---
title: "Update a Sigma Rule"
method: POST
path: "/v1/auto-sigma/jobs/{jobId}/{ruleId}"
tags: ["Auto Sigma"]
---

# Update a Sigma Rule

`POST /v1/auto-sigma/jobs/{jobId}/{ruleId}`

Classify a Sigma rule's detection quality and optionally update its YAML content.

## Path parameters

- `jobId` string, required
- `ruleId` string, required

## Request body

- UpdateSigmaRuleRequest — Request to update a Sigma rule's classification or YAML content.
  - `rule_yaml` string — Sigma rule in YAML format
  - `status` 'True Positive' | 'False Positive' | 'Benign Behavior' | 'No Root Cause' | 'Needs Tuning' | 'New' — Selected status of the rule

## Response `200`

Successful Response

- boolean — Boolean indicating if rule was updated or not

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Job or rule not found

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)