Update an existing rule

PUT {{baseUrl}}/api/v2/security_monitoring/rules/:rule_id

Update an existing rule. When updating cases, queries or options, the whole field must be included. For example, when modifying a query all queries must be included. Default rules can only be updated to be enabled, to change notifications, or to update the tags (default tags cannot be removed).

Request Body

{"cases"=>[{"condition"=>"in dolore minim", "name"=>"ad incididunt mollit eiusmod", "notifications"=>["laborum qui tempor cupidatat commodo", "ut nulla fugiat"], "status"=>"critical"}, {"condition"=>"dolore in Ut", "name"=>"incidid", "notifications"=>["Ut occaecat irure tempor", "Excepteur nulla sunt est"], "status"=>"critical"}], "complianceSignalOptions"=>{"defaultActivationStatus"=>true, "defaultGroupByFields"=>["eiusmod dolor Ut", "aute consectetur et eiusmod sunt"], "userActivationStatus"=>true, "userGroupByFields"=>["enim ut", "ex"]}, "filters"=>[{"action"=>"require", "query"=>"cillum eu anim sint"}, {"action"=>"require", "query"=>"fugiat in"}], "hasExtendedTitle"=>true, "isEnabled"=>false, "message"=>"dolore proident", "name"=>"dolore dolor", "options"=>{"complianceRuleOptions"=>{"complexRule"=>true, "regoRule"=>{"policy"=>"package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n", "resourceTypes"=>["gcp_iam_service_account", "gcp_iam_policy"]}, "resourceType"=>"aws_acm"}, "decreaseCriticalityBasedOnEnv"=>false, "detectionMethod"=>"new_value", "evaluationWindow"=>900, "hardcodedEvaluatorType"=>"log4shell", "impossibleTravelOptions"=>{"baselineUserLocations"=>true}, "keepAlive"=>1800, "maxSignalDuration"=>43200, "newValueOptions"=>{"forgetAfter"=>14, "learningDuration"=>0, "learningMethod"=>"duration", "learningThreshold"=>0}, "thirdPartyRuleOptions"=>{"defaultNotifications"=>["officia sed occaecat", "sit non pariatur"], "defaultStatus"=>"critical", "rootQueries"=>[{"groupByFields"=>["in aliqua laborum tempor", "fugiat velit"], "query"=>"source:cloudtrail"}, {"groupByFields"=>["in aute", "labore dolore magna ut nisi"], "query"=>"source:cloudtrail"}], "signalTitleTemplate"=>"eu consequat dolor qui in"}}, "queries"=>[{"aggregation"=>"new_value", "distinctFields"=>["qui veniam tempor", "id aliquip"], "groupByFields"=>["aliquip aute officia esse", "laborum "], "hasOptionalGroupByFields"=>false, "metrics"=>["dolore consectetur nulla occaecat", "labore occaecat id"], "name"=>"tempor est consequat", "query"=>"a > 3"}, {"aggregation"=>"max", "distinctFields"=>["mollit aute", "tempor enim"], "groupByFields"=>["adipisicing sint sunt irure tempor", "nulla anim id incid"], "hasOptionalGroupByFields"=>false, "metrics"=>["id in aliqua", "dolor nisi ut irure do"], "name"=>"do reprehenderit ullamco tempor", "query"=>"a > 3"}], "tags"=>["laboris eu nulla veniam", "labore nulla consequat"], "version"=>1}

HEADERS

RESPONSES

status: OK

{"cases":[{"condition":"fugiat labore laboris esse","name":"in vo","notifications":["eu non aute","labore est"],"status":"critical"},{"condition":"nisi Duis","name":"ea fugiat","notifications":["ex in","culpa dolor reprehenderit laboris Excepteur"],"status":"critical"}],"complianceSignalOptions":{"defaultActivationStatus":true,"defaultGroupByFields":["enim culpa elit nulla","irure Ut"],"userActivationStatus":false,"userGroupByFields":["in irure aute","nisi occaecat culpa"]},"createdAt":22509595,"creationAuthorId":56594621,"defaultTags":["security:attacks"],"deprecationDate":-40719165,"filters":[{"action":"require","query":"amet sit"},{"action":"suppress","query":"incididunt ullamco"}],"hasExtendedTitle":false,"id":"nulla Ut dolor","isDefault":false,"isDeleted":false,"isEnabled":false,"message":"velit dolore esse tempor","name":"cillum et voluptate","options":{"complianceRuleOptions":{"complexRule":false,"regoRule":{"policy":"package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n  # Logic that evaluates to true if the resource should be skipped\n  true\n} else = \"pass\" {\n  # Logic that evaluates to true if the resource is compliant\n  true\n} else = \"fail\" {\n  # Logic that evaluates to true if the resource is not compliant\n  true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n  some resource in input.resources[input.main_resource_type]\n  result := dd_output.format(resource, eval(resource))\n}\n","resourceTypes":["gcp_iam_service_account","gcp_iam_policy"]},"resourceType":"aws_acm"},"decreaseCriticalityBasedOnEnv":false,"detectionMethod":"threshold","evaluationWindow":900,"hardcodedEvaluatorType":"log4shell","impossibleTravelOptions":{"baselineUserLocations":true},"keepAlive":600,"maxSignalDuration":3600,"newValueOptions":{"forgetAfter":7,"learningDuration":0,"learningMethod":"duration","learningThreshold":0},"thirdPartyRuleOptions":{"defaultNotifications":["dolor ad est","dolor exercitation"],"defaultStatus":"critical","rootQueries":[{"groupByFields":["Ut","nostrud nulla id Lorem magn"],"query":"source:cloudtrail"},{"groupByFields":["reprehenderit","aliquip laborum dolore"],"query":"source:cloudtrail"}],"signalTitleTemplate":"Duis eu Excepteu"}},"queries":[{"aggregation":"sum","distinctFields":["laborum","adipisicing Excepteur dolor"],"groupByFields":["id ipsum reprehenderit","amet velit"],"hasOptionalGroupByFields":false,"metrics":["veniam commodo aliqua non Ut","veli"],"name":"quis Lorem","query":"a \u003e 3"},{"aggregation":"geo_data","distinctFields":["tempor nulla","dolor dolore eu anim"],"groupByFields":["consequat elit cillum sunt fugiat","ullamco ut"],"hasOptionalGroupByFields":false,"metrics":["nisi eiusmod","et irure ad"],"name":"cupidatat aliqua","query":"a \u003e 3"}],"tags":["esse","dolor"],"type":"application_security","updateAuthorId":29716473,"version":-86173542}