createCustomRule
Method to create a custom rule.
Parameters
Parameter | Description | Included in request | Type | Value requirements |
|---|---|---|---|---|
| The type of the rule to be created: detection or exclusion. | Optional | Integer | Possible values:
Default value: |
| Specifies whether the rule is YARA-based or Basic. | Optional | Integer | Possible values:
Default value: |
| The name of the rule to be created. | Mandatory | String | This parameter cannot begin with a whitespace character, cannot include the characters Also, it cannot be duplicated within your company. |
| The description of the rule. | Optional | String | This parameter cannot begin with a whitespace character, cannot include the characters |
| The list of associated rule tags. | Optional | Array of Strings | Each string must:
|
| The settings associated with the rule. | Mandatory | Object | Refer to |
| Indicates if the request will return the ID of the new rule. | Optional | Boolean | Possible values:
Default value: |
These are common parameters, available across all public API methods:
Parameter | Description | Included in request | Type | Value requirements |
|---|---|---|---|---|
| This parameter adds an identifier to the request, linking it to its corresponding response. The target replies with the same value in the response, allowing easy call tracking. | Mandatory | String | No additional requirements. |
| The name of the method you are using to send the request. | Mandatory | String | Must be a valid method name. |
| The version of JSON-RPC used by the request and the response. | Mandatory | String | The only possible value is |
| An object containing the configuration of the request. | Mandatory | Object | No additional requirements. |
Objects
settings
Name | Description | Included in request | Type | Value requirements |
|---|---|---|---|---|
| Indicates if the rule is active or has On-access scanning enabled. | Optional | Integer | Possible values for Basic rules:
Possible values for YARA rules:
Default value for YARA and Basic rules: |
| Indicates the severity of the alerts that will be generated. | Mandatory for detection rules Not applicable to exclusion rules. | Integer | Possible values:
|
| Indicates the type of the target entity. | Mandatory for Basic rules Not applicable to YARA rules | String | Possible values for custom exclusion and detection rules:
Possible values available only for custom exclusion rules:
|
| Defines the rule by listing the exclusion or detection sub-rules that the specified ImportantThis parameter does not include definitions related to the | Mandatory for Basic rules Not applicable to YARA rules | Array of Objects | Each object contains the following settings:
NoteFor information on the possible values of |
| Contains the exclusion or detection sub-rules related to the | Optional for Basic rules Not applicable to YARA rules | Array of Objects ImportantIt is an array containing a single object, as only one | The object within the array contains the following settings:
NoteFor information on the |
| Defines the YARA rule query. | Mandatory for YARA rules Not applicable to Basic rules | String | This value must follow YARA syntax rules. TipWhile whitespace and indentation are ignored during rule validation, the original For readability, we recommend using properly formatted and indented YARA syntax in For example, to display the following formatted rule in the UI: rule Demo_Spaced {
meta:
author = "api"
description = "indent test"
strings:
$mz = { 4D 5A }
condition:
$mz
} The |
| Indicates the automatic response actions and their enablement status for EDR incidents generated by this rule. Important
| Optional for EDR detection rules, including YARA rules Not applicable to exclusion rules or XDR detection rules | Array of Objects | Each object contains the following settings:
|
Return value
This method returns either the ID of the newly created rule (String) or a Boolean value which is true if the creation of the custom rule was successful.
Example
Request:
Creating a Basic rule:
{
"params": {
"type": 1,
"name": "Detection Rule via API",
"description": "Detection Rule via API Description",
"settings": {
"status": 0,
"severity": 1,
"target": "file",
"automaticActions": [
{
"type": 1,
"enabled": true
}
],
"criteriaList": [
{
"field": "File.Name",
"relation": "is",
"value": "abcd"
}
],
"filters": [
{
"field": "detection",
"value": "test-api"
}
]
},
"returnRuleId": true
},
"jsonrpc": "2.0",
"method": "createCustomRule",
"id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}Creating a YARA rule:
{
"jsonrpc": "2.0",
"method": "createCustomRule",
"params": {
"type": 1,
"subtype": 1,
"name": "YARA Detection Rule via API",
"description": "YARA detection",
"tags": [
"API",
"yara"
],
"settings": {
"status": 1,
"severity": 2,
"yaraQuery": "rule demo { condition: true }",
"automaticActions": [
{
"type": 5,
"enabled": true,
"settings": {
"type": 2
}
}
]
},
"returnRuleId": true
},
"id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}Response:
{
"id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
"jsonrpc": "2.0",
"result": "6372b7a3897aaa77ee021642"
}