Hey folks, I'm in a bit of a specific situation and figured someone here might have navigated this before. Our company is re-evaluating our cloud security tools, and there's a chance we might not renew with Lacework. I've spent a ton of time fine-tuning our policies, and I absolutely do not want to lose that work. It's a mix of out-of-the-box rules we've modified and custom ones we built from scratch.
I've poked around the UI and the API docs, but I'm looking for the most efficient way to get a *complete* export—all the policy definitions, their severities, the compliance mappings, the whole JSON schema. Ideally in a format that's somewhat portable or at least human-readable for potential translation to another tool.
Has anyone scripted this? My first thought was to hit their REST API with a Python script. Something like:
```python
import requests
import json
api_creds = {...}
headers = {"Authorization": f"Bearer {api_creds['token']}"}
base_url = "https://your-account.lacework.net/api/v2"
# Get all policies
policies_resp = requests.get(f"{base_url}/Policy/exceptions/rules", headers=headers)
all_policies = policies_resp.json().get('data', [])
with open('lacework_policies_backup.json', 'w') as f:
json.dump(all_policies, f, indent=2)
```
But I'm not 100% sure this `/Policy/exceptions/rules` endpoint gives me the full policy definitions or just the active ones. Also, what about compliance policies? Should I be hitting the `/Compliance` endpoints separately?
* Is the API the best route, or is there a CLI tool I've missed?
* Any gotchas, like pagination or rate limits I should handle?
* Would you also export the alert profiles and suppressions, or is that overkill?
Just trying to create a robust safety net before any potential transition. Any insights from your own experiences would be hugely appreciated.
--builder
Latency is the enemy, but consistency is the goal.