\n {\n \"criteriaid\": \"5887f5ba-4f6a-4d0a-b2e1-9ad296d12f69\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.4.0.84\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"9abb71d4-a2b8-48ff-9abe-c7ac928e3849\",\n \"name\": \"ID_FILEATTRIB_SYMELAM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"05b13baf-d46d-43f2-8a5f-a6254f9f6663\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7\"\n },\n {\n \"criteriaid\": \"7374e9a1-d7e1-4e11-8fe9-558ce1534265\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"SysDrv3S.sys\"\n },\n {\n \"criteriaid\": \"64e3f909-b0fc-4051-90f9-c3290da41d61\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.6.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"6a3745a4-6371-4489-851f-8c6cf70f64db\",\n \"name\": \"ID_FILEATTRIB_SYSDRV3S\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2aa41faa-a809-45d6-8f38-c362cce58570\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | 4678c6e4a8787a8e6ed2bce8792b122f6c08afd8 | 4cdc38c800761463749c3cbd94a12f32e49877bf | cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1\"\n },\n {\n \"criteriaid\": \"ab2e3010-36fd-4df0-bf48-db002c0430b9\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"TmComm.sys\"\n },\n {\n \"criteriaid\": \"32c40631-7a10-43fd-ad99-062eacc4470e\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"8.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"3ab52e29-c3ef-4c43-ad94-91d14fa5ea5a\",\n \"name\": \"ID_FILEATTRIB_TREND_MICRO\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"21a209fa-92c1-4822-9137-2f6e7c9b2f26\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | c7fc1727f5b75a6421a1f95c73bbdb23580c48e5\"\n },\n {\n \"criteriaid\": \"5756bd1d-917a-48a1-9205-1d467530b147\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"VBoxDrv.sys\"\n },\n {\n \"criteriaid\": \"9a458bec-0ebc-4e2a-8158-20d8e02b4d15\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"d10f0d9f-cc32-4a36-9497-74712ad8e335\",\n \"name\": \"ID_FILEATTRIB_VBOX\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"68f38b95-2bee-40d4-8004-1bb15b223ec9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | a229d2722bc6091d73b1d979b81088c977cb028a6f7cbf264bb81d5cc8f099f87d7c296e48bf09d7ebe275f5498661a4 | 0bf095b845b69928b5d7dfd1c42ae4f90feb8dc97f7830598c93e848877021fb | 1d7e838accd498c2e5ba9373af819ec097bb955c | 0bf095b845b69928b5d7dfd1c42ae4f90feb8dc97f7830598c93e848877021fb\"\n },\n {\n \"criteriaid\": \"dbcac257-6777-4fd8-a752-2146ed86329a\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"Truesight\"\n },\n {\n \"criteriaid\": \"ce3ddade-3297-4468-9c93-eb8a97281499\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.3.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"b211f92e-553c-45ba-adb7-2c671ab3da7c\",\n \"name\": \"ID_FILEATTRIB_TRUESIGHT\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"66e67d27-812b-45c1-9abd-f7bd1885565f\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d | f478f0e790d5c8ec6056a3ab2567404a991d2837\"\n },\n {\n \"criteriaid\": \"84f92558-46a6-4b7e-ad98-2ae3190ee0d2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"viragt.sys\"\n },\n {\n \"criteriaid\": \"63d2dccb-74e2-410a-8a68-0265ccf0d4dd\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.80.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"8f6a9db5-5968-4e69-9cce-e9e276ef43ef\",\n \"name\": \"ID_FILEATTRIB_VIRAGT\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b6516bd1-8115-4b0a-8998-525c06a62014\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | 4843a82ed3b1f2bfbee9671960e1940c942f688d | f478f0e790d5c8ec6056a3ab2567404a991d2837\"\n },\n {\n \"criteriaid\": \"b625b2fd-b9dc-46a1-87de-4b855ff45067\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"viragt64.sys\"\n },\n {\n \"criteriaid\": \"9c0f2569-8b43-48f2-8ecc-bc76425e523d\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.0.0.12\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"903d027a-6d2d-47d8-951a-c29428b3fcd8\",\n \"name\": \"ID_FILEATTRIB_VIRAGT64\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"fc405e7c-1250-48ef-aa68-7937aa5231aa\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae | eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf\"\n },\n {\n \"criteriaid\": \"fce7a516-c8d1-4da2-b8ee-c071974279c2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"vmdrv.sys\"\n },\n {\n \"criteriaid\": \"a956500d-bd15-42c6-b73e-8dcea004e236\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"10.0.10011.16385\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"3c15d642-131d-4ea3-96e4-8f2c68dfb01d\",\n \"name\": \"ID_FILEATTRIB_VMDRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"5ab7e7c6-5ee8-493e-b28d-4efb66bfd843\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 | 90c9669670e75989159e6eef69625eb6ad17cba6209ed56f5665d55450a05212 | e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65\"\n },\n {\n \"criteriaid\": \"d664863b-6299-446c-b7b3-727c3ba0864d\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"WinRing0.sys\"\n },\n {\n \"criteriaid\": \"e9b0a544-96a2-4b42-a287-4ae2eaf8dc09\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.0.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"24e7459d-9fee-4a12-af8a-f40f5d01d809\",\n \"name\": \"ID_FILEATTRIB_WINRING0\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"8840f1dc-8549-4af4-99ab-5e7c7131779a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843a82ed3b1f2bfbee9671960e1940c942f688d | d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae\"\n },\n {\n \"criteriaid\": \"9ed35e7b-cec3-4e56-9326-fc4de650f480\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"wnbios.sys\"\n },\n {\n \"criteriaid\": \"6afd3d99-04bc-40e1-9307-269d90f8e0d4\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"1.2.0.1\"\n }\n ],\n \"criteria_count\": 3,\n \"metaruleid\": \"60c3fc01-6458-4033-83e5-53a359cf7e26\",\n \"name\": \"ID_FILEATTRIB_WNBIOS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"5a02be0f-9f3c-4bcb-af7a-700c209a73b1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"95795d2aa2a554a423bc8c6e5b0a016d14887d35 | c734685d985b8ea13db4fc1a6dcd26aa0dde78b4c3b651ea5d58e32e081b2a41 | 95795d2aa2a554a423bc8c6e5b0a016d14887d35 | c734685d985b8ea13db4fc1a6dcd26aa0dde78b4c3b651ea5d58e32e081b2a41\"\n },\n {\n \"criteriaid\": \"3c6e6557-8e71-4bc4-a20e-3d71d7c324b9\",\n \"field\": \"productname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"MTA San Andreas\"\n },\n {\n \"criteriaid\": \"8fcb8796-c52f-47d9-8a7c-2c2f0b5ed50f\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"greater\",\n \"value\": \"366.65535.65535.65535\"\n },\n {\n \"criteriaid\": \"68875645-80bd-489f-a697-d7c9ee532c92\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"368.0.0.0\"\n }\n ],\n \"criteria_count\": 4,\n \"metaruleid\": \"5ccc4608-93a8-4adf-b797-fbab5eb538e0\",\n \"name\": \"ID_FILEATTRIB_FAIRPLAY\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"31ffed98-b084-4c58-bb94-35f901100af2\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"kprocesshacker.sys\"\n },\n {\n \"criteriaid\": \"03427e86-84a8-492e-8ed7-b5e11cf8817e\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"3.2.0.0\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"92d00bb3-259e-45ea-a209-02c12ff1bb2a\",\n \"name\": \"ID_DENY_PROCESSHACKER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"30e1e9ba-41bd-42ec-aa90-bb15eeb9b8bf\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"amp.sys\"\n },\n {\n \"criteriaid\": \"154fc6ff-4fe6-4241-a89f-746527832a10\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"5.4.11.2\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"448cd007-72d2-44c4-9d33-da29434918d5\",\n \"name\": \"ID_DENY_AMP\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"6bff9b27-a3b2-48a1-831f-42b6c1fa2548\",\n \"field\": \"origname\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"klmd.sys\"\n },\n {\n \"criteriaid\": \"ad0589c9-e5cb-4ce7-8a5c-18c6ccafe8d2\",\n \"field\": \"productversion\",\n \"index\": 0,\n \"operation\": \"less\",\n \"value\": \"2.13.0.11\"\n }\n ],\n \"criteria_count\": 2,\n \"metaruleid\": \"b140a658-923f-4c24-846c-2100c3c9afbe\",\n \"name\": \"ID_DENY_KLMD\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"8f8ede01-bdd9-4eef-bd42-24621c53519d\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"A08E79C386083D875014C409C13D144E0A24386132980DF11FF59737C8489EB1\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"7ee1b70c-6ff3-48f9-9f37-f99c530fcf35\",\n \"name\": \"ID_SIGNER_CAPCOM\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7cc3c011-48bb-4bb3-8df2-4be7f1beb3bf\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"c96e9284-17fe-4175-8df7-6b77d2e60d85\",\n \"name\": \"ID_SIGNER_CHEAT_ENGINE\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2ca20f7b-c987-4f8b-80a0-c04df8b98ab1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"9bc89775-0f44-469a-b192-9b35e11615dd\",\n \"name\": \"ID_SIGNER_ENE\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1b373191-b929-46d7-9ad9-a2a61b172af3\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"ad996fbd-c4eb-4bed-8bfb-41ef7f9e5a12\",\n \"name\": \"ID_SIGNER_MB_RB_HACKS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f365e937-6937-4645-b5cc-7457245cce73\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"1cb93626-d389-4ec0-beb9-d067b3700684\",\n \"name\": \"ID_SIGNER_MAN_MUS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cc83e47e-309b-452a-869a-2cb4a40b9508\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589A7D4DF869395601BA7538A65AFAE8C4616385\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"be610182-1bac-46f2-9559-abc13c40af57\",\n \"name\": \"ID_SIGNER_MIMIKATZ_KERNEL\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f934c6d6-f3ea-475f-bc87-0f3c2353814a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"F6CAE0B028995EB13B1C2CCE5B5107384AB7C77279AE5560933E345061D99CC0\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"8475a340-5c0c-4ceb-8f5a-51918a2b72ab\",\n \"name\": \"ID_SIGNER_MIMIKATZ_KERNEL_SHA2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"23d2727d-f8aa-4461-adb3-f2055c801889\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"F7B6EEB3A567223000A61F68C53B458193557C17E5D512D2825BCB13E5FC9BE5\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"8803cb18-89e8-4be6-a7bc-12449a068ce0\",\n \"name\": \"ID_SIGNER_MIMIKATZ_USER\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"aa1f8b05-58e3-44a7-8df5-2f7d2715604b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"C7FC1727F5B75A6421A1F95C73BBDB23580C48E5\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"ff617fa8-9f82-4306-a16b-a56edbede750\",\n \"name\": \"ID_SIGNER_SPEEDFAN\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"92c1ed2e-7528-407c-a60b-58fd05400a23\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589A7D4DF869395601BA7538A65AFAE8C4616385\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"338a0265-0c04-4699-b05c-7a3fe7e61cf8\",\n \"name\": \"ID_SIGNER_RWEVERY\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"6bd196e4-b341-4484-9647-443202663df0\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"041750993D7C9E063F02DFE74699598640911AAB\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"2ec800fd-cd71-4276-b877-0b42bd6941a3\",\n \"name\": \"ID_SIGNER_VBOX\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"3179e233-0d55-40d3-a230-65c0c528ea5a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BD1765C56594221373893EF26D97F88C144FB0E5A0111215B45D7239C3444DF7\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"5644e645-c994-4e41-8144-720808509d03\",\n \"name\": \"ID_SIGNER_GLOBALSIGN_CHEAT_ENGINE\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d07f0656-c634-4cc5-a02f-aa8ad6992668\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589A7D4DF869395601BA7538A65AFAE8C4616385\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"f7ed0762-7052-4d13-8f18-0bf94cddbcc4\",\n \"name\": \"ID_SIGNER_GLOBALSIGN_G2_CHEAT_ENGINE\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f7b8f910-8658-4f1e-bc6e-2c07266ef28c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589A7D4DF869395601BA7538A65AFAE8C4616385\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"e4086567-dc17-49aa-9646-dafd212eb40d\",\n \"name\": \"ID_SIGNER_GMEREK\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c8b7658f-666a-44ee-b6e4-792bbd33ecd1\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"E767799478F64A34B3F53FF3BB9057FE1768F4AB178041B0DCC0FF1E210CBA65\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"2b236510-3009-4c37-96cf-e7e29e58e623\",\n \"name\": \"ID_SIGNER_PAVEL_Y_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"114df20c-e5a6-4bd8-b5f5-1c2cba99eaa5\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"0BF095B845B69928B5D7DFD1C42AE4F90FEB8DC97F7830598C93E848877021FB\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"7d02265f-d873-4062-8cb3-df26f905e72b\",\n \"name\": \"ID_SIGNER_PAVEL_Y_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4d5abc74-0aca-4744-81bb-7a92d0df4e9b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"1e6fef1b-3628-4938-9c01-4777f2651b83\",\n \"name\": \"ID_SIGNER_MICKS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d702a0eb-52aa-4aaa-9d1d-b29419660ec8\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"13cca9ad-f228-4de0-b409-8935c6c648d6\",\n \"name\": \"ID_SIGNER_RENTDRV\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"eec5e213-edc8-453c-8d2d-c8108510fee3\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"6df0cf4a-c401-4bca-9f76-c2ce2ab88192\",\n \"name\": \"ID_SIGNER_ARTIFICIAL_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"390a602c-238f-4a15-a678-d252ee4beb49\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"CEC1AFD0E310C55C1DCC601AB8E172917706AA32FB5EAF826813547FDF02DD46\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"a06fe4c9-61df-40b7-956f-ccb62b0c97b9\",\n \"name\": \"ID_SIGNER_ARTIFICIAL_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b943f879-46aa-4cdf-9464-86b1cf490d9a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"79F0A648BD7F1184F86BFF43AE47C9ECC3ED3CEC\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"d5a334c8-b19d-47b4-ab18-c3a420827ba7\",\n \"name\": \"ID_SIGNER_ITM_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"999733db-e382-4a20-b950-113c49bc0aa5\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"F478F0E790D5C8EC6056A3AB2567404A991D2837\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"ca68c405-6a0e-41a5-b876-4fbf9bb0f397\",\n \"name\": \"ID_SIGNER_ITM_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"599c4fe9-c17d-4f0b-ac73-46a15c766bb6\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"589A7D4DF869395601BA7538A65AFAE8C4616385\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"580c1af5-be65-446f-ad03-fc79078b2167\",\n \"name\": \"ID_SIGNER_ITM_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d58ca519-37ab-4bed-9d12-db4df4d66432\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BD1765C56594221373893EF26D97F88C144FB0E5A0111215B45D7239C3444DF7\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"eb9001ec-245e-48f2-8292-e9574272e127\",\n \"name\": \"ID_SIGNER_ITM_4\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"651c009f-d1d2-43c5-aaf3-dd43a9a88881\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"30b4e22b-9a46-46c0-91f8-1a752e97600b\",\n \"name\": \"ID_SIGNER_AMON\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7eff7941-0e10-4c2e-bf58-07297572dc20\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"ED37AD43BC52426943019F77F35ED1A6B063B5B7\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"03bdbac0-bd37-4efa-98e4-edbf0027ae9e\",\n \"name\": \"ID_SIGNER_BAOJI\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b1a97873-0d03-4e63-8a89-711a7400b9fd\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"C4CD7D2A3E12022BCFE2852A14438C7F2BD3A959\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"76302aa4-fdac-401a-8114-71a101015163\",\n \"name\": \"ID_SIGNER_BEIJING_CHUNBAI\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"e289358a-38e0-409d-b08e-946523d2e57a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"399B4EC286EC1963F1BB36206F3200C23DBF1717E24CF0868335FF3E13A45EA0\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"25e41c4c-cf17-4423-bb1b-494abc46fdfa\",\n \"name\": \"ID_SIGNER_BEIJING_VSK\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"2ba2dfca-4df2-405e-b002-2c06116b06a2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D70EDFA009A76BD8250D74E9EE92EB9EAD7D4CB3\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"0bc8b2b4-7fce-4203-bc58-d40df9ddeed3\",\n \"name\": \"ID_SIGNER_GEOTRUST_SRL_2009\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"a777f00f-5978-4875-86c0-135fedcde3a5\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"E5BA2ABBD1DC89F143A66A3CDCDA26D968758E2D\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"dfe58654-e689-4d6c-a0ab-71f4cb96aa7d\",\n \"name\": \"ID_SIGNER_GEOTRUST_SRL_2010\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c1e479ab-0685-48cf-ba31-bdd94452c653\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"A79C023D3452B2F27E7BC36D2588C28564B2ABABBF78AFAC844152B8DD3A89D4\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"c81ea56b-8b64-4359-85a8-70ad19b99ee2\",\n \"name\": \"ID_SIGNER_GLOBAL_SOFT\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"97f5ecda-5d94-49ac-9353-33d81d61e3c5\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"8438D529DC1D87E288CE3C8830A782BB167E20A6E1FD37624D5DF21340FF6B25\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"0f91e5b8-0d16-44ad-b157-b7f370d02a49\",\n \"name\": \"ID_SIGNER_GOOD_WEI\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1bdca2a1-94c2-4830-ab4c-13465deeeb77\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"CCCAE21FBC083F5D1AF6997BB3F29ED9915E7324\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"e7b7c422-088c-47be-bfb0-a38896c13d3f\",\n \"name\": \"ID_SIGNER_HANDAN\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"739a216c-feaa-43d6-9c6c-5ae626114ea9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"5CBF0640A92AB3779F2AF481DAF0ADFEF9BD99F5\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"23d1d313-a0c2-40b6-9f40-fbb0052e88be\",\n \"name\": \"ID_SIGNER_HYPERTECH\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"f3de3c09-fcda-4f2e-b20c-074cbbd7f8fd\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"F5E1C4D98F9CE552EAD3776C16F3AD91FE5F3984\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"4d303977-50d9-4e6b-b89c-fddc98f73977\",\n \"name\": \"ID_SIGNER_NANJING\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d8f41c30-fbeb-4492-a800-a72d6c49ffee\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"232A71B4D1734EAC2CFC6EA554C86DE34F9F8B72\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"817371a8-d5f6-4d82-8b5f-ef4c42c6894c\",\n \"name\": \"ID_SIGNER_TRUST_ASIA\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"c6b5d293-fb02-4ea7-99b2-cb4176d0969f\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"DFA6171201B51A2EC174310E8FB9F4C0FDE2D365235E589DED0213C5279BEA6E\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"59356476-918c-4121-ad91-4de58bf9b5aa\",\n \"name\": \"ID_SIGNER_JEROMIN_CODY_ERIC\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"4beddccc-5519-418a-8e5e-d30b112dfd89\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"A86DE66D8198E4272859881476A6F9936034A482\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"33b03c4c-fb9f-413f-9700-05ad2fe52d0f\",\n \"name\": \"ID_SIGNER_SAASAME\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"97560246-3794-49e7-820b-fa384b8e9cb0\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"06530FA1FA2D0954A87C4AA1891699E7C81AB2CA\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"087cb976-fcf4-4c52-a3ad-97204f5df062\",\n \"name\": \"ID_SIGNER_JCOS_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cbcaee23-7ba5-48d9-a918-f8f3703a1ec7\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"8A3994CC7AA70F5480166A96A32EB10BAB0A7A36\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"eba5f5a6-2f41-4ff9-a686-350fc4c3485f\",\n \"name\": \"ID_SIGNER_JCOS_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"7a2bc2db-1e27-462b-a9c1-80a3268bdf6b\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"2AAA2A578BDEB2F1DBAAE27B6358B87D14143B7FA98518A6AC576172677225AC\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"c8509f2a-2fb4-4136-adff-d811de4e3eb0\",\n \"name\": \"ID_SIGNER_VOIDTOOLS\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b4c0fe17-c9b7-45f5-9e6f-79c260fcaf22\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4CDC38C800761463749C3CBD94A12F32E49877BF\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"f594f582-e1e4-4534-80d3-8bd4bce9ed5f\",\n \"name\": \"ID_SIGNER_PCTOOLS_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"b0fe2a2c-2808-421c-9a75-884a204e8262\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843A82ED3B1F2BFBEE9671960E1940C942F688D\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"bc0e6a36-7987-4d7d-b8c7-75e5ba60863c\",\n \"name\": \"ID_SIGNER_PCTOOLS_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"350234e5-bf3a-435f-bfa7-deb668595d08\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"C7FC1727F5B75A6421A1F95C73BBDB23580C48E5\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"aa534c16-fab3-4ba5-ba0d-8432700a6f86\",\n \"name\": \"ID_SIGNER_PCTOOLS_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"e41ca031-d06d-443d-a484-340ed2cb70c6\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"47F4B9898631773231B32844EC0D49990AC4EB1E\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"68bb1327-9242-4c7f-9241-4417abaae1b2\",\n \"name\": \"ID_SIGNER_HERMETICWIPER_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"fad2cf9e-f37e-4733-b4c0-051ab7718a09\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"B3C925B4048C3F7C444D248A2B101186B57CBA39596EB5DCE0E17A4EE4B32F19\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"3cb63675-0877-4a43-a8d8-f951b20a274f\",\n \"name\": \"ID_SIGNER_HERMETICWIPER_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"143f35f1-eb60-4246-9b08-251b7b3c34cf\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"C7FC1727F5B75A6421A1F95C73BBDB23580C48E5\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"8ac81fa6-95ef-417a-b669-2e4eb9076f27\",\n \"name\": \"ID_SIGNER_HERMETICWIPER_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"78f35b53-a02c-4745-9fb9-7f1da9d146a2\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843A82ED3B1F2BFBEE9671960E1940C942F688D\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"f9fd4b7d-fb7f-4ab6-8ff6-b7803fb6f6c7\",\n \"name\": \"ID_SIGNER_HERMETICWIPER_4\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"6cef63dc-c4c1-4779-84f1-e611fe8e2184\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"80854F578E2A3B5552EA839BA4F98DDFE94B2381\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"ac2dbfe8-1fc2-4925-b920-678aebd2911b\",\n \"name\": \"ID_SIGNER_NVIDIA_2007\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"efd876a9-28f7-4281-b1b0-788aebbe51d9\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"15C37DBEBE6FCC77108E3D7AD982676D3D5E77F7\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"b41f43c0-f223-430f-9dbd-3a77d0068a57\",\n \"name\": \"ID_SIGNER_NVIDIA_2011\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"1f525851-c9c4-4694-bbd8-75d46a9efa8a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"F049A238763D4A90B148AB10A500F96EBF1DC436\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"a87a069c-b2fc-409a-bd5f-0987f74141a6\",\n \"name\": \"ID_SIGNER_NVIDIA_2015\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"30bfa05d-0d4a-4d6e-901d-e2eaa92a628a\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"1D7E838ACCD498C2E5BA9373AF819EC097BB955C\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"8742ff2c-e3a2-4a26-89b1-6fcf5da3df2f\",\n \"name\": \"ID_SIGNER_ZEMANA_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"a7dc8a26-107f-4b39-83cb-155471f57c39\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843A82ED3B1F2BFBEE9671960E1940C942F688D\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"e796c44c-5571-4ca2-8f1f-3e642a6ef4e4\",\n \"name\": \"ID_SIGNER_ZEMANA_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"96bd0c0c-a218-4ec0-af33-9ee8416ff553\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"df12a86b-8adc-4942-a574-484a9dd438de\",\n \"name\": \"ID_SIGNER_ZEMANA_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ffd803ce-d5ed-47e5-8cd0-859edc3caa39\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"4843A82ED3B1F2BFBEE9671960E1940C942F688D\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"f1c69bd7-e4c6-4d2d-a0f4-fc2eb11aa717\",\n \"name\": \"ID_SIGNER_FILSECLAB\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d4183603-fe1f-4e97-a037-e13fc27d54bc\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"825181BD24428CF03C069B973C01BDF9F6D0291FD7F51F452C6C90F5EE73571C\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"b49341c2-fb43-437a-8c7c-e84a67e597ea\",\n \"name\": \"ID_SIGNER_NICHETECH\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"98dbe3ad-b457-4edb-a00b-2e4e7f8ea090\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"42b5ec2d-fe20-4f3b-b606-903589f30ca1\",\n \"name\": \"ID_SIGNER_CVM_SOFT_1\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"cccbd28d-363b-46d2-9749-701c53796c9c\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"15E7050789DF807F3E3174294A01B637A1239F603E42F4B5DB9398EFA9DA9996\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"eb5ae60b-97da-4f15-8d61-d28dcd83cb55\",\n \"name\": \"ID_SIGNER_CVM_SOFT_2\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"9c84a8bb-5b9f-4dce-b3f2-15fec8acc27e\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"FEC727AF43D1569995CEA26E8EB97167165842A5B185304425A92C03B71254C5D51222837515F33E60CB8ED2E8C625BA\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"480d43ab-a305-49ac-b1c8-bf0c0f1768fc\",\n \"name\": \"ID_SIGNER_CVM_SOFT_3\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"d6645c80-7ea4-4d2d-8ea3-7fd4f8dff5eb\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"BD1765C56594221373893EF26D97F88C144FB0E5A0111215B45D7239C3444DF7\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"2628acca-d43e-4b38-ba2c-e539c4636cf9\",\n \"name\": \"ID_SIGNER_CVM_SOFT_4\",\n \"os\": \"windows\"\n },\n {\n \"criteria\": [\n {\n \"criteriaid\": \"ddf65c14-5a12-47cb-b629-66b9c6121ca7\",\n \"field\": \"tbshash\",\n \"index\": 0,\n \"operation\": \"match\",\n \"value\": \"67B8386FFC9811CEAD5D88882EE2BD4DB6B516C1542ECB1FC9B8ADA932BFE8D9\"\n }\n ],\n \"criteria_count\": 1,\n \"metaruleid\": \"03a81ee8-63c9-4de0-9eb6-3b0618096c28\",\n \"name\": \"ID_SIGNER_ARTIFICIAL_SOFT\",\n \"os\": \"windows\"\n }\n ]\n }\n}"}],"_postman_id":"7f948dad-f5ab-46df-990a-6a46360ced72"},{"name":"/v1/blocklist/metarule/new","id":"632a0d08-0bb0-4446-9fad-52b9ed4f4883","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"/*\r\n * POST /v1/blocklist/metarule/new - Create Blocklist Metarule\r\n *\r\n * ============================================================================\r\n * REQUEST BODY\r\n * ============================================================================\r\n *\r\n * blocklistid (string, required) - Blocklist package timestamp ID\r\n * name (string, required) - Metarule name, max 128 chars\r\n * os (string, required) - \"windows\" | \"linux\" | \"mac\"\r\n * criteria (array, required) - 1-5 criteria objects (see below)\r\n * settings (object, optional) - Settings object (see below)\r\n *\r\n * ============================================================================\r\n * CRITERIA OBJECT\r\n * ============================================================================\r\n *\r\n * Each criteria object has: { \"field\": \"...\", \"operation\": \"...\", \"value\": \"...\" }\r\n * All criteria are processed as AND conditions.\r\n * Maximum 5 criteria per metarule.\r\n *\r\n * See /v1/application/metarule/new documentation for full list of valid fields\r\n * and operations - they are identical for blocklist metarules.\r\n *\r\n * ============================================================================\r\n * SETTINGS OBJECT\r\n * ============================================================================\r\n *\r\n * notification (int, optional) - User notification mode\r\n * 0 = Disabled\r\n * 1 = Default message (default)\r\n * 2 = Custom message\r\n * notification_text (string, optional) - Custom notification message (if notification = 2)\r\n * Max 2048 chars\r\n * upload (int, optional) - Upload execution events, 0 = Disabled, 1 = Enabled (default: 1)\r\n *\r\n * ============================================================================\r\n * VALUE FORMATS\r\n * ============================================================================\r\n *\r\n * JSON ESCAPING:\r\n * Backslashes must be escaped in JSON: C:\\example becomes \"C:\\\\example\"\r\n *\r\n * PIPE-SEPARATED VALUES (OR logic):\r\n * All fields support pipe-separated values for OR matching within a single criteria.\r\n * Examples (shown with JSON escaping):\r\n * publisher - \"Adobe Inc.|Microsoft Corporation|JetBrains s.r.o.\"\r\n * path - \"C:\\\\Program Files\\\\App1\\\\*|C:\\\\Program Files\\\\App2\\\\*\"\r\n * group - \"DOMAIN\\\\Admins|DOMAIN\\\\DevOps|DOMAIN\\\\QA\" (max 50 groups)\r\n * csgroup - \"Tenant\\\\Group1|Tenant\\\\Group2\" (max 50 groups)\r\n * hostname - \"SRV-*|WKS-*|DEV-*\"\r\n *\r\n * WILDCARD PATTERNS (for path, hostname fields with \"wildcard\" operation):\r\n * * - Single wildcard, matches any characters within one directory level (non-recursive)\r\n * Examples: C:\\example\\* | C:\\example\\*\\temp.exe | C:\\*system*\\*.exe\r\n * ** - Double wildcard, matches any characters recursively through subdirectories\r\n * Examples: C:\\example\\** | C:\\example\\**\\*.dll\r\n * ? - Question mark, matches exactly one character\r\n * Examples: C:\\example\\explore?.exe | ?:\\test.exe | C:\\example\\explorer.???\r\n *\r\n * All values max 2048 characters\r\n *\r\n * NOTE: Multiple criteria = AND logic. Pipe-separated values within a criteria = OR logic.\r\n *\r\n * ============================================================================\r\n * EXAMPLE REQUEST\r\n * ============================================================================\r\n */\r\n{\r\n \"blocklistid\": \"1752869448\",\r\n \"name\": \"Block Unsigned Executables from Temp Folders\",\r\n \"os\": \"windows\",\r\n \"criteria\": [\r\n { \"field\": \"path\", \"operation\": \"contains\", \"value\": \"\\\\Temp\\\\\" },\r\n { \"field\": \"publisher\", \"operation\": \"notcontains\", \"value\": \"Microsoft Corporation\" }\r\n ],\r\n \"settings\": {\r\n \"notification\": 2,\r\n \"notification_text\": \"This application has been blocked by security policy. Contact IT if you require access.\",\r\n \"upload\": 1\r\n }\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/blocklist/metarule/new","description":"

