{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Creates a new device posture rule.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/teams-devices_identifier"}},"required":["account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"description":{"$ref":"#/definitions/teams-devices_description"},"expiration":{"$ref":"#/definitions/teams-devices_expiration"},"input":{"$ref":"#/definitions/teams-devices_input"},"match":{"$ref":"#/definitions/teams-devices_match"},"name":{"$ref":"#/definitions/teams-devices_name"},"schedule":{"$ref":"#/definitions/teams-devices_schedule"},"type":{"$ref":"#/definitions/teams-devices_type"}},"required":["name","type"]}},"required":["path","body"],"additionalProperties":false,"definitions":{"teams-devices_identifier":{"type":"string","examples":["699d98642c564d2e855e9661899b7252"]},"teams-devices_description":{"description":"The description of the device posture rule.","type":"string","examples":["The rule for admin serial numbers"]},"teams-devices_expiration":{"description":"Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.","type":"string","examples":["1h"]},"teams-devices_input":{"description":"The value to be checked against.","type":"object","oneOf":[{"$ref":"#/definitions/teams-devices_file_input_request"},{"$ref":"#/definitions/teams-devices_unique_client_id_input_request"},{"$ref":"#/definitions/teams-devices_domain_joined_input_request"},{"$ref":"#/definitions/teams-devices_os_version_input_request"},{"$ref":"#/definitions/teams-devices_firewall_input_request"},{"$ref":"#/definitions/teams-devices_sentinelone_input_request"},{"$ref":"#/definitions/teams-devices_carbonblack_input_request"},{"$ref":"#/definitions/teams-devices_access_serial_number_list_input_request"},{"$ref":"#/definitions/teams-devices_disk_encryption_input_request"},{"$ref":"#/definitions/teams-devices_application_input_request"},{"$ref":"#/definitions/teams-devices_client_certificate_input_request"},{"$ref":"#/definitions/teams-devices_client_certificate_v2_input_request"},{"$ref":"#/definitions/teams-devices_antivirus_input_request"},{"$ref":"#/definitions/teams-devices_workspace_one_input_request"},{"$ref":"#/definitions/teams-devices_crowdstrike_input_request"},{"$ref":"#/definitions/teams-devices_intune_input_request"},{"$ref":"#/definitions/teams-devices_kolide_input_request"},{"$ref":"#/definitions/teams-devices_tanium_input_request"},{"$ref":"#/definitions/teams-devices_sentinelone_s2s_input_request"},{"$ref":"#/definitions/teams-devices_custom_s2s_input_request"}],"examples":[{"operating_system":"linux","path":"/bin/cat","thumbprint":"0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"}]},"teams-devices_match":{"description":"The conditions that the client must match to run the rule.","type":"array","items":{"$ref":"#/definitions/teams-devices_match_item"}},"teams-devices_name":{"description":"The name of the device posture rule.","type":"string","examples":["Admin Serial Numbers"]},"teams-devices_schedule":{"description":"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`.","type":"string","examples":["1h"]},"teams-devices_type":{"description":"The type of device posture rule.","type":"string","enum":["file","application","tanium","gateway","warp","disk_encryption","serial_number","sentinelone","carbonblack","firewall","os_version","domain_joined","client_certificate","client_certificate_v2","antivirus","unique_client_id","kolide","tanium_s2s","crowdstrike_s2s","intune","workspace_one","sentinelone_s2s","custom_s2s"],"examples":["file"]},"teams-devices_file_input_request":{"type":"object","properties":{"exists":{"description":"Whether or not file exists.","type":"boolean","examples":[true]},"operating_system":{"description":"Operating system.","type":"string","enum":["windows","linux","mac"],"examples":["mac"]},"path":{"description":"File path.","type":"string","examples":["/bin/cat"]},"sha256":{"description":"SHA-256.","type":"string","examples":["https://api.us-2.crowdstrike.com"]},"thumbprint":{"description":"Signing certificate thumbprint.","type":"string","examples":["0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"]}},"required":["path","operating_system"],"title":"File Check"},"teams-devices_unique_client_id_input_request":{"type":"object","properties":{"id":{"description":"List ID.","type":"string","examples":["da3de859-8f6e-47ea-a2b5-b2433858471f"]},"operating_system":{"description":"Operating System.","type":"string","enum":["android","ios","chromeos"],"examples":["android"]}},"required":["operating_system","id"],"title":"Unique Client ID"},"teams-devices_domain_joined_input_request":{"type":"object","properties":{"domain":{"description":"Domain.","type":"string","examples":["example.com"]},"operating_system":{"description":"Operating System.","type":"string","enum":["windows"],"examples":["windows"]}},"required":["operating_system"],"title":"Domain Joined"},"teams-devices_os_version_input_request":{"type":"object","properties":{"operating_system":{"description":"Operating System.","type":"string","enum":["windows"],"examples":["windows"]},"operator":{"description":"Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":["13.3.0"]},"os_distro_name":{"description":"Operating System Distribution Name (linux only).","type":"string","examples":["ubuntu"]},"os_distro_revision":{"description":"Version of OS Distribution (linux only).","type":"string","examples":["11.3.1"]},"os_version_extra":{"description":"Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.","type":"string","examples":["(a) or 