create simple rule

run-tests-firstboolean

set this field to false to exclude running tests prior to saving

run-tests-onlyboolean

set this field to true if you want to run tests without saving

Request body

alertContextstring

The alert context represented in YAML

alertTitlestring

The alert title represented in YAML

createAlertboolean

Determines whether the rule should create alerts when it triggers

dedupPeriodMinutesinteger

The amount of time in minutes for grouping alerts

descriptionstring

The description of the rule

detectionstring required

The yaml representation of the rule

displayNamestring

The display name of the rule

dynamicSeveritiesstring

The dynamic severity represented in YAML

enabledboolean

Determines whether or not the rule is active

groupBystring

The key on an event to group by represented in YAML

idstring required

The id of the rule

inlineFiltersstring

The filter for the rule represented in YAML

logTypesstring[]

log types

managedboolean

Determines if the simple rule is managed by panther

outputIDsstring[]

Destination IDs that override default alert routing based on severity

pythonBodystring

The python body of the rule

referencestring

A URL or note for additional reference material

reportsobject

reports

runbookstring

How to handle the generated alert

severity'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' required

summaryAttributesstring[]

A list of fields in the event to create top 5 summaries for

tagsstring[]

The tags for the simple rule

thresholdinteger

the number of events that must match before an alert is triggered

Response

OK response.