Create Blocklist Metarule

Update an existing Blocklist Metarule

Delete an existing Blocklist Metarule

List criteria inside an existing Metarule

Add Crtieria to a Blocklist Metarule

Update an existing Blocklist Metarule Criteria

Delete a Criteria inside an existing Blocklist Metarule

Update the Settings on a Blocklist Metarule

Endpoints for enumerating, creating, deleting and exporting Blocklist packages.

\n","_postman_id":"f0acd784-1915-414a-a240-3b3a5997858d","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Other","item":[{"name":"/v1/commlist","id":"0fdfe4cb-a8d8-4d32-a612-0de1be5618d2","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/commlist?groupid=37099f66-678e-4c46-872d-e1aad37a2224","description":"

This endpoint will return a listing of communication lists on the server. If an optional policyid is specified, it will only return the applied communication list for the given policy.

(Optional) Displays the communication list information for a given groupid. Not supplying this value will show all communication lists product wide.

\n","type":"text/plain"},"key":"groupid","value":"37099f66-678e-4c46-872d-e1aad37a2224"}],"variable":[]}},"response":[{"id":"ee6c82a1-00cf-4dd6-8933-f470d358565d","name":"/v1/commlist","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/commlist?groupid=37099f66-678e-4c46-872d-e1aad37a2224","host":["{{Server}}"],"path":["v1","commlist"],"query":[{"key":"groupid","value":"37099f66-678e-4c46-872d-e1aad37a2224","description":"(Optional) Displays the communication list information for a given policyid. Not supplying this value will show all communication lists product wide."}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 14 Nov 2024 11:01:30 GMT"},{"key":"Content-Length","value":"213"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"agentid\": [\n \"4ed4f246-ce8f-466a-8b0a-7946a3ef2ef3\",\n \"airlock-management-server\"\n ],\n \"commlistid\": \"764b0d42-7924-4363-bcaa-b1457b1aadcd\",\n \"mode\": \"balanced\",\n \"name\": \"NewRelay\",\n \"version\": \"0\"\n }\n}"}],"_postman_id":"0fdfe4cb-a8d8-4d32-a612-0de1be5618d2"},{"name":"/v1/domaingroups","id":"ffbd51c2-78d9-43b8-8dab-cf24a40acdb6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/domaingroups","description":"

Returns a listing of all available Domain Security Groups on an Airlock instance for use with the /v1/group/settings/selfservice endpoint.

Search the execution history of the Airlock instance to retrieve results based on a number of different parameters. If you want to recieve a high volume of all events or log continually via the REST API, please use the /v1/logging endpoints.

Currently this contains one endpoint for searching the product for file information called 'getexechistory'.

\n","_postman_id":"b5f8c67b-a5ac-4f13-81da-1e495bbe8690","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Group","item":[{"name":"/v1/group","id":"c3680b8f-6315-4769-a7c8-d1b149e41857","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group","description":"

Returns a listing of all policy groups within Airlock, including their 'groupid', 'name' and 'parent' group (if applicable)

Returns a listing of computers within a specific policy group by supplying the groupid of a target group. Unique 'groupid' parameters can be obtained from the /group endpoint.

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"}],"variable":[]}},"response":[{"id":"c214e860-8ae0-4dac-aa89-1740aaa45672","name":"/v1/group/agents","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/agents?groupid=97cfece6-624e-4437-9882-4db0f480e0ad","host":["{{Server}}"],"path":["v1","group","agents"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target groupid"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:27:16 GMT"},{"key":"Content-Length","value":"380"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"agents\": [\n {\n \"agentid\": \"c9950bab-7998-4a9c-8792-c506b027be64\",\n \"clientversion\": \"5.1.0.375\",\n \"domain\": \"Centos8.4Minimal\",\n \"freespace\": \"94\",\n \"groupid\": \"97cfece6-624e-4437-9882-4db0f480e0ad\",\n \"hostname\": \"Centos8.4Minimal\",\n \"ip\": \"120.47.121.55\",\n \"lastcheckin\": \"2023-12-07T00:24:45Z\",\n \"os\": \"CentOS Linux 8\",\n \"policyversion\": \"25432.\",\n \"status\": 0,\n \"username\": \"root\"\n }\n ]\n }\n}"}],"_postman_id":"0f0ff737-a843-4900-b749-8273e02cfb6b"},{"name":"/v1/group/assign","id":"e5a1d42d-0c68-4730-a406-d463bf33983c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/assign?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&targetgroupid=c698d44d-a307-494e-9149-cd349781bcf1","description":"

Assign all policies currently applied to one groupid, to another groupid, this effectively 'clones' the configuration of a group.

Note: This endpoint will only clone configurations that are applied directly to the group and will not clone configurations that are applied through inheritance. If you would like to recreate the resultant policy of a parent and child group, it is recommended to create a parent and child group and clone both the parent and the child seperately to obtain the same policy configuration.

(Required) Source GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) Target GroupID

\n","type":"text/plain"},"key":"targetgroupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"}],"variable":[]}},"response":[{"id":"3c9aa486-e3ce-40ac-bfb0-ca460b1fbf8c","name":"/v1/group/assign","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/assign?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&targetgroupid=c698d44d-a307-494e-9149-cd349781bcf1","host":["{{Server}}"],"path":["v1","group","assign"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Source GroupID"},{"key":"targetgroupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Target GroupID"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:29:47 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"e5a1d42d-0c68-4730-a406-d463bf33983c"},{"name":"/v1/group/clone","id":"a9304222-efd1-4bcf-bc3a-63995952dd9e","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/clone?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&name=Windows Servers Clone","description":"

Assign all policies currently applied to one groupid, to another groupid, this effectively 'clones' the configuration of a group.

(Required) Source GroupID to Clone

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) The Name of the New Group

\n","type":"text/plain"},"key":"name","value":"Windows Servers Clone"}],"variable":[]}},"response":[{"id":"c3699a50-8a1b-4df7-ac40-91c56808af46","name":"/v1/group/clone","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/clone?groupid=05e9c43b-b0c1-4964-9106-0a4d37824578&name=Cloned Parent 2","host":["{{Server}}"],"path":["v1","group","clone"],"query":[{"key":"groupid","value":"05e9c43b-b0c1-4964-9106-0a4d37824578","description":"(Required) Source GroupID to Clone"},{"key":"name","value":"Cloned Parent 2","description":"(Required) The Name of the New Group"}]}},"status":"OK","code":200,"_postman_previewlanguage":null,"header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 18 Dec 2025 11:10:06 GMT"},{"key":"Content-Length","value":"81"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"groupid\": \"26c61504-ed36-4243-9bc0-7fe87907d79a\"\n }\n}"}],"_postman_id":"a9304222-efd1-4bcf-bc3a-63995952dd9e"},{"name":"/v1/group/policies","id":"3d85c891-d89a-4ea5-945e-61ac9a707fe3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/policies?groupid=c698d44d-a307-494e-9149-cd349781bcf1","description":"

Retrieve the policy applied to a group by specifying a target 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint.

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"}],"variable":[]}},"response":[{"id":"17634bad-5505-451b-8d93-d911fe749836","name":"/v1/group/policies","originalRequest":{"method":"POST","header":[],"url":{"raw":"https://al100.ci.managedwhitelisting.com:3129/v1/group/policies?groupid=c698d44d-a307-494e-9149-cd349781bcf1","protocol":"https","host":["al100","ci","managedwhitelisting","com"],"port":"3129","path":["v1","group","policies"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Target groupid"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 14 Nov 2024 11:37:16 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"agentstopcode\": \"\",\n \"applications\": [\n {\n \"applicationid\": \"1570641682\",\n \"name\": \"Airlock Enforcement Agents\",\n \"version\": \"\"\n }\n ],\n \"auditmode\": 0,\n \"autoupdate\": 0,\n \"baselines\": [\n {\n \"baselineid\": \"1567253648\",\n \"name\": \"Windows 10 1903 x64 May 2019 (Reference)\"\n },\n {\n \"baselineid\": \"1569941628\",\n \"name\": \"Windows 10 1803 x64 May 2019 (Reference)\"\n },\n {\n \"baselineid\": \"1597574944\",\n \"name\": \"Windows 10 2004 x86 RTM (Reference)\"\n }\n ],\n \"batch\": 1,\n \"blocklists\": null,\n \"check_ea\": 0,\n \"command\": 1,\n \"commlist\": [\n {\n \"ip\": \"13.7.89.10\",\n \"name\": \"test.server.com\"\n }\n ],\n \"commlistid\": \"airlock-default-communication-list\",\n \"compiledhtml\": 1,\n \"dylib\": 0,\n \"enable_notifications\": 1,\n \"extensions_enabled\": 0,\n \"generalisation\": 0,\n \"gprocesses\": null,\n \"groupid\": \"c698d44d-a307-494e-9149-cd349781bcf1\",\n \"hashdb_ver\": \"215\",\n \"htmlapplication\": 1,\n \"javaapplication\": 1,\n \"javascript\": 1,\n \"modreload\": 0,\n \"name\": \"ADL Workstations\",\n \"notification_message\": \"%filename% has been prevented from executing as a result of Application Whitelisting. If this event caused unexpected system behaviour please contact your Administrator\",\n \"parent\": \"Airlock Groups\",\n \"paths\": [\n {\n \"comment\": \"\",\n \"name\": \"C:\\\\\\\\Windows\\\\\\\\assembly\\\\\\\\GAC*\\\\\\\\*\\\\\\\\*.*.*_*\\\\\\\\*.dll\"\n },\n {\n \"comment\": \"\",\n \"name\": \"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\__PSScriptPolicyTest_????????.???.ps1\"\n },\n {\n \"comment\": \"\",\n \"name\": \"C:\\\\\\\\Users\\\\\\\\*\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\__PSScriptPolicyTest_????????.???.ps1\"\n }\n ],\n \"policyver\": \"316\",\n \"poll_time\": 600,\n \"powershell\": 1,\n \"pprocesses\": [\n {\n \"comment\": \"comment on inherited proc\",\n \"name\": \"testprocInherited.exe\"\n }\n ],\n \"proxyauth\": 0,\n \"proxyenabled\": 0,\n \"proxypass\": \"\",\n \"proxyport\": \"\",\n \"proxyserver\": \"\",\n \"proxyuser\": \"\",\n \"pslockdown\": 0,\n \"publishers\": [\n {\n \"comment\": \"\",\n \"name\": \"Microsoft Corporation\"\n },\n {\n \"comment\": \"\",\n \"name\": \"Microsoft Dynamic Code Publisher\"\n },\n {\n \"comment\": \"\",\n \"name\": \"Microsoft Windows\"\n }\n ],\n \"python\": 1,\n \"reflection\": 0,\n \"script_custom\": 0,\n \"script_enabled\": 2,\n \"selfservice\": 0,\n \"selfupgrade\": 0,\n \"shellscript\": 0,\n \"targetvers\": [\n {\n \"linux\": \"\",\n \"macos\": \"6.1.0.8047\",\n \"windows\": \"\"\n }\n ],\n \"trusted_config\": false,\n \"trusted_upload\": 0,\n \"vbscript\": 1,\n \"windowsinstaller\": 1,\n \"windowsscriptcomponent\": 1\n }\n}"}],"_postman_id":"3d85c891-d89a-4ea5-945e-61ac9a707fe3"},{"name":"/v1/group/application/approve","id":"d496341d-7553-474d-88d4-d83c63613996","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/application/approve?groupid=c698d44d-a307-494e-9149-cd349781bcf1&applicationid=1570641612","description":"

Approve an Allowlist within a computer group by specifying the 'groupid' and 'applicationid' parameters. Unique 'groupid' parameters can be obtained from the /group endpoint and unique 'applicationid' parameters can be obtained from the /application endpoint.

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"},{"description":{"content":"

(Required) Target applicationid to approve

\n","type":"text/plain"},"key":"applicationid","value":"1570641612"}],"variable":[]}},"response":[{"id":"1adbfded-b1a1-43d9-8c11-88734f735040","name":"/v1/group/application/approve","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/application/approve?groupid=c698d44d-a307-494e-9149-cd349781bcf1&applicationid=1570641612","host":["{{Server}}"],"path":["v1","group","application","approve"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Target groupid"},{"key":"applicationid","value":"1570641612","description":"(Required) Target applicationid to approve"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:39:16 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"d496341d-7553-474d-88d4-d83c63613996"},{"name":"/v1/group/application/deny","id":"79b24158-06b6-4ddf-8328-2a3ae06939d7","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/application/deny?groupid=c698d44d-a307-494e-9149-cd349781bcf1&applicationid=1570641612","description":"

Deny an Allowlist within a group by supplying the 'groupid' of the group and the 'applicationid' of the Allowlist you want to deny. Unique 'groupid' parameters can be obtained from the /group endpoint and unique 'applicationid' parameters can be obtained from the /application endpoint.

(Required) Target groupid to deny

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"},{"description":{"content":"

(Required) Target applicationid to deny

\n","type":"text/plain"},"key":"applicationid","value":"1570641612"}],"variable":[]}},"response":[{"id":"45b6bed6-6c49-4fc0-8a41-09774621296a","name":"/v1/group/application/deny","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/application/deny?groupid=c698d44d-a307-494e-9149-cd349781bcf1&applicationid=1570641612","host":["{{Server}}"],"path":["v1","group","application","deny"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Target groupid to deny"},{"key":"applicationid","value":"1570641612","description":"(Required) Target applicationid to deny"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:39:54 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"79b24158-06b6-4ddf-8328-2a3ae06939d7"},{"name":"/v1/group/baseline/approve","id":"4d4bad55-5f2d-4d0d-b130-a42100430bb1","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/baseline/approve?groupid=c698d44d-a307-494e-9149-cd349781bcf1&baselineid=1567253648","description":"

Approve a baseline within a computer group by specifying the 'groupid' and 'baselineid' parameters. Unique 'groupid' parameters can be obtained from the /group endpoint and unique 'baselineid' parameters can be obtained from the /baseline endpoint.

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"},{"description":{"content":"

(Required) Target baselineid to approve

\n","type":"text/plain"},"key":"baselineid","value":"1567253648"}],"variable":[]}},"response":[{"id":"5a696e37-d160-4d14-8e0f-7914812327a8","name":"/v1/group/baseline/approve","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/baseline/approve?groupid=c698d44d-a307-494e-9149-cd349781bcf1&baselineid=1567253648","host":["{{Server}}"],"path":["v1","group","baseline","approve"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Target groupid"},{"key":"baselineid","value":"1567253648","description":"(Required) Target baselineid to approve"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:40:51 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"4d4bad55-5f2d-4d0d-b130-a42100430bb1"},{"name":"/v1/group/baseline/deny","id":"1ad67b83-e776-4e0c-9082-794e2575ceb4","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/baseline/deny?groupid=c698d44d-a307-494e-9149-cd349781bcf1&baselineid=1567253648","description":"

Deny a Baseline within a computer group by specifying the 'groupid' and 'baselineid' parameters. Unique 'groupid' parameters can be obtained from the /group endpoint and unique 'baselineid' parameters can be obtained from the /baseline endpoint.

