Create Risk Predictor (Traffic anomaly)
POST {{apiPath}}/environments/{{envID}}/riskPredictors
This request creates a traffic anomaly predictor.
The rules array contains a single rule - tracking of unique users on a single device, the only rule that can currently be included in traffic anomaly predictors.
The threshold object is used to specify the number of users that will be considered Medium risk and the number of users that will be considered High risk.
The interval object is used to define the timeframe for tracking unique users on a device.
Prerequisites
-
Refer to Risk Predictors for important overview information.
Request Model
Refer to Risk Predictors for the complete data models.
Base data model
| Property | Type | Required? |
|---|---|---|
|
String |
Required |
|
Object |
Required |
|
String |
Required |
|
String |
Required |
|
String |
Required |
|
Array |
Optional |
|
Boolean |
Required |
|
Object |
Required |
|
String |
Required |
`rules[].interval.quantity ` |
Integer |
Required |
|
Object |
Required |
|
Integer |
Required |
|
Integer |
Required |
|
String |
Required |
|
String |
Required |
Body
raw ( application/json )
{
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
}
Example Request
-
cURL
-
C#
-
Go
-
HTTP
-
Java
-
jQuery
-
NodeJS
-
Python
-
PHP
-
Ruby
-
Swift
curl --location --globoff '{{apiPath}}/environments/{{envID}}/riskPredictors' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
}'
var options = new RestClientOptions("{{apiPath}}/environments/{{envID}}/riskPredictors")
{
MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@" ""name"": ""Traffic anomaly predictor created with API""," + "\n" +
@" ""compactName"": ""trafficAnomalyCreatedFromAPI""," + "\n" +
@" ""type"": ""TRAFFIC_ANOMALY""," + "\n" +
@" ""default"": {" + "\n" +
@" ""result"": {" + "\n" +
@" ""level"": ""medium""," + "\n" +
@" ""type"": ""VALUE""" + "\n" +
@" }" + "\n" +
@" }," + "\n" +
@" ""rules"": [" + "\n" +
@" {" + "\n" +
@" ""type"": ""UNIQUES_USERS_PER_DEVICE""," + "\n" +
@" ""threshold"": {" + "\n" +
@" ""medium"": 3," + "\n" +
@" ""high"": 6" + "\n" +
@" }," + "\n" +
@" ""interval"": {" + "\n" +
@" ""unit"": ""DAY""," + "\n" +
@" ""quantity"": 7" + "\n" +
@" }," + "\n" +
@" ""enabled"": true" + "\n" +
@" }" + "\n" +
@" ]" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "{{apiPath}}/environments/{{envID}}/riskPredictors"
method := "POST"
payload := strings.NewReader(`{
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
}`)
client := &http.Client {
}
req, err := http.NewRequest(method, url, payload)
if err != nil {
fmt.Println(err)
return
}
req.Header.Add("Content-Type", "application/json")
req.Header.Add("Authorization", "Bearer {{accessToken}}")
res, err := client.Do(req)
if err != nil {
fmt.Println(err)
return
}
defer res.Body.Close()
body, err := io.ReadAll(res.Body)
if err != nil {
fmt.Println(err)
return
}
fmt.Println(string(body))
}
POST /environments/{{envID}}/riskPredictors HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}
{
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
}
OkHttpClient client = new OkHttpClient().newBuilder()
.build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n \"name\": \"Traffic anomaly predictor created with API\",\n \"compactName\": \"trafficAnomalyCreatedFromAPI\",\n \"type\": \"TRAFFIC_ANOMALY\",\n \"default\": {\n \"result\": {\n \"level\": \"medium\",\n \"type\": \"VALUE\"\n }\n },\n \"rules\": [\n {\n \"type\": \"UNIQUES_USERS_PER_DEVICE\",\n \"threshold\": {\n \"medium\": 3,\n \"high\": 6\n },\n \"interval\": {\n \"unit\": \"DAY\",\n \"quantity\": 7\n },\n \"enabled\": true\n }\n ]\n}");
Request request = new Request.Builder()
.url("{{apiPath}}/environments/{{envID}}/riskPredictors")
.method("POST", body)
.addHeader("Content-Type", "application/json")
.addHeader("Authorization", "Bearer {{accessToken}}")
.build();
Response response = client.newCall(request).execute();
var settings = {
"url": "{{apiPath}}/environments/{{envID}}/riskPredictors",
"method": "POST",
"timeout": 0,
"headers": {
"Content-Type": "application/json",
"Authorization": "Bearer {{accessToken}}"
},
"data": JSON.stringify({
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
}),
