Filters, rules and taint

Set the unique-event definition

Sets which fields split detections into separate events for the given scope. axes is any subset of source, detail, trace, machine, origin; an empty array keeps only the baseline (account, agent, sink); a name outside that list is ignored, not rejected. A product your account does not hold is a 400. OMITTING axes entirely clears this scope's row so it inherits the level below it; that is how you reset a machine to the account default. Applies to detections recorded from now on: it does not re-group what is already stored, and a field that was not keyed was never stored per-occurrence, so no later change can split history that has already merged. On success replies 204 No Content. Cookie callers must pass CSRF.

This is a write: a read-only API key is refused with 403.

put/api/event_uniqueness/

Request

  • Base URL: https://eyalsec.com
  • URL: https://eyalsec.com/api/event_uniqueness/
  • Auth: one of:
    • API key in header X-API-Key
    • API key in cookie __Host-es2session

Request body

machinestring

Machine public_id to scope to; omit/empty for the account default.

agent_kindstring required

Product the setting applies to, e.g. python.

Response

Done. No body.

Changes

No recorded changes to this operation across all 1 revision of this API.