(Required) groupid is the unique ID of the group you want to deny a baseilne inside of

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"},{"description":{"content":"

(Required) baselineid is the unique ID for the baseline you want to deny within a group

\n","type":"text/plain"},"key":"baselineid","value":"1567253648"}],"variable":[]}},"response":[{"id":"ceaed757-3359-4edb-8b56-5809823b5ee7","name":"/v1/group/baseline/deny","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/baseline/deny?groupid=c698d44d-a307-494e-9149-cd349781bcf1&baselineid=1567253648","host":["{{Server}}"],"path":["v1","group","baseline","deny"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) groupid is the unique ID of the group you want to deny a baseilne inside of"},{"key":"baselineid","value":"1567253648","description":"(Required) baselineid is the unique ID for the baseline you want to deny within a group"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:41:39 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"1ad67b83-e776-4e0c-9082-794e2575ceb4"},{"name":"/v1/group/blocklist/approve","id":"290a39bb-b150-435a-bc1a-6cc47031c803","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/blocklist/approve?groupid=c698d44d-a307-494e-9149-cd349781bcf1&blocklistid=1567173746&audit=1","description":"

Set a Blocklist package in a specific Policy Group to Audit or Enforcement.

(Required) Group ID

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"},{"description":{"content":"

(Required) Blocklist ID

\n","type":"text/plain"},"key":"blocklistid","value":"1567173746"},{"description":{"content":"

(Required) audit mode / 1 = audit, 0 = enforcement

\n","type":"text/plain"},"key":"audit","value":"1"}],"variable":[]}},"response":[{"id":"14bdf74c-2e69-48ee-b0c7-e6997cfbc884","name":"/v1/group/blocklist/approve","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/blocklist/approve?groupid=c698d44d-a307-494e-9149-cd349781bcf1&blocklistid=1567173746&audit=1","host":["{{Server}}"],"path":["v1","group","blocklist","approve"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Group ID"},{"key":"blocklistid","value":"1567173746","description":"(Required) Blocklist ID"},{"key":"audit","value":"1","description":"(Required) audit mode / 1 = audit, 0 = enforcement"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:42:27 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"290a39bb-b150-435a-bc1a-6cc47031c803"},{"name":"/v1/group/blocklist/deny","id":"b137ac2e-5de2-4e71-8a75-f9e65050daff","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/blocklist/deny?groupid=c698d44d-a307-494e-9149-cd349781bcf1&blocklistid=1567173746","description":"

Deny a Blocklist package in a specific Policy Group.

(Required) Group ID

\n","type":"text/plain"},"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1"},{"description":{"content":"

(Required) Blocklist ID to deny

\n","type":"text/plain"},"key":"blocklistid","value":"1567173746"}],"variable":[]}},"response":[{"id":"1a3eada4-d1b0-49c4-b5e2-c1605c4fac04","name":"/v1/group/blocklist/deny","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/blocklist/deny?groupid=c698d44d-a307-494e-9149-cd349781bcf1&blocklistid=1567173746","host":["{{Server}}"],"path":["v1","group","blocklist","deny"],"query":[{"key":"groupid","value":"c698d44d-a307-494e-9149-cd349781bcf1","description":"(Required) Group ID"},{"key":"blocklistid","value":"1567173746","description":"(Required) Blocklist ID to deny"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:42:59 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"b137ac2e-5de2-4e71-8a75-f9e65050daff"},{"name":"/v1/group/new","id":"faa899ee-a235-467d-aeba-2e7e566e0919","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/new?name=My New Group&parent&hidden=0","description":"

This endpoint allows for new computer groups within Airlock to be created, child groups can be created by specifying the 'parent' group you would like the group to be created inside of. Additionally, you can specify groups to be 'hidden' from the UI and be used as staging groups (enforcement agents can't be placed inside hidden groups).

(Required) Name of the new group

\n","type":"text/plain"},"key":"name","value":"My New Group"},{"description":{"content":"

(Optional) GroupID of the parent group

\n","type":"text/plain"},"key":"parent","value":null},{"description":{"content":"

(Optional) 0 = Visible, 1 = Hidden

\n","type":"text/plain"},"key":"hidden","value":"0"}],"variable":[]}},"response":[{"id":"c593dd1f-49c6-48d0-8d46-f36bb3e2ca16","name":"/v1/group/new","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/new?name=My New Group&parent&hidden=0","host":["{{Server}}"],"path":["v1","group","new"],"query":[{"key":"name","value":"My New Group","description":"(Required) Name of the new group"},{"key":"parent","value":null,"description":"(Optional) GroupID of the parent group"},{"key":"hidden","value":"0","description":"(Optional) 0 = Visible, 1 = Hidden"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:43:46 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"faa899ee-a235-467d-aeba-2e7e566e0919"},{"name":"/v1/group/remove","id":"f917b553-dcda-4fe1-a6af-1aae3b1e5862","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/remove?groupid=a2b754a5-ff01-4d34-9070-e8e727886a8b","description":"

Delete a Policy Group by supplying the 'groupid' you want to delete. Unique 'groupid' parameters can be obtained from the /group endpoint.

(Required) Target GroupID to remove

\n","type":"text/plain"},"key":"groupid","value":"a2b754a5-ff01-4d34-9070-e8e727886a8b"}],"variable":[]}},"response":[{"id":"35b95b02-47e0-464b-b4f9-3e56b235071b","name":"/v1/group/remove","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/remove?groupid=a2b754a5-ff01-4d34-9070-e8e727886a8b","host":["{{Server}}"],"path":["v1","group","remove"],"query":[{"key":"groupid","value":"a2b754a5-ff01-4d34-9070-e8e727886a8b","description":"(Required) Target GroupID to remove"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:48:43 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"f917b553-dcda-4fe1-a6af-1aae3b1e5862"},{"name":"/v1/group/path/add","id":"bf45480d-0c43-44eb-af7e-f1e136529153","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"37099f66-678e-4c46-872d-e1aad37a2224\", //(Required) Target GroupID\r\n \"path\": [\"C:\\\\Program Files\\\\Adobe Reader\\\\*.dll\",\"C:\\\\Windows\\\\Microsoft.NET\\\\assembly\\\\*_*\",\"/bin/touch\"] //(Required) An Array of Paths to Add. Windows path separators must be properly escaped to be JSON valid\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/group/path/add","description":"

This endpoint allows for Path Exclusions to be added to a Policy Group by supplying the target 'groupid' and the 'path' you wish to add. Unique 'groupid' parameters can be obtained from the /group endpoint.

Note: You can supply one path through query parameters OR multiple paths in a JSON formatted array as shown below. Paths must be correctly escaped when supplied in JSON.

(Required) GroupID of the target group

\n","type":"text/plain"},"key":"groupid","value":"37099f66-678e-4c46-872d-e1aad37a2224"},{"disabled":true,"description":{"content":"

(Required) Path Exclusion to add

\n","type":"text/plain"},"key":"path","value":"C:\\Program Files\\Adobe Reader\\*.dll2"}],"variable":[]}},"response":[{"id":"35324cae-a218-423a-a0c5-b0576ca5dec9","name":"/v1/group/path/add","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/path/add?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&path=C:\\Program Files\\Adobe Reader\\*.dll","host":["{{Server}}"],"path":["v1","group","path","add"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of the target group"},{"key":"path","value":"C:\\Program Files\\Adobe Reader\\*.dll","description":"(Required) Path Exclusion to add"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:50:43 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"},{"id":"487e8b83-4878-437e-97cf-9e9931f3e6fe","name":"/v1/group/path/add","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"37099f66-678e-4c46-872d-e1aad37a2224\", //(Required) Target GroupID\r\n \"path\": [\"C:\\\\Program Files\\\\Adobe Reader\\\\*.dll\",\"C:\\\\Windows\\\\Microsoft.NET\\\\assembly\\\\*_*\",\"/bin/touch\"] //(Required) An Array of Paths to Add. Windows path separators must be properly escaped to be JSON valid\r\n}","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/group/path/add","host":["{{Server}}"],"path":["v1","group","path","add"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of the target group","disabled":true},{"key":"path","value":"C:\\Program Files\\Adobe Reader\\*.dll","description":"(Required) Path Exclusion to add","disabled":true}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Wed, 19 Feb 2025 10:00:51 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"bf45480d-0c43-44eb-af7e-f1e136529153"},{"name":"/v1/group/path/remove","id":"c39fb39c-0741-4c78-bf67-0b7a36546bb0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/path/remove?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&path=C:\\Program Files\\Adobe Reader\\*.dll","description":"

This endpoint allows for Path Exclusions to be removed from a Policy Group by supplying a target 'groupid' and the 'path' you wish to remove. Unique 'groupid' parameters can be obtained from the /group endpoint.

(Required) GroupID of the target group

\n","type":"text/plain"},"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3"},{"description":{"content":"

(Required) Path exclusion to remove

\n","type":"text/plain"},"key":"path","value":"C:\\Program Files\\Adobe Reader\\*.dll"}],"variable":[]}},"response":[{"id":"0ba45594-607a-4a34-8fee-25a760b149b1","name":"/v1/group/path/remove","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/path/remove?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&path=C:\\Program Files\\Adobe Reader\\*.dll","host":["{{Server}}"],"path":["v1","group","path","remove"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of the target group"},{"key":"path","value":"C:\\Program Files\\Adobe Reader\\*.dll","description":"(Required) Path exclusion to remove"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:52:35 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"c39fb39c-0741-4c78-bf67-0b7a36546bb0"},{"name":"/v1/group/process/add","id":"6d1e5536-7837-46d7-9044-697e2dd5aae6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"37099f66-678e-4c46-872d-e1aad37a2224\", //(Required) GroupID of the target group\r\n \"processes\": [ //(Required) Processes Block for an array of processes\r\n {\r\n \"process\": \"acrord32\",\r\n \"type\": \"pprocess\",\r\n \"comment\": \"acrobat\"\r\n },\r\n {\r\n \"process\": \"vstudio.exe\",\r\n \"type\": \"pprocess\",\r\n \"comment\": \"run visual studio\"\r\n },\r\n {\r\n \"process\": \"C:\\\\pathto\\\\my_parent_process.exe\",\r\n \"type\": \"gprocess\"\r\n }\r\n ]\r\n}\r\n\r\n//Processes Array\r\n//(Required) 'process' Rule to add\r\n//(Required) 'type' The type of process rule to add, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule.\r\n//(Optional) 'comment' Comment to add to the process rule","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/group/process/add","description":"

This endpoint allows for Process exclusions to be added to a target group, including the type of rule to be added.

Note: You can supply one process through query parameters OR multiple processes in a JSON formatted array as shown below. Where processes contain full paths, they must be correctly escaped when supplied in JSON.

(Required) GroupID of the target group

\n","type":"text/plain"},"key":"groupid","value":"debd0f24-e206-4b21-8b5a-ddab44ddab33"},{"disabled":true,"description":{"content":"

(Required) Process rule to add

\n","type":"text/plain"},"key":"process","value":"myinvisibleprocess2.exe"},{"disabled":true,"description":{"content":"

(Required) The type of process rule to add, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule.

\n","type":"text/plain"},"key":"type","value":"pprocess"},{"disabled":true,"description":{"content":"

(Optional) Comment to add to the process rule

\n","type":"text/plain"},"key":"comment","value":"Reason why the rule is added"}],"variable":[]}},"response":[{"id":"5eb73b32-e1d8-4800-ae5d-5d4aff236d4c","name":"/v1/group/process/add","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/process/add?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&process=my_parent_process.exe&type=pprocess&comment=Reason why the rule is added","host":["{{Server}}"],"path":["v1","group","process","add"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of the target group"},{"key":"process","value":"my_parent_process.exe","description":"(Required) Process rule to add"},{"key":"type","value":"pprocess","description":"(Required) The type of process rule to add, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule."},{"key":"comment","value":"Reason why the rule is added","description":"(Optional) Comment to add to the process rule"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 09 May 2024 06:25:21 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"},{"id":"e531bc0d-5eb9-48ed-a7df-0cd16d5b813b","name":"/v1/group/process/add","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"37099f66-678e-4c46-872d-e1aad37a2224\", //(Required) GroupID of the target group\r\n \"processes\": [ //(Required) Processes Block for an array of processes\r\n {\r\n \"process\": \"acrord32\",\r\n \"type\": \"pprocess\",\r\n \"comment\": \"acrobat\"\r\n },\r\n {\r\n \"process\": \"vstudio.exe\",\r\n \"type\": \"pprocess\",\r\n \"comment\": \"run visual studio\"\r\n },\r\n {\r\n \"process\": \"C:\\\\pathto\\\\my_parent_process.exe\",\r\n \"type\": \"gprocess\"\r\n }\r\n ]\r\n}\r\n\r\n//Processes Array\r\n//(Required) 'process' Rule to add\r\n//(Required) 'type' The type of process rule to add, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule.\r\n//(Optional) 'comment' Comment to add to the process rule","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/group/process/add","host":["{{Server}}"],"path":["v1","group","process","add"],"query":[{"key":"groupid","value":"debd0f24-e206-4b21-8b5a-ddab44ddab33","description":"(Required) GroupID of the target group","disabled":true},{"key":"process","value":"myinvisibleprocess2.exe","description":"(Required) Process rule to add","disabled":true},{"key":"type","value":"pprocess","description":"(Required) The type of process rule to add, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule.","disabled":true},{"key":"comment","value":"Reason why the rule is added","description":"(Optional) Comment to add to the process rule","disabled":true}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Wed, 19 Feb 2025 11:53:15 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"6d1e5536-7837-46d7-9044-697e2dd5aae6"},{"name":"/v1/group/process/remove","id":"9d089cf3-f94a-4c25-bd5e-da991a1cd507","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/process/remove?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&process=my_parent_process.exe&type=pprocess","description":"

This endpoint allows for Process exclusions to be removed from a target group, including the type of rule to be removed.

(Required) GroupID of the target group

\n","type":"text/plain"},"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3"},{"description":{"content":"

(Required) Process rule to remove

\n","type":"text/plain"},"key":"process","value":"my_parent_process.exe"},{"description":{"content":"

(Required) The type of process rule to remove, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule.

\n","type":"text/plain"},"key":"type","value":"pprocess"}],"variable":[]}},"response":[{"id":"263946b5-7b43-4f6c-8df8-3a332045cd05","name":"/v1/group/process/remove","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/process/remove?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&process=my_parent_process.exe&type=pprocess","host":["{{Server}}"],"path":["v1","group","process","remove"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of the target group"},{"key":"process","value":"my_parent_process.exe","description":"(Required) Process rule to remove"},{"key":"type","value":"pprocess","description":"(Required) The type of process rule to remove, specify 'pprocess' for a Parent Process rule and 'gprocess' for a Grandparent Process rule."}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 09 May 2024 15:58:16 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"9d089cf3-f94a-4c25-bd5e-da991a1cd507"},{"name":"/v1/group/publisher/add","id":"18f32fa5-18c3-4613-a440-689260c54652","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"37099f66-678e-4c46-872d-e1aad37a2224\", //(Required) Target GroupID\r\n \"publisher\": [\"Adobe Inc\",\"Microsoft Windows\",\"Contoso\"] //(Required) An Array of Publisher Names to Add \r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/group/publisher/add","description":"

This endpoint allows for Publishers to be trusted within a Policy Group by supplying the name of the 'publisher' you wish to add and the target 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint.