6889 or Ubuntu 24.04"]},"version":{"description":"Version of OS.","type":"string","examples":["13.3.0"]}},"required":["operating_system","version","operator"],"title":"OS Version"},"teams-devices_firewall_input_request":{"type":"object","properties":{"enabled":{"description":"Enabled.","type":"boolean","examples":[true]},"operating_system":{"description":"Operating System.","type":"string","enum":["windows","mac"],"examples":["windows"]}},"required":["operating_system","enabled"],"title":"Firewall"},"teams-devices_sentinelone_input_request":{"type":"object","properties":{"operating_system":{"description":"Operating system.","type":"string","enum":["windows","linux","mac"],"examples":["mac"]},"path":{"description":"File path.","type":"string","examples":["/bin/cat"]},"sha256":{"description":"SHA-256.","type":"string","examples":["b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c"]},"thumbprint":{"description":"Signing certificate thumbprint.","type":"string","examples":["0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"]}},"required":["path","operating_system"],"title":"Sentinelone"},"teams-devices_carbonblack_input_request":{"type":"object","properties":{"operating_system":{"description":"Operating system.","type":"string","enum":["windows","linux","mac"],"examples":["mac"]},"path":{"description":"File path.","type":"string","examples":["/bin/cat"]},"sha256":{"description":"SHA-256.","type":"string","examples":["b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c"]},"thumbprint":{"description":"Signing certificate thumbprint.","type":"string","examples":["0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"]}},"required":["path","operating_system"],"title":"Carbonblack"},"teams-devices_access_serial_number_list_input_request":{"type":"object","properties":{"id":{"description":"UUID of Access List.","type":"string","maxLength":36,"examples":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]}},"required":["id"],"title":"Serial Number"},"teams-devices_disk_encryption_input_request":{"type":"object","properties":{"checkDisks":{"$ref":"#/definitions/teams-devices_checkDisks"},"requireAll":{"$ref":"#/definitions/teams-devices_requireAll"}},"title":"Disk Encryption"},"teams-devices_application_input_request":{"type":"object","properties":{"operating_system":{"description":"Operating system.","type":"string","enum":["windows","linux","mac"],"examples":["mac"]},"path":{"description":"Path for the application.","type":"string","examples":["/bin/cat"]},"sha256":{"description":"SHA-256.","type":"string","examples":["b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c"]},"thumbprint":{"description":"Signing certificate thumbprint.","type":"string","examples":["0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"]}},"required":["path","operating_system"],"title":"Application"},"teams-devices_client_certificate_input_request":{"type":"object","properties":{"certificate_id":{"description":"UUID of Cloudflare managed certificate.","type":"string","maxLength":36,"examples":["b14ddcc4-bcd2-4df4-bd4f-eb27d5a50c30"]},"cn":{"description":"Common Name that is protected by the certificate.","type":"string","examples":["example.com"]}},"required":["certificate_id","cn"],"title":"Client Certificate"},"teams-devices_client_certificate_v2_input_request":{"type":"object","properties":{"certificate_id":{"description":"UUID of Cloudflare managed certificate.","type":"string","maxLength":36,"examples":["b14ddcc4-bcd2-4df4-bd4f-eb27d5a50c30"]},"check_private_key":{"description":"Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.","type":"boolean","examples":[true]},"cn":{"description":"Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables.","type":"string","examples":["${hostname}.com.${serial_number}"]},"extended_key_usage":{"description":"List of values indicating purposes for which the certificate public key can be used.","type":"array","items":{"$ref":"#/definitions/teams-devices_extended_key_usage_enum"},"examples":[["clientAuth","emailProtection"]]},"locations":{"type":"object","properties":{"paths":{"$ref":"#/definitions/teams-devices_paths"},"trust_stores":{"$ref":"#/definitions/teams-devices_trust_stores"}}},"operating_system":{"description":"Operating System.","type":"string","enum":["windows","mac","linux"],"examples":["windows"]},"subject_alternative_names":{"description":"List of certificate Subject Alternative Names.","type":"array","items":{"type":"string"},"examples":[["example.com","sample.com"]]}},"required":["certificate_id","check_private_key","operating_system"],"title":"Client Certificate V2"},"teams-devices_antivirus_input_request":{"type":"object","properties":{"update_window_days":{"description":"Number of days that the antivirus should be updated within.","type":"number","examples":[7]}},"title":"Antivirus"},"teams-devices_workspace_one_input_request":{"type":"object","properties":{"compliance_status":{"description":"Compliance Status.","type":"string","enum":["compliant","noncompliant","unknown"],"examples":["compliant"]},"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]}},"required":["connection_id","compliance_status"],"title":"Workspace One S2S Input"},"teams-devices_crowdstrike_input_request":{"type":"object","properties":{"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]},"last_seen":{"description":"For more details on last seen, please refer to the