API Reference
  1. Rules API
  2. public

Update Rule Public Api

patch
https://example.com/public/v1/rules/

Update a rule in your organization.

Send only fields you want to change. user_id is taken from your session and
cannot be set via the public API. Updating content replaces the typed content
for the rule's rule_type (same shapes as create).

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
string
required

Rule ID

Query Params

Specific version to update (if omitted, updates the latest version)

Body Params
SigmaRuleContent | SqlRuleContent | StreamingSqlRuleContent | ScheduledSqlRuleContent | CorrelationRuleContent | SignalCombinationRuleContent | null
enum

Rule status. See RULE_LIFECYCLE.md for state transition diagram.

Rule title

Rule description

0 to 100

Rule severity (0-100)

array | null

Rule tags

array | null

Detection categories. None = caller omitted the field (no change); [] = caller explicitly cleared the field. The service layer only writes when this is not None.

array | null

Data sources. None = caller omitted the field (no change); [] = caller explicitly cleared the field. The service layer only writes when this is not None.

User ID

object | null

Additional rule details

Headers
string
required

Your API Key ID

string

Your API Key Secret

Responses

Updated about 2 months ago

Did this page help you?
Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated about 2 months ago

Did this page help you?