Sign in

v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB
Security Monitoring

Update an existing rule

Update an existing rule. When updating cases, queries or options, the whole field must be included. For example, when modifying a query all queries must be included. Default rules can only be updated to be enabled, to change notifications, or to update the tags (default tags cannot be removed).

put/api/v2/security_monitoring/rules/{rule_id}

Path parameters

rule_idstring required

The ID of the rule.

Request body

customMessagestring

Custom/Overridden Message for generated signals (used in case of Default rule update).

customNamestring

Custom/Overridden name (used in case of Default rule update).

groupSignalsBystring[]

Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups.

hasExtendedTitleboolean

Whether the notifications include the triggering group-by values in their title.

isEnabledboolean

Whether the rule is enabled.

messagestring

Message for generated signals.

namestring

Name of the rule.

tagsstring[]

Tags for generated signals.

versioninteger

The version of the rule being updated.

Example request

{
  "calculatedFields": [
    {
      "expression": "@request_end_timestamp - @request_start_timestamp",
      "name": "response_time"
    }
  ],
  "cases": [
    {
      "actions": [
        {
          "options": {
            "flaggedIPType": "FLAGGED"
          }
        }
      ],
      "customStatus": "critical",
      "status": "critical"
    }
  ],
  "groupSignalsBy": [
    "service"
  ],
  "hasExtendedTitle": true,
  "options": {
    "anomalyDetectionOptions": {
      "bucketDuration": 300,
      "detectionTolerance": 5
    },
    "complianceRuleOptions": {
      "regoRule": {
        "policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}",
        "resourceTypes": [
          "gcp_iam_service_account",
          "gcp_iam_policy"
        ]
      },
      "resourceType": "aws_acm"
    },
    "impossibleTravelOptions": {
      "baselineUserLocations": true
    },
    "thirdPartyRuleOptions": {
      "defaultStatus": "critical",
      "rootQueries": [
        {
          "query": "source:cloudtrail"
        }
      ]
    }
  },
  "queries": [
    {
      "customQueryExtension": "a > 3",
      "dataSource": "logs",
      "query": "a > 3"
    }
  ],
  "schedulingOptions": {
    "rrule": "FREQ=HOURLY;INTERVAL=1;",
    "start": "2025-07-14T12:00:00",
    "timezone": "America/New_York"
  },
  "thirdPartyCases": [],
  "version": 1
}

Response

OK

OR

Example response

{
  "calculatedFields": [
    {
      "expression": "@request_end_timestamp - @request_start_timestamp",
      "name": "response_time"
    }
  ],
  "cases": [
    {
      "actions": [
        {
          "options": {
            "flaggedIPType": "FLAGGED"
          }
        }
      ],
      "customStatus": "critical",
      "status": "critical"
    }
  ],
  "defaultTags": [
    "security:attacks"
  ],
  "groupSignalsBy": [
    "service"
  ],
  "options": {
    "anomalyDetectionOptions": {
      "bucketDuration": 300,
      "detectionTolerance": 5
    },
    "complianceRuleOptions": {
      "regoRule": {
        "policy": "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}",
        "resourceTypes": [
          "gcp_iam_service_account",
          "gcp_iam_policy"
        ]
      },
      "resourceType": "aws_acm"
    },
    "impossibleTravelOptions": {
      "baselineUserLocations": true
    },
    "thirdPartyRuleOptions": {
      "defaultStatus": "critical",
      "rootQueries": [
        {
          "query": "source:cloudtrail"
        }
      ]
    }
  },
  "queries": [
    {
      "customQueryExtension": "a > 3",
      "dataSource": "logs",
      "query": "a > 3"
    }
  ],
  "schedulingOptions": {
    "rrule": "FREQ=HOURLY;INTERVAL=1;",
    "start": "2025-07-14T12:00:00",
    "timezone": "America/New_York"
  },
  "thirdPartyCases": []
}