Crowdstrike documentation.","type":"string","examples":["15d3h20m4s"]},"operator":{"description":"Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]},"os":{"description":"Os Version.","type":"string","examples":["13.3.0"]},"overall":{"description":"Overall.","type":"string","examples":[90]},"sensor_config":{"description":"SensorConfig.","type":"string","examples":[90]},"state":{"description":"For more details on state, please refer to the Crowdstrike documentation.","type":"string","enum":["online","offline","unknown"],"examples":["online"]},"version":{"description":"Version.","type":"string","examples":["13.3.0"]},"versionOperator":{"description":"Version Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]}},"required":["connection_id"],"title":"Crowdstrike S2S Input"},"teams-devices_intune_input_request":{"type":"object","properties":{"compliance_status":{"description":"Compliance Status.","type":"string","enum":["compliant","noncompliant","unknown","notapplicable","ingraceperiod","error"],"examples":["compliant"]},"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]}},"required":["connection_id","compliance_status"],"title":"Intune S2S Input"},"teams-devices_kolide_input_request":{"type":"object","properties":{"auth_state":{"description":"The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.","type":"array","items":{"enum":["Good","Notified","Will Block","Blocked"],"type":"string"},"minItems":1,"uniqueItems":true,"examples":[["Good","Notified"]]},"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]},"countOperator":{"description":"Count Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]},"issue_count":{"description":"The Number of Issues.","type":"string","examples":["1"]}},"required":["connection_id"],"title":"Kolide S2S Input"},"teams-devices_tanium_input_request":{"type":"object","properties":{"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]},"eid_last_seen":{"description":"For more details on eid last seen, refer to the Tanium documentation.","type":"string","examples":["2023-07-20T23:16:32Z"]},"operator":{"description":"Operator to evaluate risk_level or eid_last_seen.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]},"risk_level":{"description":"For more details on risk level, refer to the Tanium documentation.","type":"string","enum":["low","medium","high","critical"],"examples":["low"]},"scoreOperator":{"description":"Score Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]},"total_score":{"description":"For more details on total score, refer to the Tanium documentation.","type":"number","examples":[1]}},"required":["connection_id"],"title":"Tanium S2S Input"},"teams-devices_sentinelone_s2s_input_request":{"type":"object","properties":{"active_threats":{"description":"The Number of active threats.","type":"number","examples":[1]},"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]},"infected":{"description":"Whether device is infected.","type":"boolean","examples":[true]},"is_active":{"description":"Whether device is active.","type":"boolean","examples":[true]},"network_status":{"description":"Network status of device.","type":"string","enum":["connected","disconnected","disconnecting","connecting"],"examples":["connected"]},"operational_state":{"description":"Agent operational state.","type":"string","enum":["na","partially_disabled","auto_fully_disabled","fully_disabled","auto_partially_disabled","disabled_error","db_corruption"]},"operator":{"description":"Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]}},"required":["connection_id"],"title":"SentinelOne S2S Input"},"teams-devices_custom_s2s_input_request":{"type":"object","properties":{"connection_id":{"description":"Posture Integration ID.","type":"string","examples":["bc7cbfbb-600a-42e4-8a23-45b5e85f804f"]},"operator":{"description":"Operator.","type":"string","enum":["<","<=",">",">=","=="],"examples":[">"]},"score":{"description":"A value between 0-100 assigned to devices set by the 3rd party posture provider.","type":"number","examples":[100]}},"required":["connection_id","score","operator"],"title":"Custom Device Posture Integration Input"},"teams-devices_match_item":{"type":"object","properties":{"platform":{"$ref":"#/definitions/teams-devices_platform"}}},"teams-devices_checkDisks":{"description":"List of volume names to be checked for encryption.","type":"array","items":{"type":"string"},"examples":[["C","D","G"]]},"teams-devices_requireAll":{"description":"Whether to check all disks for encryption.","type":"boolean","examples":[true]},"teams-devices_extended_key_usage_enum":{"type":"string","enum":["clientAuth","emailProtection"]},"teams-devices_paths":{"description":"List of paths to check for client certificate on linux.","type":"array","items":{"type":"string"},"examples":[["/path1","/path2"]]},"teams-devices_trust_stores":{"description":"List of trust stores to check for client certificate.","type":"array","items":{"$ref":"#/definitions/teams-devices_trust_stores_enum"},"examples":[["system","user"]]},"teams-devices_platform":{"type":"string","enum":["windows","mac","linux","android","ios","chromeos"],"examples":["windows"]},"teams-devices_trust_stores_enum":{"type":"string","enum":["system","user"]}}},"name":"Create posture rule","id":"cloudflare.device-posture-rules-create-device-posture-rule","example":{"path":{"account_id":"699d98642c564d2e855e9661899b7252"},"body":{"name":"Admin Serial Numbers","type":"file"}},"maxRequests":1,"summary":false}}