Note: You can supply one publisher through query parameters OR multiple publishers in a JSON formatted array as shown below.

(Required) GroupID of Target Group

\n","type":"text/plain"},"key":"groupid","value":"37099f66-678e-4c46-872d-e1aad37a2224"},{"disabled":true,"description":{"content":"

(Required) Publisher name to add

\n","type":"text/plain"},"key":"publisher","value":"Contoso Inc"}],"variable":[]}},"response":[{"id":"fbc31424-d22c-4559-9317-4ea89a7ae570","name":"/v1/group/publisher/add","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/publisher/add?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&publisher=Contoso Inc","host":["{{Server}}"],"path":["v1","group","publisher","add"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of Target Group"},{"key":"publisher","value":"Contoso Inc","description":"(Required) Publisher name to add"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:54:01 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"},{"id":"318205e4-7ff8-4e7c-9989-04325ceae5ca","name":"/v1/group/publisher/add","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"37099f66-678e-4c46-872d-e1aad37a2224\", //(Required) Target GroupID\r\n \"publisher\": [\"Adobe Inc\",\"Microsoft Windows\",\"Contoso\"] //(Required) An Array of Publisher Names to Add \r\n}","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/group/publisher/add","host":["{{Server}}"],"path":["v1","group","publisher","add"],"query":[{"key":"groupid","value":"37099f66-678e-4c46-872d-e1aad37a2224","description":"(Required) GroupID of Target Group","disabled":true},{"key":"publisher","value":"Contoso Inc","description":"(Required) Publisher name to add","disabled":true}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Tue, 18 Feb 2025 07:32:42 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"18f32fa5-18c3-4613-a440-689260c54652"},{"name":"/v1/group/publisher/remove","id":"b08f9f46-a997-4005-9d92-47fb606b93f8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/publisher/remove?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&publisher=Contoso Inc","description":"

This endpoint allows for publishers to be removed from a Policy Group by supplying the name of the 'publisher' you wish to remove and a target 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint.

(Required) GroupID of target group

\n","type":"text/plain"},"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3"},{"description":{"content":"

(Required) Name of the publisher to remove

\n","type":"text/plain"},"key":"publisher","value":"Contoso Inc"}],"variable":[]}},"response":[{"id":"93abf895-b683-482f-b887-7fd0054793c4","name":"/v1/group/publisher/remove","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/publisher/remove?groupid=f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3&publisher=Contoso Inc","host":["{{Server}}"],"path":["v1","group","publisher","remove"],"query":[{"key":"groupid","value":"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3","description":"(Required) GroupID of target group"},{"key":"publisher","value":"Contoso Inc","description":"(Required) Name of the publisher to remove"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 13:54:37 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"b08f9f46-a997-4005-9d92-47fb606b93f8"},{"name":"/v1/group/settings/updateall","id":"5bb0b370-f5c1-4ffb-a854-e2f32f384e81","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\":\"f276fa4d-01bf-4d86-8d08-8cfd82a8b1e3\", //(Required) Target GroupID\r\n \"script_enabled\": 1, //(Required) Script Control, 0 = Disabled, 1 = Enabled\r\n \"auditmode\": 0, //(Required) Audit mode, 0 = Disabled, 1 = Enabled\r\n \"batch\": 1, //(Required) Batch scripts, 0 = Disabled, 1 = Enabled\r\n \"powershell\": 1, //(Required) Powershell scripts, 0 = Disabled, 1 = Enabled\r\n \"command\": 1, //(Required) Command scripts, 0 = Disabled, 1 = Enabled\r\n \"vbscript\": 1, //(Required) VBScript, 0 = Disabled, 1 = Enabled\r\n \"javascript\": 1, //(Required) Javascript, 0 = Disabled, 1 = Enabled\r\n \"windowsinstaller\": 1, //(Required) Windows Installer, 0 = Disabled, 1 = Enabled\r\n \"htmlapplications\": 1, //(Required) HTML applications, 0 = Disabled, 1 = Enabled\r\n \"javaapplications\": 1, //(Required) Java applications, 0 = Disabled, 1 = Enabled\r\n \"windowsscriptcomponent\": 1, //(Required) Windows script component, 0 = Disabled, 1 = Enabled\r\n \"compiledhtml\": 1, //(Required)\r\n \"shellscript\": 1, //(Required)\r\n \"dylib\": 1, //(Required)\r\n \"python\": 1, //(Required) Python scripts, 0 = Disabled, 1 = Enabled\r\n \"poll_time\": 300, //(Required) Client Polling time, in seconds\r\n \"pslockdown\": 2, //(Required) Powershell Language Mode, 0 = Default, 1 = Full Language, 2 = Contrained Language\r\n \"proxyenabled\": 0, //(Required) Enable/Disable Proxy, 0 = Disabled, 1 = Enabled\r\n \"proxyserver\": \"my.proxy.server\", //(Required IF proxyenabled = 1) Proxy Server FQDN/IP\r\n \"proxyport\": \"8080\", //(Required IF proxyenabled = 1) Proxy Port Number\r\n \"proxyauth\": \"1\", //(Required IF proxyenabled = 1) Enable/Disable Proxy Auth, 0 = Disabled, 1 = Enabled\r\n \"proxyuser\": \"my_proxy_user\", //(Required IF proxyenabled = 1) Proxy Username to use if proxyauth enabled\r\n \"proxypass\": \"my_proxy_password\", //(Required IF proxyenabled = 1) Proxy Password to use if proxyauth enabled\r\n \"enable_notifications\": 1, //(Required) Enable User Notifications, 0 = Disabled, 1 = Enabled\r\n \"notification_message\": \"Message to Display\", // (Required) Notification message\r\n \"agentstopcode\": \"myagentpassword\", //(Required) Stop Code for the MSI\r\n \"generalisation\": 0, //(Required) Agent Runtime Generalisation, 0 = Disabled, 1 = Enabled\r\n \"browser\": 2, //(Required) 0 = Disabled, 1 = Enabled (Respect Policy), 2 = Enabled (Audit Only)\r\n \"mitrustedinstaller\": 1, //(Required) Microsoft Managed Installer Trust, 0 = Disabled, 1 = Enabled, 2 = Enabled With Trusted Logging\r\n \"trusted_upload\": 0, //(Required) Trusted Execution Activity Uploading, 0 = Per Rule, 1 = All Rules (Complete), 2 = All Rules (Summary)\r\n \"selfupgrade\": 0, //(Required) Self Upgrading Agent, 0 = Disabled, 1 = Enabled\r\n \"windows\": \"5.3.1.4044\", //(Required IF selfupgrade = 1) Target Agent Upgrade Version\r\n \"linux\": \"5.2.0.1\", //(Required IF selfupgrade = 1) Target Agent Upgrade Version\r\n \"macos\": \"5.3.0.3013\", //(Required IF selfupgrade = 1) Target Agent Upgrade Version\r\n \"reflection\": \"1\", //(Required) Assembly Reflection 0 = Disabled, 1 = Enabled\r\n \"commlistid\": \"airlock-default-communication-list\" //(Required) Communication List ID use \"airlock-default-communication-list\" for the default communication list\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/group/settings/updateall","description":"

Update the settings of a specific Policy Group by specifying the groupid. When this endpoint is used, nearly all parameters must be specified in a single request, if you would like to configure settings individually use other /v1/group/settings REST API endpoints.

Set a Policy Groups Client Notifications to enabled or disabled

(Required) GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) set notification, 0 = Disabled, 1 = Enabled

\n","type":"text/plain"},"key":"enable_notifications","value":"1"}],"variable":[]}},"response":[{"id":"9e2c4662-03c3-452e-862b-f4d31615e649","name":"/v1/group/settings/notification","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/enable_notifications?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&enable_notifications=1","host":["{{Server}}"],"path":["v1","group","settings","enable_notifications"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) GroupID"},{"key":"enable_notifications","value":"1","description":"(Required) set notification, 0 = Disabled, 1 = Enabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 03:13:51 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"f3e3d13e-44d3-4495-83a2-b10c31bf8ab0"},{"name":"/v1/group/settings/notification_message","id":"ba18296b-6442-413b-8d93-b04c6094cc93","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/notification_message?groupid=97cfece6-624e-4437-9882-4db0f480e0ad¬ification_message=This is the message","description":"

Set a Policy Groups Notification Message which is displayed on endpoints when a file is blocked.

Supported variables within the message are:
%filename% - Displays the name of the blocked file
%filepath% - Displays the path of the blocked file
%filehash% - Displays the hash of the blocked file
%fileparent% - Displays the parent process of the blocked file
%filepub% - Displays the publisher of the blocked file
%filecreation% - Displays the creation date of the blocked file %emailbutton|button_text|email_address% - Mailto button for sending an email
%urlbutton|button_text|hxxp://url% - URL button for links

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) message is the string the client will see

\n","type":"text/plain"},"key":"notification_message","value":"This is the message"}],"variable":[]}},"response":[{"id":"d3cae676-ede5-4cbd-bf9a-6745f7020261","name":"/v1/group/settings/notification/message","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/notification_message?groupid=97cfece6-624e-4437-9882-4db0f480e0ad¬ification_message=This is the message","host":["{{Server}}"],"path":["v1","group","settings","notification_message"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target groupid"},{"key":"notification_message","value":"This is the message","description":"(Required) message is the string the client will see"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 03:14:07 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"ba18296b-6442-413b-8d93-b04c6094cc93"},{"name":"/v1/group/settings/auditmode","id":"68e81270-6cb7-4c48-b021-7ca75135055b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/auditmode?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&auditmode=1","description":"

Set a Policy Group mode as either Audit or Enforcement

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 1=Audit, 0=Enforcement

\n","type":"text/plain"},"key":"auditmode","value":"1"}],"variable":[]}},"response":[{"id":"5151e6d2-0a67-44e4-a7c2-71775a24027b","name":"/v1/group/settings/auditmode","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/auditmode?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&auditmode=1","host":["{{Server}}"],"path":["v1","group","settings","auditmode"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"auditmode","value":"1","description":"(Required) 1=Audit, 0=Enforcement"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 18:52:25 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"68e81270-6cb7-4c48-b021-7ca75135055b"},{"name":"/v1/group/settings/commlist","id":"cfb2a64d-aea8-4d34-b0cc-97d6abd64a2b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/commlist?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&commlistid=37099f66-678e-4c46-872d-e1aad37a2224","description":"

Set the communication list for a defined policy group. You can use the \"airlock-default-communication-list\" as the commlistid if you want to apply the default communication list. CommlistID's can be found by using the /v1/commlist endpoint.

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) Communication List ID, use \"airlock-default-communication-list\" for the default communication list

\n","type":"text/plain"},"key":"commlistid","value":"37099f66-678e-4c46-872d-e1aad37a2224"}],"variable":[]}},"response":[{"id":"1f95dcd7-9ecb-4853-87db-1968da3523cf","name":"/v1/group/settings/commlist","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/commlist?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&commlistid=37099f66-678e-4c46-872d-e1aad37a2224","host":["{{Server}}"],"path":["v1","group","settings","commlist"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"commlistid","value":"37099f66-678e-4c46-872d-e1aad37a2224","description":"(Required) Communication List ID, use \"airlock-default-communication-list\" for the default communication list"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 14 Nov 2024 12:18:31 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"cfb2a64d-aea8-4d34-b0cc-97d6abd64a2b"},{"name":"/v1/group/settings/reflection","id":"24b8b52c-f451-4685-9d1c-015c11894115","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/reflection?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&reflection=1","description":"

Set 'Assembly Reflection Prevention' feature to Disabled or Enabled within a policy group

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) Assembly Reflection 0 = Disabled, 1 = Enabled

\n","type":"text/plain"},"key":"reflection","value":"1"}],"variable":[]}},"response":[{"id":"3a604789-873b-4cef-b270-59e46f2c5152","name":"/v1/group/settings/reflection","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/reflection?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&reflection=1","host":["{{Server}}"],"path":["v1","group","settings","reflection"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"reflection","value":"1","description":"(Required) Assembly Reflection 0 = Disabled, 1 = Enabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 14 Nov 2024 11:25:13 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"24b8b52c-f451-4685-9d1c-015c11894115"},{"name":"/v1/group/settings/pslockdown","id":"d65e3704-741a-409e-b22c-adf1684a4587","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/pslockdown?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&pslockdown=0","description":"

Set a Policy Group PowerShell Language Mode.

NOTE: This feature is enforced by PowerShell and requires PowerShell v5 or greater to be respected.

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) Powershell language mode, 0 = Default, 1 = Full Language, 2 = Contrained Language

\n","type":"text/plain"},"key":"pslockdown","value":"0"}],"variable":[]}},"response":[{"id":"b0f7c180-546e-4b0b-bcdc-17b8aed3387b","name":"/v1/group/settings/pslockdown","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/pslockdown?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&pslockdown=0","host":["{{Server}}"],"path":["v1","group","settings","pslockdown"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"pslockdown","value":"0","description":"(Required) 0 = Default / 1 = Full Language / 2 = Constrained Language"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 18:56:56 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"d65e3704-741a-409e-b22c-adf1684a4587"},{"name":"/v1/group/settings/polltime","id":"79474f77-bdf3-4d66-859a-fc0e6a01a257","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/polltime?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&polltime=250","description":"

Set a Policy Groups Client Poll Time in seconds. This defines how often the Enforcement Agents will communicate with the instance and check for policy updates.

