{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/armis/json-schema/armis-persistent-policy-items-schema.json",
  "title": "PersistentPolicyItems",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/armis-policies-api-openapi.yml#/components/schemas/PersistentPolicyItems",
  "properties": {
    "items": {
      "items": {
        "$ref": "#/$defs/PersistentPolicy"
      },
      "type": "array",
      "title": "Items"
    },
    "next": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Next"
    }
  },
  "type": "object",
  "required": [
    "items"
  ],
  "$defs": {
    "AndRule": {
      "properties": {
        "or": {
          "items": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "object",
                "description": "Another AsqRule"
              }
            ]
          },
          "type": "array",
          "title": "Or"
        }
      },
      "type": "object",
      "required": [
        "and"
      ],
      "title": "AndRule"
    },
    "AsqRule": {
      "anyOf": [
        {
          "$ref": "#/$defs/AndRule"
        },
        {
          "$ref": "#/$defs/OrRule"
        }
      ],
      "title": "AsqRule"
    },
    "OrRule": {
      "properties": {
        "and": {
          "items": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "object",
                "description": "Another AsqRule"
              }
            ]
          },
          "type": "array",
          "title": "And"
        }
      },
      "type": "object",
      "required": [
        "or"
      ],
      "title": "OrRule"
    },
    "PersistentPolicy": {
      "properties": {
        "id": {
          "type": "integer",
          "title": "Id",
          "description": "Unique identifier of the policy."
        },
        "name": {
          "type": "string",
          "title": "Name",
          "description": "Display name of the policy."
        },
        "description": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "title": "Description",
          "description": "Human-readable description of what the policy detects or enforces."
        },
        "is_enabled": {
          "type": "boolean",
          "title": "Is Enabled",
          "description": "Whether the policy is active and will trigger when its rules match.",
          "default": false
        },
        "rule_type": {
          "$ref": "#/$defs/PolicyRuleType",
          "description": "The entity type that this policy's rules are evaluated against."
        },
        "asq_rule": {
          "$ref": "#/$defs/AsqRule",
          "description": "The ASQ rule expression that determines which entities the policy matches."
        },
        "labels": {
          "anyOf": [
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "title": "Labels",
          "description": "Labels associated with the policy for organization and filtering."
        },
        "mitre_attack_labels": {
          "anyOf": [
            {
              "items": {
                "type": "object"
              },
              "type": "array"
            },
            {
              "type": "null"
            }
          ],
          "title": "Mitre Attack Labels",
          "description": "MITRE ATT&CK technique tags associated with the policy."
        },
        "actions": {
          "items": {
            "$ref": "#/$defs/PolicyAction"
          },
          "type": "array",
          "title": "Actions",
          "description": "The actions to perform when the policy's rules match.",
          "default": []
        }
      },
      "type": "object",
      "required": [
        "id",
        "name",
        "rule_type",
        "asq_rule"
      ],
      "title": "PersistentPolicy"
    },
    "PolicyAction": {
      "properties": {
        "type": {
          "$ref": "#/$defs/PolicyActionType",
          "description": "The type of action to perform when the policy matches."
        },
        "params": {
          "type": "object",
          "title": "Params",
          "description": "Parameters specific to the action type. The shape of this object varies by `type`. For example, an `alert` action contains `severity`, `title`, `endpoint`, and `consolidation`, while a `tag` action contains `tags` and `endpoint`. For a `risk_factor` action, the params include a `risk_factor_data` object describing the custom risk factor (`type`, `description`, `category`, `group`, `score`, `user`).",
          "default": {}
        }
      },
      "type": "object",
      "required": [
        "type"
      ],
      "title": "PolicyAction"
    },
    "PolicyActionType": {
      "type": "string",
      "enum": [
        "ALERT",
        "ALERT_CRITICAL",
        "ALERT_HIGH",
        "ALERT_LOW",
        "ALERT_MEDIUM",
        "ARMIS_SCANNER_SCAN",
        "BLOCK",
        "BLOCK_FIREWALL",
        "BLOCK_PANW",
        "BLOCK_WLC",
        "BOUNDARY",
        "CREATE_TICKETS",
        "CUSTOM_ACTION",
        "CUSTOM_PROPERTY",
        "CUSTOM_RISK_FACTOR",
        "CVE_ASSOCIATION_STATUS",
        "DEVICE_GROUP_ASSIGNMENT",
        "ENFORCEMENT",
        "LINK_LAYER_SEGMENTATION",
        "MANAGE_SWITCH_PORT",
        "NETWORK_LAYER_SEGMENTATION",
        "NEXPOSE_SCAN",
        "ORG_PRIORITY",
        "QUALYS_SCAN",
        "RAPID7_INSIGHTVM_SCAN",
        "RISK_FACTOR",
        "SERVICE_NOW_PUSH",
        "TAG",
        "TENABLE_IO_SCAN",
        "TENABLE_SC_SCAN",
        "TORQ_TRIGGER",
        "UNTAG"
      ],
      "title": "PolicyActionType"
    },
    "PolicyRuleType": {
      "type": "string",
      "enum": [
        "ACTIVITY",
        "DEVICE",
        "IP_CONNECTION",
        "VULNERABILITY"
      ],
      "title": "PolicyRuleType"
    }
  }
}