---
title: "Update Report Rules"
method: PATCH
path: "/api/v2/ReportRules/{mcGuid}"
tags: ["ReportRules"]
---

# Update Report Rules

`PATCH /api/v2/ReportRules/{mcGuid}`

Update a report rule by specifying parameters in the request body when invoking the following endpoint: 

  > `PATCH https://YourAccount.lacework.net/api/v2/ReportRules/{mcGuid}`

  Replace `{mcGuid}` with the `mcGuid` value returned for a report rule in the response, when the `GET /api/v2/ReportRules` endpoint is invoked. 

 In addition, if the severity field doesn't exist for the report rule being updated, the severity field is required if you add any of the following report types:  `awsCloudtrailEvents`, `awsComplianceEvents`, `azureActivityLogEvents`, `azureComplianceEvents`, `gcpAuditTrailEvents`, `gcpComplianceEvents`, `platformEvents`, `agentEvents`.

## Path parameters

- `mcGuid` string, required

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- ReportRulesUpdateSchema
  - `filters` object — When sending a request, use this object to define the new report rule. When included in a response, this object contains details of a report rule. You can use these attributes when searching for existing report rules by invoking a GET request.
    - `name` string — The report rule's name.
    - `description` string — Summary of the report rule.
    - `enabled` unknown
    - `resourceGroups` string[] — The resource groups that you want the rule to apply to.
    - `severity` unknown[] — The severities that you want the rule to apply to. 1=Critical 2=High 3=Medium 4=Low 5=Info
      - unknown
  - `intgGuidList` string[] — The alert channels for the rule to access.
  - `reportNotificationTypes` object — The report types that you want the rule to apply to.
    - `agentEvents` boolean
    - `awsCis14` boolean
    - `awsCis401` boolean
    - `awsCisS3` boolean
    - `awsCloudtrailEvents` boolean
    - `awsComplianceEvents` boolean
    - `awsCis14IsoIec270022022` boolean
    - `awsCyberEssentials22` boolean
    - `awsCsaCcm405` boolean
    - `azureActivityLogEvents` boolean
    - `azureCis` boolean
    - `azureCis131` boolean
    - `azureComplianceEvents` boolean
    - `azurePci` boolean
    - `azurePciRev2` boolean
    - `azureSoc` boolean
    - `azureSocRev2` boolean
    - `azureIso27001` boolean
    - `azureHipaa` boolean
    - `azureNistCsf` boolean
    - `azureNist80053Rev5` boolean
    - `azureNist800171Rev2` boolean
    - `gcpAuditTrailEvents` boolean
    - `gcpCis` boolean
    - `gcpComplianceEvents` boolean
    - `gcpHipaa` boolean
    - `gcpHipaaRev2` boolean
    - `gcpIso27001` boolean
    - `gcpCis12` boolean
    - `gcpCis13` boolean
    - `gcpK8s` boolean
    - `gcpPci` boolean
    - `gcpPciRev2` boolean
    - `gcpSoc` boolean
    - `gcpSocRev2` boolean
    - `gcpNistCsf` boolean
    - `gcpNist80053Rev4` boolean
    - `gcpNist800171Rev2` boolean
    - `hipaa` boolean
    - `iso2700` boolean
    - `k8sAuditLogEvents` boolean
    - `nist800-53Rev4` boolean
    - `nist800-171Rev2` boolean
    - `openShiftCompliance` boolean
    - `pci` boolean
    - `platformEvents` boolean
    - `soc` boolean
    - `awsSocRev2` boolean
    - `trendReport` boolean
    - `awsPciDss321` boolean
    - `awsNist80053Rev5` boolean
    - `awsSoc2` boolean
    - `awsNist800171Rev2` boolean
    - `awsNistCsf` boolean
    - `awsCmmc102` boolean
    - `awsHipaa` boolean
    - `awsIso270012013` boolean
    - `incidentEvents` boolean

## Response `200`

No Error

- object
  - `data` ReportRulesResponseSchema
    - `filters` object, required — When sending a request, use this object to define the new report rule. When included in a response, this object contains details of a report rule. You can use these attributes when searching for existing report rules by invoking a GET request.
      - `name` string, required — The report rule's name.
      - `description` string — Summary of the report rule.
      - `enabled` unknown, required
      - `resourceGroups` string[] — The resource groups that you want the rule to apply to.
      - `severity` unknown[] — The severities that you want the rule to apply to. 1=Critical 2=High 3=Medium 4=Low 5=Info
        - unknown
    - `intgGuidList` string[], required — The alert channels for the rule to access.
    - `reportNotificationTypes` object, required — The report types that you want the rule to apply to.
      - `agentEvents` boolean
      - `awsCis14` boolean
      - `awsCis401` boolean
      - `awsCisS3` boolean
      - `awsCloudtrailEvents` boolean
      - `awsComplianceEvents` boolean
      - `awsCis14IsoIec270022022` boolean
      - `awsCyberEssentials22` boolean
      - `awsCsaCcm405` boolean
      - `azureActivityLogEvents` boolean
      - `azureCis` boolean
      - `azureCis131` boolean
      - `azureComplianceEvents` boolean
      - `azurePci` boolean
      - `azurePciRev2` boolean
      - `azureSoc` boolean
      - `azureSocRev2` boolean
      - `azureIso27001` boolean
      - `azureHipaa` boolean
      - `azureNistCsf` boolean
      - `azureNist80053Rev5` boolean
      - `azureNist800171Rev2` boolean
      - `gcpAuditTrailEvents` boolean
      - `gcpCis` boolean
      - `gcpComplianceEvents` boolean
      - `gcpHipaa` boolean
      - `gcpHipaaRev2` boolean
      - `gcpIso27001` boolean
      - `gcpCis12` boolean
      - `gcpCis13` boolean
      - `gcpK8s` boolean
      - `gcpPci` boolean
      - `gcpPciRev2` boolean
      - `gcpSoc` boolean
      - `gcpSocRev2` boolean
      - `gcpNistCsf` boolean
      - `gcpNist80053Rev4` boolean
      - `gcpNist800171Rev2` boolean
      - `hipaa` boolean
      - `iso2700` boolean
      - `k8sAuditLogEvents` boolean
      - `nist800-53Rev4` boolean
      - `nist800-171Rev2` boolean
      - `openShiftCompliance` boolean
      - `pci` boolean
      - `platformEvents` boolean
      - `soc` boolean
      - `awsSocRev2` boolean
      - `trendReport` boolean
      - `awsPciDss321` boolean
      - `awsNist80053Rev5` boolean
      - `awsSoc2` boolean
      - `awsNist800171Rev2` boolean
      - `awsNistCsf` boolean
      - `awsCmmc102` boolean
      - `awsHipaa` boolean
      - `awsIso270012013` boolean
      - `incidentEvents` boolean
    - `type` 'Report', required — The data type as `Report`.
    - `mcGuid` string — Report Rule ID.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/versions/7015f76895f2/schema)