updateCustomRule
You can use this method to edit any existing custom exclusion or detection rule by referencing its Rule ID.
Parameters
Parameter | Description | Included in request | Type | Value requirements |
|---|---|---|---|---|
| The ID of the rule to be updated. | Mandatory | String | This parameter should consist of exactly 24 hexadecimal characters. |
| The type of the rule to be updated. | Mandatory for detection rules Optional for exclusion rules | Integer | Possible values:
Default value: |
| The rule’s new name | Mandatory | String | This parameter cannot begin with a whitespace character, cannot include the characters Also, it cannot be duplicated within the same company. |
| The new description of the rule. | Optional | String | This parameter cannot begin with a whitespace character, cannot include the characters |
| The new list of associated rule tags. | Optional | Array of Strings | Each string must:
|
| The settings associated with the rule. | Mandatory | Object | Refer to |
These are common parameters, available across all public API methods.
Parameter | Description | Included in request | Type | Value requirements |
|---|---|---|---|---|
| This parameter adds an identifier to the request, linking it to its corresponding response. The target replies with the same value in the response, allowing easy call tracking. | Mandatory | String | No additional requirements. |
| The name of the method you are using to send the request. | Mandatory | String | Must be a valid method name. |
| The version of JSON-RPC used by the request and the response. | Mandatory | String | The only possible value is |
| An object containing the configuration of the request. | Mandatory | Object | No additional requirements. |
Objects
settings
Name | Description | Included in request | Type | Value requirements |
|---|---|---|---|---|
| Indicates if the rule is active. | Optional | Integer | Possible values for Basic rules:
Possible values for YARA rules:
|
| Indicates the severity of the alerts that will be generated. | Mandatory for detection rules Not applicable to exclusion rules | Integer | Possible values:
|
| Indicates the type of the target entity. | Mandatory for Basic rules Not applicable to YARA rules | String | Possible values for custom exclusion and detection rules:
Possible values available only for custom exclusion rules:
|
| Defines the rule by listing the exclusion or detection sub-rules that the specified ImportantThis parameter does not include definitions related to the | Mandatory for Basic rules Not applicable to YARA rules | Array of Objects | Each object contains the following settings:
NoteFor information on the possible values of |
| Contains the exclusion or detection sub-rules related to the | Optional for Basic rules Not applicable to YARA rules | Array of Objects ImportantIt is an array containing a single object, as only one | The object within the array contains the following settings:
NoteFor information on the |
| Indicates the automatic response actions and their enablement status for EDR incidents generated by the rule. Important
| Optional for EDR detection rules, including YARA rules Not applicable to exclusion rules or XDR detection rules | Array of Objects | Each object contains the following settings:
|
| Defines the YARA rule query. | Mandatory for YARA rules Not applicable to Basic rules | String | This value must follow YARA syntax rules. TipWhile whitespace and indentation are ignored during rule validation, the original For readability, we recommend using properly formatted and indented YARA syntax in For example, to display the following formatted rule in the UI: rule Demo_Spaced {
meta:
author = "api"
description = "indent test"
strings:
$mz = { 4D 5A }
condition:
$mz
} The |
Return value
Attribute | Type | Description |
|---|---|---|
| Boolean | Returns |
Example
Request
Updating a Basic rule:
{
"params": {
"ruleId": "61827b8036492c2fc0718722",
"type": 1,
"name": "Detection Rule via API",
"description": "description test api",
"tags": [
"test",
"api",
"demo"
],
"settings": {
"status": 1,
"severity": 1,
"target": "connection",
"criteriaList": [
{
"field": "Connection.DestinationPort",
"relation": "is",
"value": "25691"
},
{
"field": "Connection.Process.Name",
"relation": "contains",
"value": "./network1"
},
{
"field": "Connection.SourcePort",
"relation": "any",
"value": [
"22",
"23",
"24"
]
}
],
"automaticActions": [
{
"type": 4,
"enabled": true,
"settings": {
"includeParent": false,
"includeChildren": true
}
}
]
}
},
"jsonrpc": "2.0",
"method": "updateCustomRule",
"id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}Updating a YARA rule:
{
"jsonrpc": "2.0",
"method": "updateCustomRule",
"params": {
"ruleId": "6182a7e26f59d3072a1e8fc5",
"type": 1,
"name": "YARA Detection Rule via API",
"description": "YARA detection",
"tags": [
"API",
"yara"
],
"settings": {
"status": 1,
"severity": 2,
"yaraQuery": "rule demo { condition: true }",
"automaticActions": [
{
"type": 5,
"enabled": true,
"settings": {
"type": 2
}
}
]
}
},
"id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
} Response
{
"id": "301f7b05-ec02-481b-9ed6-c07b97de2b7b",
"jsonrpc": "2.0",
"result": true
}