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) polltime (seconds)

\n","type":"text/plain"},"key":"polltime","value":"250"}],"variable":[]}},"response":[{"id":"62379794-a51c-425f-a63c-55110bfbc94f","name":"/v1/group/settings/polltime","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/polltime?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&polltime=250","host":["{{Server}}"],"path":["v1","group","settings","polltime"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"polltime","value":"250","description":"(Required) polltime (seconds)"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 18:58:24 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"79474f77-bdf3-4d66-859a-fc0e6a01a257"},{"name":"/v1/group/settings/proxy","id":"d72adf48-a489-4af0-85b2-816cdaa31d20","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/proxy?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&proxy=0","description":"

Set a Policy Group Proxy to enabled or disabled

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) proxy, 0 = Disabled, 1 = Enabled

\n","type":"text/plain"},"key":"proxy","value":"0"}],"variable":[]}},"response":[{"id":"9d1a7524-f062-402c-8aa0-4e8c52214098","name":"/v1/group/settings/proxy","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/proxy?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&proxy=0","host":["{{Server}}"],"path":["v1","group","settings","proxy"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"proxy","value":"0","description":"(Required) proxy, 0 = Disabled, 1 = Enabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 18:59:36 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"d72adf48-a489-4af0-85b2-816cdaa31d20"},{"name":"/v1/group/settings/proxy/settings","id":"bab3fcd5-7ebb-4d4e-9ce0-480f251c9f2c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/proxy/settings?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&server=myproxyserver.domain&port=8080&authentication=1&username=myproxyusername&password=myproxypassword","description":"

Defines the Proxy configuration for a Policy Group

(Required) Target Group

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) Proxy Server name

\n","type":"text/plain"},"key":"server","value":"myproxyserver.domain"},{"description":{"content":"

(Required) Proxy Port Number

\n","type":"text/plain"},"key":"port","value":"8080"},{"description":{"content":"

(Required) 0 = Disabled, 1 = Enabled

\n","type":"text/plain"},"key":"authentication","value":"1"},{"description":{"content":"

(Optional) Username to use if authentication enabled

\n","type":"text/plain"},"key":"username","value":"myproxyusername"},{"description":{"content":"

(Optional) Password to use if authentication enabled

\n","type":"text/plain"},"key":"password","value":"myproxypassword"}],"variable":[]}},"response":[{"id":"4a57e59d-d1ba-4da0-94a7-d3c1dfe63c07","name":"/v1/group/settings/proxy/settings","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/proxy/settings?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&server=myproxyserver.domain&port=8080&authentication=1&username=myproxyusername&password=myproxypassword","host":["{{Server}}"],"path":["v1","group","settings","proxy","settings"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target Group"},{"key":"server","value":"myproxyserver.domain","description":"(Required) Proxy Server name"},{"key":"port","value":"8080","description":"(Required) Proxy Port Number"},{"key":"authentication","value":"1","description":"(Required) 0 = Disabled, 1 = Enabled"},{"key":"username","value":"myproxyusername","description":"(Optional) Username to use if authentication enabled"},{"key":"password","value":"myproxypassword","description":"(Optional) Password to use if authentication enabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 19:10:24 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"bab3fcd5-7ebb-4d4e-9ce0-480f251c9f2c"},{"name":"/v1/group/settings/script","id":"84f403c0-e316-4b7a-af64-64ec8adc0540","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/script?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&scripts=1","description":"

Set a Policy Groups Script Control mode

(Required) Target groupid

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 0 = Disabled, 1 = Enabled(Respect Policy), 2 = Enabled(Audit Only)

\n","type":"text/plain"},"key":"scripts","value":"1"}],"variable":[]}},"response":[{"id":"6d6ff1a6-76af-4634-b4d1-39d44f92759b","name":"/v1/group/settings/script","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/script?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&scripts=1","host":["{{Server}}"],"path":["v1","group","settings","script"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target groupid"},{"key":"scripts","value":"1","description":"(Required) 0 = Disabled, 1 = Enabled(Respect Policy), 2 = Enabled(Audit Only)"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 19:02:35 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"84f403c0-e316-4b7a-af64-64ec8adc0540"},{"name":"/v1/group/settings/script/type","id":"54eaf1c9-5bc1-4e7d-8d8f-5c329217e80e","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"groupid\": \"97cfece6-624e-4437-9882-4db0f480e0ad\", //(Required) Target GroupID\r\n \"batch\": 1, //(Optional) batch scripts, 0 = Disabled, 1 = Enabled\r\n \"powershell\": 0, //(Optional) powershell scripts, 0 = Disabled, 1 = Enabled\r\n \"command\": 1, //(Optional) command scripts, 0 = Disabled, 1 = Enabled\r\n \"vbscript\": 1, //(Optional) vbscript, 0 = Disabled, 1 = Enabled\r\n \"javascript\": 1, //(Optional) javascript, 0 = Disabled, 1 = Enabled\r\n \"windowsinstaller\": 1, //(Optional) windows installer, 0 = Disabled, 1 = Enabled\r\n \"htmlapplication\": 1, //(Optional) HTML applications, 0 = Disabled, 1 = Enabled\r\n \"javaapplication\": 1, //(Optional) java applications, 0 = Disabled, 1 = Enabled\r\n \"windowsscriptcomponent\": 1, //(Optional) Windows script component, 0 = Disabled, 1 = Enabled\r\n \"python\": 1, //(Optional) python scripts, 0 = Disabled, 1 = Enabled\r\n \"compiledhtml\": 1, //(Optional) Compiled HTML, 0 = Disabled, 1 = Enabled\r\n \"shellscript\": 1, //(Optional) Shell Script, 0 = Disabled, 1 = Enabled\r\n \"dylib\": 1 //(Optional) Dylib, 0 = Disabled, 1 = Enabled\r\n}\r\n\r\n//NOTE: If you send a groupid as a parameter, instead of in the body of the request it will return the groups currently applied script configuration","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/group/settings/script/type","description":"

Sets individual script types to enabled or disabled within a Policy Group. These settings will not take effect if Script Control is set to disabled witin the Policy Group.

Set the script control behavior for v6.0+ Enforcement Agents. This setting if defined will superseed configurations on the /script and /script/type endpoints. Individual script types can be set to audit / disabled / respect by specifying them in the arrays in the description. If the same type is specified in multiple arrays it is considered invalid and will result in an error.

Set custom OTP Durations in Policy. Note: All five durations are required (in minutes).

Valid durations are 0 (disabled) or between 1 (minute) - 10080 (7 days)

Update the Self Service configuration and supply group information for domain security groups to trust, if required. Note: available Domain Security Groups can be obtained from the /v1/domaingroups endpoint.

Sets the Client Self Upgrade option to enabled or disabled within a Policy Group

(Request) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Request) 0 = Disabled / 1 = Enabled

\n","type":"text/plain"},"key":"selfupgrade","value":"0"}],"variable":[]}},"response":[{"id":"c042c64c-b6b0-4f69-8f00-ad88ac259171","name":"/v1/group/settings/selfupgrade","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/selfupgrade?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&selfupgrade=0","host":["{{Server}}"],"path":["v1","group","settings","selfupgrade"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Request) Target GroupID"},{"key":"selfupgrade","value":"0","description":"(Request) 0 = Disabled / 1 = Enabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 05 May 2024 07:33:56 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"27fde1ad-dd6f-4b86-89b2-3aaec0e5b59c"},{"name":"/v1/group/settings/selfupgrade/target","id":"5cfe4bd1-05aa-47fd-b005-c2efc4fb7c66","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/selfupgrade/target?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&windows=5.3.1.4144&linux=5.3.0.6102&macos=5.3.1.8113","description":"

This endpoint defines the target versions of Enforcement Agents for the Policy Group as part of the Client Self Upgrade feature. When setting versions via this endpoint, the versions must be available for use on the server, otherwise the endpoint will not respect the value.

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Optional) Target version of the Windows Enforcement Agent

\n","type":"text/plain"},"key":"windows","value":"5.3.1.4144"},{"description":{"content":"

(Optional) Target version of the Linux Enforcement Agent

\n","type":"text/plain"},"key":"linux","value":"5.3.0.6102"},{"description":{"content":"

(Optional) Target version of the macOS Enforcement Agent

\n","type":"text/plain"},"key":"macos","value":"5.3.1.8113"}],"variable":[]}},"response":[{"id":"6dbd19db-fd8d-483f-a4a6-da3802e5f3aa","name":"/v1/group/settings/selfupgrade/target","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/selfupgrade/target?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&windows=5.3.1.4144&linux=5.3.0.6102&macos=5.3.1.8113","host":["{{Server}}"],"path":["v1","group","settings","selfupgrade","target"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"windows","value":"5.3.1.4144","description":"(Optional) Target version of the Windows Enforcement Agent"},{"key":"linux","value":"5.3.0.6102","description":"(Optional) Target version of the Linux Enforcement Agent"},{"key":"macos","value":"5.3.1.8113","description":"(Optional) Target version of the macOS Enforcement Agent"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 05 May 2024 23:50:22 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"5cfe4bd1-05aa-47fd-b005-c2efc4fb7c66"},{"name":"/v1/group/settings/mactrustedinstaller","id":"5e1bf2ba-da8e-4449-8d41-d02e356842d0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/mactrustedinstaller?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&mactrustedinstaller=1","description":"

Sets the operating mode for the MacOS Trusted Installer feature within a Policy Group

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 0 = Disabled / 1 = Enabled / 2 = Enabled With Trusted Logging

\n","type":"text/plain"},"key":"mactrustedinstaller","value":"1"}],"variable":[]}},"response":[{"id":"fc80ace4-fe83-4d58-aa81-260ba73a81cc","name":"/v1/group/settings/mitrustedinstaller","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/mitrustedinstaller?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&mitrustedinstaller=2","host":["{{Server}}"],"path":["v1","group","settings","mitrustedinstaller"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"mitrustedinstaller","value":"2","description":"(Required) 0 = Disabled / 1 = Enabled / 2 = Enabled With Trusted Logging"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 05 May 2024 07:31:18 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"5e1bf2ba-da8e-4449-8d41-d02e356842d0"},{"name":"/v1/group/settings/mitrustedinstaller","id":"279be9c4-cb71-4334-91bf-f13a831512a2","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/mitrustedinstaller?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&mitrustedinstaller=1","description":"

Sets the operating mode for the Microsoft Trusted Installer feature within a Policy Group

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 0 = Disabled / 1 = Enabled / 2 = Enabled With Trusted Logging

\n","type":"text/plain"},"key":"mitrustedinstaller","value":"1"}],"variable":[]}},"response":[{"id":"c98bda6d-27a4-429c-a735-6cfaed99dd7c","name":"/v1/group/settings/mitrustedinstaller","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/mitrustedinstaller?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&mitrustedinstaller=2","host":["{{Server}}"],"path":["v1","group","settings","mitrustedinstaller"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"mitrustedinstaller","value":"2","description":"(Required) 0 = Disabled / 1 = Enabled / 2 = Enabled With Trusted Logging"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 05 May 2024 07:31:18 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"279be9c4-cb71-4334-91bf-f13a831512a2"},{"name":"/v1/group/settings/browser","id":"20434664-a3e9-4c2e-8080-3489f71f6bf7","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/browser?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&browser=2","description":"

Sets the operating mode for the Browser Extension Control feature within a Policy Group

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 0 = Disabled / 1 = Enabled (Respect Policy) / 2 = Enabled (Audit Only)

\n","type":"text/plain"},"key":"browser","value":"2"}],"variable":[]}},"response":[{"id":"5706fef7-afdc-4599-a11c-2db01c7122f0","name":"/v1/group/settings/browser","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/browser?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&browser=2","host":["{{Server}}"],"path":["v1","group","settings","browser"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"browser","value":"2","description":"(Required) 0 = Disabled / 1 = Enabled (Respect Policy) / 2 = Enabled (Audit Only)"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 05 May 2024 07:29:43 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"20434664-a3e9-4c2e-8080-3489f71f6bf7"},{"name":"/v1/group/settings/trusted_upload","id":"5007dccf-dd86-49c9-9288-bd20f6109915","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/trusted_upload?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&trusted_upload=0","description":"

Sets the mode of Trusted Execution Activity Uploading within a Policy Group

(Required) GroupID of the Target Group

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 0 = Per Rule / 1 = All Rules (Complete) / 2 = All Rules (Summary)

\n","type":"text/plain"},"key":"trusted_upload","value":"0"}],"variable":[]}},"response":[{"id":"e454a583-4863-4b22-b429-66ca964da761","name":"/v1/group/settings/trustedactivity","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/trusted_upload?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&trusted_upload=0","host":["{{Server}}"],"path":["v1","group","settings","trusted_upload"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) GroupID of the Target Group"},{"key":"trusted_upload","value":"0","description":"(Required) 0 = Per Rule / 1 = All Rules (Complete) / 2 = All Rules (Summary)"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Mon, 06 May 2024 00:04:12 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"5007dccf-dd86-49c9-9288-bd20f6109915"},{"name":"/v1/group/settings/generalisation","id":"40d87cd3-cd3c-44fd-8f4f-d52b70c26c71","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/generalisation?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&generalisation=0","description":"

Sets the Runtime Generalisation to enabled or disabled within a Policy Group

(Required) GroupID of the target group

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) 1 = Enabled / 0 = Disabled

\n","type":"text/plain"},"key":"generalisation","value":"0"}],"variable":[]}},"response":[{"id":"6e647357-e5d9-4ac8-bb2e-7cba50594c6a","name":"/v1/group/settings/generalisation","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/generalisation?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&generalisation=0","host":["{{Server}}"],"path":["v1","group","settings","generalisation"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) GroupID of the target group"},{"key":"generalisation","value":"0","description":"(Required) 1 = Enabled / 0 = Disabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Sun, 05 May 2024 07:17:28 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"40d87cd3-cd3c-44fd-8f4f-d52b70c26c71"},{"name":"/v1/group/settings/agentstopcode","id":"dc13411c-b7f7-46f2-ae73-2a75d86412d8","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/group/settings/agentstopcode?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&agentstopcode=mystopcode","description":"

Set a Stop Code value for a Policy Group. Use a value of \"\" to disable the Stop Code.

(Required) Target GroupID

\n","type":"text/plain"},"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad"},{"description":{"content":"

(Required) \"\" = Disabled, String = Enabled

\n","type":"text/plain"},"key":"agentstopcode","value":"mystopcode"}],"variable":[]}},"response":[{"id":"2cdbe8aa-3764-4bbe-83a5-bd64f127e559","name":"/v1/group/settings/agentstopcode","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/group/settings/agentstopcode?groupid=97cfece6-624e-4437-9882-4db0f480e0ad&agentstopcode=mystopcode","host":["{{Server}}"],"path":["v1","group","settings","agentstopcode"],"query":[{"key":"groupid","value":"97cfece6-624e-4437-9882-4db0f480e0ad","description":"(Required) Target GroupID"},{"key":"agentstopcode","value":"mystopcode","description":"(Required) \"\" = Disabled, String = Enabled"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 19:35:48 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"dc13411c-b7f7-46f2-ae73-2a75d86412d8"}],"id":"5095a4c4-f804-4697-b71a-6089ecfac13a","description":"

Endpoints for modifying policy configurations within groups across the product

\n","_postman_id":"5095a4c4-f804-4697-b71a-6089ecfac13a","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Hash","item":[{"name":"/v1/hash/query","id":"b94cb96a-d087-4a32-9fcf-ffdac33bc7c2","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"hashes\": [ //(Required) An array or single hash to lookup\r\n \"b60e92004d394d0b14a8953a2ba29951c79f2f8a6c94f495e3153dfbbef115b6\",\r\n \"41526AFF3HFA2F93C0BC4A765621C34941JH1231J4E35FF222KAN1029418AJ05\"\r\n ]\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/hash/query","description":"

Query the file repository by specifying the hash value(s) you would like to lookup.
NOTE: Only SHA256 hashes are supported.

Add(s) single or multiple SHA256 hashes to a Blocklist package

Remove(s) single or multiple SHA256 hashes from a Blocklist package

Remove one or more SHA256 hashes from all Blocklists, without specifying a specific Blocklist package

Specify a single hash or array of hashes

\n","type":"text/plain"},"key":"hashes","value":null}],"variable":[]}},"response":[{"id":"1c2d126a-e83b-4623-8017-52214c91e178","name":"/v1/hash/blocklist/remove/all","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"hashes\": [ //(Required) An array of SHA256 hashes or single hash to remove from all blocklists globally\r\n \"a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce\",\r\n \"152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3\"\r\n ]\r\n}","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/hash/blocklist/remove/all?hashes","host":["{{Server}}"],"path":["v1","hash","blocklist","remove","all"],"query":[{"key":"hashes","value":null,"description":"Specify a single hash or array of hashes"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 02:19:56 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"8d3f3e6e-5d72-4c46-ac22-15e3ef745e12"},{"name":"/v1/hash/add","id":"0682a04b-5dee-4aee-b545-1764e4365e87","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"hashes\": [\r\n {\r\n \"sha256\": \"a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce\",\r\n \"path\": \"C:\\\\WindowsApps\\\\OneConnect.dll\"\r\n }\r\n ]\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/hash/add?path=&sha256=","description":"

Add one or more SHA256 Hash value(s) to the Airlock repository with an associated file path.
NOTE: Only SHA256 hashes are supported.