};
$.ajax(settings).done(function (response) {
console.log(response);
});
var request = require('request');
var options = {
'method': 'POST',
'url': '{{apiPath}}/environments/{{envID}}/riskPredictors',
'headers': {
'Content-Type': 'application/json',
'Authorization': 'Bearer {{accessToken}}'
},
body: JSON.stringify({
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
})
};
request(options, function (error, response) {
if (error) throw new Error(error);
console.log(response.body);
});
import requests
import json
url = "{{apiPath}}/environments/{{envID}}/riskPredictors"
payload = json.dumps({
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": True
}
]
})
headers = {
'Content-Type': 'application/json',
'Authorization': 'Bearer {{accessToken}}'
}
response = requests.request("POST", url, headers=headers, data=payload)
print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/environments/{{envID}}/riskPredictors');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
'follow_redirects' => TRUE
));
$request->setHeader(array(
'Content-Type' => 'application/json',
'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n "name": "Traffic anomaly predictor created with API",\n "compactName": "trafficAnomalyCreatedFromAPI",\n "type": "TRAFFIC_ANOMALY",\n "default": {\n "result": {\n "level": "medium",\n "type": "VALUE"\n }\n },\n "rules": [\n {\n "type": "UNIQUES_USERS_PER_DEVICE",\n "threshold": {\n "medium": 3,\n "high": 6\n },\n "interval": {\n "unit": "DAY",\n "quantity": 7\n },\n "enabled": true\n }\n ]\n}');
try {
$response = $request->send();
if ($response->getStatus() == 200) {
echo $response->getBody();
}
else {
echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
$response->getReasonPhrase();
}
}
catch(HTTP_Request2_Exception $e) {
echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"
url = URI("{{apiPath}}/environments/{{envID}}/riskPredictors")
http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"type": "TRAFFIC_ANOMALY",
"default": {
"result": {
"level": "medium",
"type": "VALUE"
}
},
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
]
})
response = http.request(request)
puts response.read_body
let parameters = "{\n \"name\": \"Traffic anomaly predictor created with API\",\n \"compactName\": \"trafficAnomalyCreatedFromAPI\",\n \"type\": \"TRAFFIC_ANOMALY\",\n \"default\": {\n \"result\": {\n \"level\": \"medium\",\n \"type\": \"VALUE\"\n }\n },\n \"rules\": [\n {\n \"type\": \"UNIQUES_USERS_PER_DEVICE\",\n \"threshold\": {\n \"medium\": 3,\n \"high\": 6\n },\n \"interval\": {\n \"unit\": \"DAY\",\n \"quantity\": 7\n },\n \"enabled\": true\n }\n ]\n}"
let postData = parameters.data(using: .utf8)
var request = URLRequest(url: URL(string: "{{apiPath}}/environments/{{envID}}/riskPredictors")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")
request.httpMethod = "POST"
request.httpBody = postData
let task = URLSession.shared.dataTask(with: request) { data, response, error in
guard let data = data else {
print(String(describing: error))
return
}
print(String(data: data, encoding: .utf8)!)
}
task.resume()
Example Response
201 Created
{
"_links": {
"self": {
"href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/riskPredictors/fe36c631-6520-431b-a586-e680277a9f85"
},
"environment": {
"href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
}
},
"id": "fe36c631-6520-431b-a586-e680277a9f85",
"environment": {
"id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
},
"createdAt": "2024-08-06T15:22:09.536Z",
"createdBy": "USER_DEFINED",
"updatedAt": "2024-08-06T15:22:09.536Z",
"name": "Traffic anomaly predictor created with API",
"compactName": "trafficAnomalyCreatedFromAPI",
"licensed": true,
"rules": [
{
"type": "UNIQUES_USERS_PER_DEVICE",
"threshold": {
"medium": 3,
"high": 6
},
"interval": {
"unit": "DAY",
"quantity": 7
},
"enabled": true
}
],
"type": "TRAFFIC_ANOMALY",
"condition": {
"scores": [
{
"name": "HIGH",
"value": "HIGH"
},
{
"name": "MEDIUM",
"value": "MEDIUM"
},
{
"name": "LOW",
"value": "LOW"
}
]
},
"deletable": true,
"tooltip": "predictor.tooltip.traffic.anomaly",
"default": {
"weight": 5,
"score": 80,
"result": {
"level": "MEDIUM",
"type": "VALUE"
},
"evaluated": false
}
}