previewRuleTargets¶
QUERYpreviewRuleTargets
AI Defense Policy GraphQL API · Queries
Preview an ordered rule sequence as a unit, with each rule's advisories narrowed to the applications it will actually act on. Rules are walked top-to-bottom under first-match-wins: an application claimed by an earlier in-effect rule — whatever that rule's action — is excluded from every later rule's effective reach. Returns exactly one preview per input rule, in input order: result[i] describes rules[i]. Only the supplied rules are considered; other policies never affect the result. For policy authoring — works with unsaved rules and in-progress edits. Use previewRuleTarget for a single rule in isolation or for the full matched-app list.
Request samples¶
curl -X POST "https://api.taegis.sophos.com/graphql" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
\"query\": \"query PreviewRuleTargets(\$rules: [RuleTargetInput!]!) { previewRuleTargets(rules: \$rules) { matchedCount effectiveCount topApps { id name riskLevel } riskCounts { level count } warnings enforcementImpact { webControlDomains } } }\",
\"variables\": {
\"rules\": [
{
\"conditions\": [
{
\"dimension\": \"<dimension>\",
\"operator\": \"IN\",
\"values\": [
\"<values>\"
]
}
],
\"action\": \"BLOCK\"
}
]
}
}"
import requests
response = requests.post(
"https://api.taegis.sophos.com/graphql",
headers={
"Authorization": "Bearer <access-token>",
"X-Tenant-ID": "<tenant-id>",
"Content-Type": "application/json",
},
json={ 'query': 'query PreviewRuleTargets($rules: [RuleTargetInput!]!) { '
'previewRuleTargets(rules: $rules) { matchedCount effectiveCount '
'topApps { id name riskLevel } riskCounts { level count } '
'warnings enforcementImpact { webControlDomains } } }',
'variables': { 'rules': [ { 'conditions': [ { 'dimension': '<dimension>',
'operator': 'IN',
'values': [ '<values>']}],
'action': 'BLOCK'}]}},
)
print(response.json())
$headers = @{
"Authorization" = "Bearer <access-token>"
"X-Tenant-ID" = "<tenant-id>"
"Content-Type" = "application/json"
}
$body = '{
"query": "query PreviewRuleTargets($rules: [RuleTargetInput!]!) { previewRuleTargets(rules: $rules) { matchedCount effectiveCount topApps { id name riskLevel } riskCounts { level count } warnings enforcementImpact { webControlDomains } } }",
"variables": {
"rules": [
{
"conditions": [
{
"dimension": "<dimension>",
"operator": "IN",
"values": [
"<values>"
]
}
],
"action": "BLOCK"
}
]
}
}'
Invoke-RestMethod -Method POST -Uri "https://api.taegis.sophos.com/graphql" -Headers $headers -Body $body -ContentType "application/json"
package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
req, err := http.NewRequest("POST", "https://api.taegis.sophos.com/graphql", strings.NewReader(`{
"query": "query PreviewRuleTargets($rules: [RuleTargetInput!]!) { previewRuleTargets(rules: $rules) { matchedCount effectiveCount topApps { id name riskLevel } riskCounts { level count } warnings enforcementImpact { webControlDomains } } }",
"variables": {
"rules": [
{
"conditions": [
{
"dimension": "<dimension>",
"operator": "IN",
"values": [
"<values>"
]
}
],
"action": "BLOCK"
}
]
}
}`))
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <access-token>")
req.Header.Set("X-Tenant-ID", "<tenant-id>")
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
const response = await fetch("https://api.taegis.sophos.com/graphql", {
method: "POST",
headers: {
"Authorization": "Bearer <access-token>",
"X-Tenant-ID": "<tenant-id>",
"Content-Type": "application/json",
},
body: JSON.stringify({
"query": "query PreviewRuleTargets($rules: [RuleTargetInput!]!) { previewRuleTargets(rules: $rules) { matchedCount effectiveCount topApps { id name riskLevel } riskCounts { level count } warnings enforcementImpact { webControlDomains } } }",
"variables": {
"rules": [
{
"conditions": [
{
"dimension": "<dimension>",
"operator": "IN",
"values": [
"<values>"
]
}
],
"action": "BLOCK"
}
]
}
}),
});
const data = await response.json();
console.log(data);