(Required) Path to binary/dll

\n","type":"text/plain"},"key":"path","value":""},{"description":{"content":"

(Required) SHA256 hash value to add

\n","type":"text/plain"},"key":"sha256","value":""}],"variable":[]}},"response":[{"id":"ac00cf8f-106c-4790-b532-1b9dad1a300d","name":"/v1/hash/add","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"hashes\": [\r\n {\r\n \"sha256\": \"a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce\",\r\n \"path\": \"C:\\\\WindowsApps\\\\OneConnect.dll\"\r\n }\r\n ]\r\n}","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/hash/add?path=&sha256=","host":["{{Server}}"],"path":["v1","hash","add"],"query":[{"key":"path","value":"","description":"(Required) Path to binary/dll"},{"key":"sha256","value":"","description":"(Required) SHA256 hash value to add"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 14:07:55 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"0682a04b-5dee-4aee-b545-1764e4365e87"},{"name":"/v1/hash/application/add","id":"10fa2a99-7754-4f52-b09a-218924cbdce4","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"applicationid\": \"1570641612\", //(Required) Unique ID of the application group\r\n \"hashes\": [ //(Required) Single SHA256 or array of hashes\r\n \"167af16ce3b2e09df7b07c505cddb51f8a61cf56caff087259ccc2254f440297\",\r\n \"16b03e61d30f6cd24a770f3b58a6f6cfd01559486fc70d03695a7b7ebe24c46f\"\r\n ]\r\n} ","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/hash/application/add","description":"

Add one or more a SHA256 hash value(s) into an Allowlist.
NOTE: The hash value must already exist within the Airlock repository, only SHA256 hashes are supported.

Remove one or more SHA256 Hash value(s) from an Allowlist.
NOTE: The hash value must already exist within the Airlock repository, only SHA256 hashes are supported.

(Required) Unique ID of application group

\n","type":"text/plain"},"key":"applicationid","value":"1570641612"},{"description":{"content":"

(Required) Single SHA256 or Array of Hashes

\n","type":"text/plain"},"key":"hashes","value":"167af16ce3b2e09df7b07c505cddb51f8a61cf56caff087259ccc2254f440297,16b03e61d30f6cd24a770f3b58a6f6cfd01559486fc70d03695a7b7ebe24c46f"}],"variable":[]}},"response":[{"id":"7806f105-e1ea-4ebf-afd2-39c86c9820d6","name":"/v1/hash/application/remove","originalRequest":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"body":{"mode":"raw","raw":"{\r\n \"applicationid\": \"1570641612\", //(Required) Unique ID of the application group\r\n \"hashes\": [ //(Required) Single SHA256 or array of hashes\r\n \"167af16ce3b2e09df7b07c505cddb51f8a61cf56caff087259ccc2254f440297\",\r\n \"16b03e61d30f6cd24a770f3b58a6f6cfd01559486fc70d03695a7b7ebe24c46f\"\r\n ]\r\n} ","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/hash/application/remove"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 14:12:24 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"4b461304-6cfb-4d86-b101-3c2d381ed911"},{"name":"/v1/hash/application/remove/all","id":"14f95c98-76d1-4661-97a5-86d3be15d55e","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{ \r\n \"hashes\": [ //(Required) Single SHA256 or array of hashes\r\n \"167af16ce3b2e09df7b07c505cddb51f8a61cf56caff087259ccc2254f440297\",\r\n \"16b03e61d30f6cd24a770f3b58a6f6cfd01559486fc70d03695a7b7ebe24c46f\"\r\n ]\r\n} ","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/hash/application/remove/all","description":"

Remove one or more SHA256 Hashes from all Allowlists, without specifying a specific Allowlist package

Add one or more SHA256 hash value(s) into a Baseline.
NOTE: The hash value must already exist within the Airlock repository, only SHA256 hashes are supported.

Remove one or more SHA256 Hash value(s) from a Baseline.
NOTE: The hash value must already exist within the Airlock repository, only SHA256 hashes are supported.

Remove one or more SHA256 Hashes from all Baselines, without specifying a specific Baseline package

Endpoints for querying, adding and removing hashes within various lists within the product

\n","_postman_id":"6295478b-3700-4128-8baf-f100fa5f252c","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"OTP","item":[{"name":"/v1/otp/retrieve","id":"0477cfa8-12ca-4cb3-8531-2930c12075c0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/otp/retrieve?duration=15&agentid=b338cc86-3c9d-4010-aa0b-87b09e7c7be6&purpose=Join Webex Meeting","description":"

Retrieve an OTP code for a particular computer (agent) within Airlock. You must specify the OTP 'duration' and unique 'agentid' to retrieve the code. Unique 'agentid' parameters can be obtained from the /agent/find endpoint.

(Required) How long the code will work in minutes (15,60,360,1440,10080)

\n","type":"text/plain"},"key":"duration","value":"15"},{"description":{"content":"

(Required) agentid can be found using /agent/find, this will be the unique ID of a computer.

\n","type":"text/plain"},"key":"agentid","value":"b338cc86-3c9d-4010-aa0b-87b09e7c7be6"},{"description":{"content":"

(Required) The purpose of the OTP code.

\n","type":"text/plain"},"key":"purpose","value":"Join Webex Meeting"}],"variable":[]}},"response":[{"id":"ad06623b-9325-4b74-a0fb-4981178e1caa","name":"/v1/otp/retrieve","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/otp/retrieve?duration=15&agentid=b338cc86-3c9d-4010-aa0b-87b09e7c7be6&purpose=Join Webex Meeting","host":["{{Server}}"],"path":["v1","otp","retrieve"],"query":[{"key":"duration","value":"15","description":"(Required) How long the code will work in minutes (15,60,360,1440,10080)"},{"key":"agentid","value":"b338cc86-3c9d-4010-aa0b-87b09e7c7be6","description":"(Required) agentid can be found using /agent/find, this will be the unique ID of a computer."},{"key":"purpose","value":"Join Webex Meeting","description":"(Required) The purpose of the OTP code."}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 23:26:26 GMT"},{"key":"Content-Length","value":"74"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"otpcode\": \"98967271\",\n \"otpid\": \"1714692385\"\n }\n}"}],"_postman_id":"0477cfa8-12ca-4cb3-8531-2930c12075c0"},{"name":"/v1/otp/revoke","id":"cdb2b3ed-8086-4507-9423-8dab32f864f3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/otp/revoke?otpid","description":"

Revoke an active OTP code by specifying the otpid of the OTP code you want to revoke.

(Required) Target otpid to revoke

\n","type":"text/plain"},"key":"otpid","value":null}],"variable":[]}},"response":[{"id":"1d281aa5-940f-43c6-8f69-b2f1078fae49","name":"/v1/otp/revoke","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/otp/revoke?otpid=1570552048","host":["{{Server}}"],"path":["v1","otp","revoke"],"query":[{"key":"otpid","value":"1570552048","description":"(Required) Target otpid to revoke"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 14:50:00 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"cdb2b3ed-8086-4507-9423-8dab32f864f3"},{"name":"/v1/otp/usage","id":"e30c2af8-b63f-4c13-8606-87ce2ffd5a50","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/otp/usage?clientid&status","description":"

Returns the OTP usage of clientid, clientid is retrieved via /agent/find
NOTE: This endpoint will return a limit of 10,000 records

(Required) Clientid of the target agent

\n","type":"text/plain"},"key":"clientid","value":null},{"description":{"content":"

(Required if clientid not specified) Filter requests by their OTP status: 0 = Awaiting / 1 = Active / 2 = Enforced /3 = Revoked Server Side, Pending Agent Check-In

\n","type":"text/plain"},"key":"status","value":null}],"variable":[]}},"response":[{"id":"9ca29b17-5a85-4152-9e03-afb893fee7e4","name":"/v1/otp/usage","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"status\": \"3\" //(Required if clientid not specified) Filter requests by their OTP status: 0 = Awaiting / 1 = Active / 2 = Enforced /3 = Revoked Server Side, Pending Agent Check-In\r\n}\r\n\r\n//OR\r\n\r\n{\r\n \"clientid\":\"0f43204f-a8e3-4853-a9f8-c7a1b64ff2b8\" //(Required if status not specified) Clientid of the target agent\r\n}","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/otp/usage?clientid=&status=3","host":["{{Server}}"],"path":["v1","otp","usage"],"query":[{"key":"clientid","value":"","description":"(Required) Clientid of the target agent"},{"key":"status","value":"3","description":"(Required if clientid not specified) Filter requests by their OTP status: 0 = Awaiting / 1 = Active / 2 = Enforced /3 = Revoked Server Side, Pending Agent Check-In"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 23:27:39 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"otpusage\": [\n {\n \"clientid\": \"0f43204f-a8e3-4853-a9f8-c7a1b64ff2b8\",\n \"duration\": \"15\",\n \"granted\": \"2019-10-08 16:27:28.23 +0000 UTC\",\n \"hostname\": \"DESKTOP-G3GJO5S\",\n \"ip\": \"98.234.237.55\",\n \"otpcode\": \"71587630\",\n \"otpid\": \"1570552048\",\n \"purpose\": \"123 test\",\n \"status\": \"3\",\n \"user\": \"admin\"\n },\n {\n \"clientid\": \"47bd6b1e-fed5-4b4a-a691-7671d80856de\",\n \"duration\": \"15\",\n \"granted\": \"2019-10-18 01:42:02.831 +0000 UTC\",\n \"hostname\": \"DESKTOP-G3GJO5S\",\n \"ip\": \"98.234.236.94\",\n \"otpcode\": \"51664562\",\n \"otpid\": \"1571362922\",\n \"purpose\": \"testing\",\n \"status\": \"3\",\n \"user\": \"REST API\"\n },\n {\n \"clientid\": \"47bd6b1e-fed5-4b4a-a691-7671d80856de\",\n \"duration\": \"15\",\n \"granted\": \"2019-10-18 02:14:09.354 +0000 UTC\",\n \"hostname\": \"DESKTOP-G3GJO5S\",\n \"ip\": \"98.234.236.94\",\n \"otpcode\": \"57169419\",\n \"otpid\": \"1571364849\",\n \"purpose\": \"testing\",\n \"status\": \"3\",\n \"user\": \"REST API\"\n },\n {\n \"clientid\": \"47bd6b1e-fed5-4b4a-a691-7671d80856de\",\n \"duration\": \"15\",\n \"granted\": \"2019-10-18 02:39:23.195 +0000 UTC\",\n \"hostname\": \"DESKTOP-G3GJO5S\",\n \"ip\": \"98.234.236.94\",\n \"otpcode\": \"63994046\",\n \"otpid\": \"1571366363\",\n \"purpose\": \"testing\",\n \"status\": \"3\",\n \"user\": \"REST API\"\n }\n ]\n }\n}"}],"_postman_id":"e30c2af8-b63f-4c13-8606-87ce2ffd5a50"},{"name":"/v1/otp/id","id":"f55b6ced-2c3d-484b-bb9a-85efce0e7428","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/otp/id?otpcode=88932761","description":"

Returns the ID of an OTP code for targeting by other endpoints

(Required) Target OTP code to retrieve the ID of

\n","type":"text/plain"},"key":"otpcode","value":"88932761"}],"variable":[]}},"response":[{"id":"63e12fbd-e5ae-4db9-ad6e-a1626340e849","name":"/v1/otp/id","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/otp/id?otpcode=88932761","host":["{{Server}}"],"path":["v1","otp","id"],"query":[{"key":"otpcode","value":"88932761","description":"(Required) Target OTP code to retrieve the ID of"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 14:23:22 GMT"},{"key":"Content-Length","value":"53"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"ids\": [\n \"1570552048\"\n ]\n }\n}"}],"_postman_id":"f55b6ced-2c3d-484b-bb9a-85efce0e7428"},{"name":"/v1/otp/activities","id":"ac4d8c7e-e541-421f-83b3-656cfeedf0e4","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"otpid\":\"1570552048\" //(Required) Target otpid to retrieve activities from\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/otp/activities?otpid=1570552048","description":"

Returns file activities associated with an OTP code session. Use the /v1/otp/id endpoint to retrieve otpid's to query.

(Required) Target otpid to retrieve activities from

\n","type":"text/plain"},"key":"otpid","value":"1570552048"}],"variable":[]}},"response":[{"id":"254e3d0b-e0af-4a1d-809e-874935930fcd","name":"/v1/otp/activities","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"otpid\":\"1622521647\" //(Required) Target otpid to retrieve activities from\r\n}","options":{"raw":{"language":"json"}}},"url":{"raw":"{{Server}}/v1/otp/activities?otpid=1570552048","host":["{{Server}}"],"path":["v1","otp","activities"],"query":[{"key":"otpid","value":"1570552048","description":"(Required) Target otpid to retrieve activities from"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 23:35:46 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"otpactivities\": [\n {\n \"filename\": \"C:\\\\Program Files\\\\WindowsApps\\\\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\\\\Skype\\\\Skype.exe\",\n \"publisher\": \"Skype Software Sarl\",\n \"sha256\": \"1012672dacbe33e8f8851607b667b2551622431183bcec34f02dc8e51cab7aef\",\n \"createtime\": \"2021-01-28T01:32:56Z\",\n \"modtime\": \"2021-01-28T01:33:03Z\",\n \"filesize\": 91016584\n },\n {\n \"filename\": \"C:\\\\Program Files\\\\WindowsApps\\\\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\\\\Skype\\\\ffmpeg.dll\",\n \"publisher\": \"Not Signed\",\n \"sha256\": \"d02f2328f240c909fa14e6739f6c5914ccf8386d5c63fec5ca27228fbb4482ae\",\n \"createtime\": \"2020-12-29T01:54:22Z\",\n \"modtime\": \"2020-12-29T01:54:29Z\",\n \"filesize\": 2072064\n },\n {\n \"filename\": \"C:\\\\Windows\\\\Temp\\\\DX20D7.tmp\\\\dxupdate.dll\",\n \"publisher\": \"Not Signed\",\n \"sha256\": \"fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2\",\n \"createtime\": \"2021-06-01T23:29:21Z\",\n \"modtime\": \"2011-03-29T19:10:00Z\",\n \"filesize\": 177152\n },\n {\n \"filename\": \"C:\\\\Program Files (x86)\\\\Citrix\\\\ICA Client\\\\Receiver\\\\AnalyticsInterface.dll\",\n \"publisher\": \"Not Signed\",\n \"sha256\": \"94997e6c97de2cfb385b27275835e25800c965f93017f2a5bdc06b9f71ca6771\",\n \"createtime\": \"2021-05-02T18:13:04Z\",\n \"modtime\": \"2021-05-02T18:13:04Z\",\n \"filesize\": 875520\n },\n {\n \"filename\": \"C:\\\\Users\\\\User\\\\AppData\\\\Local\\\\Temp\\\\rm.bat\",\n \"publisher\": \"Not Signed\",\n \"sha256\": \"85690c3c7786af32d4979872f5c3f23c665f454161f9c6f57dd4a5ec8806a216\",\n \"createtime\": \"2021-06-01T23:31:36Z\",\n \"modtime\": \"2021-06-01T23:31:36Z\",\n \"filesize\": 9775\n }\n ]\n }\n}"}],"_postman_id":"ac4d8c7e-e541-421f-83b3-656cfeedf0e4"}],"id":"2b0372b9-d8c3-4197-b376-4cfbdef743b9","description":"

Endpoints for interacting with OTP codes including usage, retrieval, revocation and issuance

\n","_postman_id":"2b0372b9-d8c3-4197-b376-4cfbdef743b9","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Exception","item":[{"name":"/v1/exception/list","id":"8622110a-73d5-4874-b1db-cec3e8809463","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/exception/list","description":"

Retrieve details of exceptions in varying statuses. This endpoint can be polled for requests and used with the /approve /deny endpoints to take actions on pending exceptions.

