Updates the organization's notification policy

The policy contains targets, which are named destinations, for example a list of admins, and then rules for how notifications are routed. The most basic notification is the default policy assigned to all organizations, which is to send notifications to the organization owner.

Each notification has a schema which can be used to filter how notifications are routed.

Here is an example notification policy:

{
    "targets": {
      "admins": {
        "emails": [
          "admin1@foo.com",
          "admin2@foo.com"
        ]
      },
      "soc": {
        "slack": {
          "url": "http://app.slack.com/XXXX"
        }
      }
    },
    "routes": [
      {
        "target": "admins",
        "expr": {
          "schema": "agent_offline"
        }
      },
      {
        "target": "soc",
        "expr": {
          "schema": "spydertrace_updated"
        }
      },
      {
        "destination": {
          "users": [
            "X23hs8234lks"
          ]
        }
      }
    ]
  }

This policy says that any notification with the schema "agent_offline" is send to the admin emails, and that any notifications with the schema "spydertrace_update" is send to the soc slack channel, and all other notifications are sent to a user specified by their UserUID. If a destination is an explicit UserUID then the users notification policy will applied, for example to notify them by their notification type of choice.

• The following destination types are currently supported, UserUID, Email, Slack, Webhook. See the associated destination definition in the notification policy for details.
• First match for a routing rule wins, and further processsing of the notification stops.
• If a UserUID is specified the users notification policy may be used to contact that user.
• Each notification has an associated schema, which is used to provide a consistent schema for the notification.
• Expressions are optional, if no expression is specified the route matches by default
• If the content-type is application/hjson the policy will be parsed and stored as hjson, all comments will be lost on an existing hjson policy if it is uploaded as json

This is an example notification generated by a notification policy:

{
	"uid": "lQ0Q1lKm",
	"org_uid": "your_org_uid",
	"valid_from": "2021-10-14T19:22:00.869159169Z",
	"title": "Spyderbat: Interactive shell detected",
	"message": "An interactive shell was started on machine mach:123456.",
	"data": {
	  "route_id": "RTBQoR3uucyjG8ZeHJmw",
	  "details": {
		"Agent UID": "agent:123456789",
		"Machine UID": "mach:123456",
		"Time": "2021-10-14 19:22:00Z"
	  },
	  "linkback_text": "View in Spyderbat",
	  "linkback_url": "https://app.spyderbat.com/app/org/your_org_uid/search"
	},
	"schema": "analytics_object_notification"
  }

• Requires the user have the action org:UpdateNotificationPolicy on the organization