Sign in

v1

latestOpenAPI 3.0.12026-07-2491247233.8 KB
Rules

Update rule

Update a rule to a new definition

put/v0/rules/{id}

Path parameters

idstring required

Rule ID

Rule ID

Request body

action_idsstring[]

IDs of actions to run when the rule is triggered

attack_typesstring[]

Rule attack types

auto_review_auto_shareboolean

Whether auto-reviewed messages will be shared

auto_review_classificationstring nullable

The classification auto-reviewed messages will have, when an auto-review action is associated with the rule

descriptionstring

Description of rule

detection_methodsstring[]

Rule detection technologies

false_positivesstring[]

Descriptions of known false positives that could occur

internal_typestring nullable

For core feed only

labelstring nullable

Rule label

maturitystring nullable

Rule maturity

namestring required

Rule name

referencesstring[]

URL references

run_triage_on_excluded_messagesboolean nullable

For Triage rules only, whether this rule will run even if the message matched a global exclusion.

severitystring nullable

Rule severity

sourcestring required

Source

tactics_and_techniquesstring[]

Rule tactics and techniques

tagsstring[]

Tags

triage_abuse_reportsboolean nullable

For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.

triage_classification_changesboolean nullable

For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.

triage_dlp_rule_matchedboolean nullable

For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.

triage_flagged_messagesboolean nullable

For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.

user_provided_tagsstring[]

User-provided tags

Response

OK

action_idsstring[]

IDs of actions to run when the rule is triggered

activeboolean

Indicates whether or not the rule is active and will flag matching messages

attack_typesstring[]

Rule attack types

auto_review_auto_shareboolean

Whether auto-reviewed messages will be shared

auto_review_classification'malicious' | 'benign' | 'spam' | 'graymail' | 'simulation' | 'unwanted' | 'violation' | 'non-violation'

The classification auto-reviewed messages will have, when an auto-review action is associated with the rule

created_atstring date-time

Rule creation time

descriptionstring required

Description of rule

detection_methodsstring[]

Rule detection technologies

false_positivesstring[]

Descriptions of known false positives that could occur

idstring uuid

Rule ID

labelstring

Rule label

last_activated_atstring date-time

When the rule was last activated

maturitystring

Rule maturity

namestring required

Rule name

passiveboolean

Indicates whether or not the rule is in passive mode

referencesstring[]

URLs of reference resources for this rule

run_triage_on_excluded_messagesboolean

For Triage rules only, whether this rule will run even if the message matched a global exclusion.

severity'informational' | 'low' | 'medium' | 'high' | 'critical'

Rule severity

sourcestring required

Rule MQL (Message Query Language) source

tactics_and_techniquesstring[]

Rule tactics and techniques

tagsstring[]

Freeform tags for this rule (for example, "Executive Impersonation")

triage_abuse_reportsboolean

For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.

triage_classification_changesboolean

For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.

triage_dlp_rule_matchedboolean

For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.

triage_flagged_messagesboolean

For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.

typestring

Rule type

updated_atstring date-time

Rule last updated time