(Optional) Filter by status: 0=pending, 1=approved, 2=denied, 3=expired

\n","type":"text/plain"},"key":"status","value":"0"},{"disabled":true,"description":{"content":"

(Optional) 0=respect status filter, 1=return all statuses

\n","type":"text/plain"},"key":"include_all","value":"0"},{"disabled":true,"description":{"content":"

(Optional) Max results per page (max 1000)

\n","type":"text/plain"},"key":"limit","value":"100"},{"disabled":true,"description":{"content":"

(Optional) Pagination offset

\n","type":"text/plain"},"key":"offset","value":"0"}],"variable":[]}},"response":[],"_postman_id":"8622110a-73d5-4874-b1db-cec3e8809463"},{"name":"/v1/exception/approve","id":"2d08fe63-618d-403c-b046-b577bdef1706","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/exception/approve?approval_id=6e737f14-9b3e-4cc6-99cb-3bc1b44e61ab","description":"

Approve a pending exception request

(Required) The approval ID to approve

\n","type":"text/plain"},"key":"approval_id","value":"6e737f14-9b3e-4cc6-99cb-3bc1b44e61ab"}],"variable":[]}},"response":[],"_postman_id":"2d08fe63-618d-403c-b046-b577bdef1706"},{"name":"/v1/exception/deny","id":"c50b61f2-ed64-487e-b8ed-e3e35e63d1c2","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/exception/deny?approval_id=b42b714f-dab7-45df-929f-5f80a05c068c","description":"

Deny a pending exception request

(Required) The approval ID to deny

\n","type":"text/plain"},"key":"approval_id","value":"b42b714f-dab7-45df-929f-5f80a05c068c"}],"variable":[]}},"response":[],"_postman_id":"c50b61f2-ed64-487e-b8ed-e3e35e63d1c2"}],"id":"142f6cce-d93d-4c83-9c29-78a377e45429","_postman_id":"142f6cce-d93d-4c83-9c29-78a377e45429","description":"","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"License","item":[{"name":"/v1/license/set","id":"f1e88432-cd63-4f96-b9f4-1aa23bfd490b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/license/set?companyname&licensekey","description":"

Sets the license key for the selected instance

(Required) Company Name of the selected instance

\n","type":"text/plain"},"key":"companyname","value":null},{"description":{"content":"

(Required) License key to set

\n","type":"text/plain"},"key":"licensekey","value":null}],"variable":[]}},"response":[{"id":"32e8da04-61fc-4df0-8422-ba5a5203f5a4","name":"/v1/license/set","originalRequest":{"method":"POST","header":[],"url":{"raw":"{{Server}}/v1/license/set?companyname=My Company License&licensekey=XXXXX-XXXXX-XXXXX-XXXXX-XXXXX","host":["{{Server}}"],"path":["v1","license","set"],"query":[{"key":"companyname","value":"My Company License","description":"(Required) Company Name of the selected instance"},{"key":"licensekey","value":"XXXXX-XXXXX-XXXXX-XXXXX-XXXXX","description":"(Required) License key to set"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Thu, 02 May 2024 14:26:30 GMT"},{"key":"Content-Length","value":"19"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\"\n}"}],"_postman_id":"f1e88432-cd63-4f96-b9f4-1aa23bfd490b"},{"name":"/v1/license/get","id":"132f21cb-aaf9-4f34-b3d5-faecbed4fe40","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"{{Server}}/v1/license/get","description":"

Gets the license key for the selected instance

Endpoints for interacting with the product license

\n","_postman_id":"04a7c15c-a6ad-4fe7-9f73-7069dc7b340d","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}},{"name":"Logging","item":[{"name":"/v1/logging/exechistories","id":"412fa863-423f-45d2-ac57-5723ea634638","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"type\":[3,5,8], //(Required) 0 = \"Trusted Execution\", 1 = \"Blocked Execution\", 2 = \"Untrusted Execution [Audit]\", 3 = \"Untrusted Execution [OTP]\", 4 = \"Trusted Path Execution\", 5 = \"Trusted Publisher Execution\", 6 = \"Blocklist Execution\", 7 = \"Blocklist Execution [Audit]\", 8 = \"Trusted Process Execution\", 9 = \"Constrained Execution\", 10 = \"Trusted Metadata Execution\", 11 = \"Trusted Browser Execution\", 12 = \"Blocked Browser Execution\", 13 = \"Untrusted Browser Execution [Audit]\", 14 = \"Untrusted Browser Execution [OTP]\", 15 = \"Blocklist Browser Execution [Audit]\", 16 = \"Blocklist Browser Execution\", 17 = \"Trusted Installer Execution\", 18 = \"Trusted Browser Metadata Execution\"\r\n \"checkpoint\":\"601d275487bacb01e3470713\", //(Optional) Retrieve the next event(s) after the specified checkpoint. Note: the checkpoint is essentially a database rising column. The endpoint is designed to return a single request when called without a checkpoint to seed the 'latest' checkpoint in a script. When the request is returned with the checkpoint it will either: Return nothing (if there are no events to return); or Return all the more recent events since the checkpoint, up to a maximum value of 10,000 executions in a single response.\r\n \"policy\":[\"Apple Mac\",\"Servers London\"] //(Optional) Provide an array of policy group names to retrieve events from the specified policy groups. Not specifying this parameter will return events from all groups.\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/logging/exechistories","description":"

Retrieves Execution History Logs, please see the comments in the JSON body for usage instructions

Retrieves Server Activity History Logs, please see the comment in the query parameters for usage instructions.

(Optional) Retrieve the next event(s) after the specified checkpoint. Note: the checkpoint is essentially a database rising column. The endpoint is designed to return a single request when called without a checkpoint to seed the 'latest' checkpoint in a script. When the request is returned with the checkpoint it will either: Return nothing (if there are no events to return); or Return all the more recent events since the checkpoint, up to a maximum value of 10,000 executions in a single response.

\n","type":"text/plain"},"key":"checkpoint","value":null}],"variable":[]}},"response":[{"id":"1eec65d1-df2a-455e-8a40-051b0248f540","name":"/v1/logging/svractivities","originalRequest":{"method":"POST","header":[],"body":{"mode":"raw","raw":"{\r\n \"checkpoint\":\"65b1f05387bacb6955a32a38\"\r\n}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/logging/svractivities"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"},{"key":"Date","value":"Fri, 03 May 2024 01:35:10 GMT"},{"key":"Transfer-Encoding","value":"chunked"}],"cookie":[],"responseTime":null,"body":"{\n \"error\": \"Success\",\n \"response\": {\n \"svractivities\": [\n {\n \"checkpoint\": \"65b1f05387bacb6955a32a3c\",\n \"datetime\": \"2024-01-25T05:23:31.77Z\",\n \"task\": \"Repository Add\",\n \"user\": \"SYSTEM\",\n \"description\": \"a.out added to repository\"\n },\n {\n \"checkpoint\": \"65b1f05387bacb6955a32a40\",\n \"datetime\": \"2024-01-25T05:23:31.88Z\",\n \"task\": \"Repository Add\",\n \"user\": \"SYSTEM\",\n \"description\": \"file.exe added to repository\"\n },\n {\n \"checkpoint\": \"65b1f05387bacb6955a32a30\",\n \"datetime\": \"2024-01-25T05:23:30.88Z\",\n \"task\": \"Client Checkin\",\n \"user\": \"SYSTEM\",\n \"description\": \"DESKTOP-GG4CEJM checks in\"\n },\n {\n \"checkpoint\": \"65b1f05387bacb6955a32a29\",\n \"datetime\": \"2024-01-25T05:23:31.88Z\",\n \"task\": \"Server Tasks\",\n \"user\": \"SYSTEM\",\n \"description\": \"Server License Key was modified by user David\"\n } \n ]\n }\n}"}],"_postman_id":"ed10fdcb-e184-44e1-ace2-7a3eae4deb33"},{"name":"/v1/logging/summary","id":"86b5e3fc-59fa-4cb1-bf41-e0f52304c917","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"body":{"mode":"raw","raw":"/*\r\n * POST /v1/logging/summary - Get File Activity Summary\r\n *\r\n * Returns a comprehensive summary of file activity across the Airlock server\r\n * with optional policy filtering and configurable time ranges.\r\n *\r\n * ============================================================================\r\n * REQUEST BODY\r\n * ============================================================================\r\n *\r\n * time_period (string, required) - Time range for the summary\r\n * \"15m\" = Last 15 minutes\r\n * \"1h\" = Last 1 hour\r\n * \"today\" = Since midnight today\r\n * \"1d\" = Last 24 hours\r\n * \"3d\" = Last 3 days\r\n * \"1w\" = Last 1 week\r\n * \"2w\" = Last 2 weeks\r\n * \"1mo\" = Last 1 month\r\n * \"custom\" = Custom date range\r\n *\r\n * groupid (string, optional) - Filter by policy group UUID\r\n * e.g. \"c698d44d-a307-494e-9149-cd349781bcf1\"\r\n *\r\n * start_date (string, required if time_period=\"custom\")\r\n * - Start date in RFC3339 format\r\n * e.g. \"2025-12-20T00:00:00Z\"\r\n *\r\n * end_date (string, required if time_period=\"custom\")\r\n * - End date in RFC3339 format\r\n * e.g. \"2025-12-21T00:00:00Z\"\r\n *\r\n * include_malicious (int, optional) - Include malicious file count\r\n * 0 = Exclude (default, faster)\r\n * 1 = Include (requires reputation lookup)\r\n *\r\n * include_trends (int, optional) - Include execution trends over time\r\n * 0 = Exclude (default)\r\n * 1 = Include hourly (≤24h) or daily trends\r\n *\r\n * ============================================================================\r\n * RESPONSE FIELDS\r\n * ============================================================================\r\n *\r\n * summary.time_period - Echoed time period from request\r\n * summary.start_date - Calculated start date\r\n * summary.end_date - Calculated end date\r\n * summary.policy_filter - Resolved policy name (if groupid applied)\r\n * summary.new_files_count - Count of unique file hashes seen\r\n * summary.malicious_files_count - Count of files flagged as malicious (optional)\r\n *\r\n * summary.execution_summary:\r\n * .total_untrusted_total - Total untrusted executions\r\n * .total_untrusted_unique - Unique files with untrusted executions\r\n * .blocked_total - Total blocked executions\r\n * .blocked_unique - Unique files blocked\r\n * .audit_total - Total audit executions\r\n * .audit_unique - Unique files in audit\r\n * .trusted_total - Total trusted executions\r\n * .otp_total - Total OTP executions\r\n * .blocklist_total - Total blocklist executions\r\n * .blocklist_audit_total - Total blocklist audit executions\r\n * .type_breakdown - Map of execution type name to count\r\n *\r\n * summary.top_files[] - Top 10 files by execution count\r\n * summary.top_parent_processes[] - Top 10 parent processes\r\n * summary.top_publishers[] - Top 10 publishers\r\n * summary.top_folders[] - Top 10 folders\r\n * summary.top_hosts[] - Top 10 hosts\r\n * summary.policy_breakdown[] - Execution counts per policy\r\n * summary.execution_trends[] - Time-series trend data (optional)\r\n *\r\n * ============================================================================\r\n * COUNT DEFINITIONS\r\n * ============================================================================\r\n *\r\n * These definitions match the Dashboard.\r\n *\r\n * BLOCKED COUNTS (blocked_total, blocked_unique):\r\n * Includes: Blocked Execution\r\n * \r\n * This represents files that were prevented from executing because they\r\n * were not on an allowlist and the policy was in enforcement mode.\r\n *\r\n * UNTRUSTED COUNTS (total_untrusted_total, total_untrusted_unique):\r\n * Includes: Untrusted Execution [Audit]\r\n * Untrusted Execution [OTP]\r\n * \r\n * This represents files that executed but were not trusted. In audit mode,\r\n * these files are logged but allowed. With OTP, a one-time password was\r\n * used to temporarily allow execution / or a self-service / exception request.\r\n *\r\n * TOTAL vs UNIQUE:\r\n * - Total: Every execution event (same file run 10 times = 10)\r\n * - Unique: Distinct files by hash (same file run 10 times = 1)\r\n *\r\n * TREND DATA (execution_trends):\r\n * - blocked_count: Blocked Execution events per time bucket\r\n * - audit_count: Untrusted [Audit] + Untrusted [OTP] events per time bucket\r\n * - total_count: All execution events per time bucket\r\n *\r\n * ============================================================================\r\n * EXAMPLE REQUESTS\r\n * ============================================================================\r\n */\r\n// Basic - Last 2 weeks summary\r\n{\r\n \"time_period\": \"2w\"\r\n}\r\n// With policy filter\r\n//{\r\n// \"time_period\": \"today\",\r\n// \"groupid\": \"c698d44d-a307-494e-9149-cd349781bcf1\"\r\n//}\r\n// Full summary with trends\r\n//{\r\n// \"time_period\": \"1w\",\r\n// \"include_malicious\": 1,\r\n// \"include_trends\": 1\r\n//}","options":{"raw":{"language":"json"}}},"url":"{{Server}}/v1/logging/summary","description":"

Returns a comprehensive summary of file activity across the server with optional policy filtering and configurable time ranges.

Endpoints for retrieval of logs within the product, these endpoints can be used as a 'pull' method of log retrieval for SIEM instead of 'push' implemented by the External Logging

\n","_postman_id":"ee2928a5-1f02-46c1-a9bc-f034593b017c","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]},"isInherited":true,"source":{"_postman_id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","id":"411c80f9-3d9c-4d25-aba5-ec738a9102f3","name":"Airlock Digital REST API (v6.1.2+)","type":"collection"}}}],"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ApiKey"},{"key":"value","value":"{{APIKey}}"}]}},"event":[{"listen":"prerequest","script":{"id":"bc775979-f1fd-4b0d-9ff7-93721f07abd9","type":"text/javascript","packages":{},"exec":[""]}},{"listen":"test","script":{"id":"91e40261-38eb-4269-a9cd-23928b10427d","type":"text/javascript","packages":{},"exec":[""]}}]}