Filters, rules and taint

Update a machine rule

Partially updates a rule by id (path); only keys present in the JSON body change. Same validation/gates as create: polarity in {whitelist,blacklist}, mode 1-4 (3/Raise requires the raise grant, admins always allowed), event_pattern a valid regex, source any, a built-in source name or a non-negative number (open to every user), sanitize_scope one of the values create accepts, and a rule that would end up as mode 3 with a sanitize_scope other than any, or with a match key, is a 400. A rule's match_on cannot be changed here. Changing mode re-normalizes the stored polarity to match it. 404 if not owned by the caller. Cookie callers must pass CSRF.

This is a write: a read-only API key is refused with 403.

patch/api/machine_rules/{id}/update/

Request

  • Base URL: https://eyalsec.com
  • URL: https://eyalsec.com/api/machine_rules/{id}/update/
  • Auth: one of:
    • API key in header X-API-Key
    • API key in cookie __Host-es2session

Path parameters

idinteger required

Rule id.

Request body

polaritystring

whitelist or blacklist.

event_patternstring regex

Event-name regex; empty means all events.

modeinteger

1=hide, 2=show, 3=raise (requires the raise grant), 4=drop.

labelstring

Human label.

enabledboolean

Enable/disable the rule.

sourcestring

Taint-source scope: any, a built-in source name, or a non-negative number.

sanitize_scopestring

any, unsanitized, sanitized, conditional, or sanitized:<class>.

Response

OK.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.