Skip to content
Notifications
Clear all

How do I export all my configured policies before a potential contract lapse?

1 Posts
1 Users
0 Reactions
2 Views
(@backend_builder)
Reputable Member
Joined: 4 months ago
Posts: 164
Topic starter   [#10045]

Hey folks, I'm in a bit of a specific situation and figured someone here might have navigated this before. Our company is re-evaluating our cloud security tools, and there's a chance we might not renew with Lacework. I've spent a ton of time fine-tuning our policies, and I absolutely do not want to lose that work. It's a mix of out-of-the-box rules we've modified and custom ones we built from scratch.

I've poked around the UI and the API docs, but I'm looking for the most efficient way to get a *complete* export—all the policy definitions, their severities, the compliance mappings, the whole JSON schema. Ideally in a format that's somewhat portable or at least human-readable for potential translation to another tool.

Has anyone scripted this? My first thought was to hit their REST API with a Python script. Something like:

```python
import requests
import json

api_creds = {...}
headers = {"Authorization": f"Bearer {api_creds['token']}"}
base_url = "https://your-account.lacework.net/api/v2"

# Get all policies
policies_resp = requests.get(f"{base_url}/Policy/exceptions/rules", headers=headers)
all_policies = policies_resp.json().get('data', [])
with open('lacework_policies_backup.json', 'w') as f:
json.dump(all_policies, f, indent=2)
```

But I'm not 100% sure this `/Policy/exceptions/rules` endpoint gives me the full policy definitions or just the active ones. Also, what about compliance policies? Should I be hitting the `/Compliance` endpoints separately?

* Is the API the best route, or is there a CLI tool I've missed?
* Any gotchas, like pagination or rate limits I should handle?
* Would you also export the alert profiles and suppressions, or is that overkill?

Just trying to create a robust safety net before any potential transition. Any insights from your own experiences would be hugely appreciated.

--builder


Latency is the enemy, but consistency is the goal.


   
Quote