Update a detection rule
Spaces method and path for this operation:
<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>Refer to Spaces for more information.
Update a detection rule using the rule_id or id field. The original rule is replaced, and all unspecified fields are deleted.
The difference between the id and rule_id is that the id is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas rule_id is a stable rule identifier that can be assigned during rule creation.
warn When used with API key authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.
If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.
Request body
Example request
{
"actions": [
{
"frequency": {
"throttle": "1h"
}
}
],
"description": "Detects anomalous Windows process creation events.",
"name": "Anomalous Windows Process Creation",
"related_integrations": [
{
"integration": "activitylogs",
"package": "azure",
"version": "~1.1.6"
}
],
"response_actions": [
{
"params": {
"config": {
"linux": {
"timeout": 60
},
"macos": {
"timeout": 60
},
"windows": {
"timeout": 60
}
}
}
}
],
"throttle": "1h"
}Response
Indicates a successful call.
Example response
{
"actions": [
{
"frequency": {
"throttle": "1h"
}
}
],
"description": "Detects anomalous Windows process creation events.",
"name": "Anomalous Windows Process Creation",
"related_integrations": [
{
"integration": "activitylogs",
"package": "azure",
"version": "~1.1.6"
}
],
"response_actions": [
{
"params": {
"config": {
"linux": {
"timeout": 60
},
"macos": {
"timeout": 60
},
"windows": {
"timeout": 60
}
}
}
}
],
"throttle": "1h"
}