Rule templates

Create a rule template

Creates a personal rule template owned by the caller. Items are validated exactly as machine rules are: source must be any/a built-in source name/a non-negative number, a non-empty event_pattern must be a valid regex (empty means all events), mode must be 1-4, and sanitize_scope must be any/unsanitized/sanitized/conditional/sanitized:<CLASS> (absent defaults to any); a mode 3 item with a sanitize_scope other than any is a 400. name is at most 128 bytes and description at most 512. Maximum 50 templates per user and 200 items per template. Names are unique per owner, case-insensitively. Cookie callers must pass CSRF.

This is a write: a read-only API key is refused with 403.

post/api/rule_templates/create/

Request

  • Base URL: https://eyalsec.com
  • URL: https://eyalsec.com/api/rule_templates/create/
  • Auth: one of:
    • API key in header X-API-Key
    • API key in cookie __Host-es2session

Request body

namestring required

Template name (unique per owner).

descriptionstring

Free-text description.

Response

Created.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.