---
title: "Update Detection Rule"
method: PUT
path: "/detection-rule/{id}"
tags: ["Detection Rule"]
---

# Update Detection Rule

`PUT /detection-rule/{id}`

## Request

- Base URL: `https://oneuptime.com/api`
- URL: `https://oneuptime.com/api/detection-rule/{id}`
- Auth: API key in header `APIKey`
- TypeScript: <https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/docs/detection-rule/:id/put.ts> (a function with typed inputs; its response is checked against the schema)

Endpoint to update an existing Detection Rule

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `data` DetectionRuleUpdateSchema, required: Update schema for DetectionRule model. Update
    - `name` string: Friendly name for this detection rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `description` string: Description of what this detection rule looks for. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `sigmaRuleYaml` string: The Sigma rule to evaluate, in YAML. detection selections and condition are compiled to a ClickHouse query over security events. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `isEnabled` boolean: Whether this detection rule is evaluated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `evaluationIntervalInMinutes` number: How often this rule is evaluated, in minutes. The evaluation window covers the time since the previous evaluation. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `isRealTime` boolean: Whether each event is checked against this rule as it arrives, within seconds, instead of every evaluation interval. Only for a rule that fires on one event: not a correlation, a match count threshold of 1, no distinct count field and no regular expression. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `groupByField` string: Optional security-event field (e.g. principalHost, principalUser) to group matches by. One alert is opened per distinct value; empty groups all matches into one alert. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `distinctCountField` string: Optional security-event field (e.g. principalUser, principalIp) whose distinct values are counted instead of raw matching events. The match count threshold then applies to that distinct count. Empty values are not counted. Names that are not typed event columns are looked up in the event's attributes map. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `matchCountThreshold` number: Fire only when a group's count — distinct values when a distinct count field is set, matching events otherwise — reaches this number within one evaluation window. 1 fires on any match. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldCreateAlert` boolean: Whether matches open OneUptime alerts. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldWriteDetectionFinding` boolean: Whether matches also write a Detection Finding security event back into the events table. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldCreateIncident` boolean: Whether matches also open OneUptime incidents. Off by default: incidents drive on-call, SLAs and status pages, so opt in per rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldCreateCase` boolean: Whether matches open security cases (or join the open case about the same entity), where the security team works them and playbooks respond. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `riskScore` number: What a match adds to the risk of the user, host or address it is about, from 0 to 100. Empty: by the rule's level. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `alertSeverityId` string, uuid: ID of the alert severity for alerts opened by this rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `incidentSeverityId` string, uuid: ID of the incident severity for incidents opened by this rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]

## Response `200`

Updated successfully

- object
  - `data` DetectionRuleReadSchema: Read schema for DetectionRule model. Read
    - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `projectId` string, uuid: ID of the project this detection rule belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation]
    - `name` string, required: Friendly name for this detection rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `description` string: Description of what this detection rule looks for. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `sigmaRuleYaml` string, required: The Sigma rule to evaluate, in YAML. detection selections and condition are compiled to a ClickHouse query over security events. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `isEnabled` boolean: Whether this detection rule is evaluated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `evaluationIntervalInMinutes` number: How often this rule is evaluated, in minutes. The evaluation window covers the time since the previous evaluation. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `isRealTime` boolean: Whether each event is checked against this rule as it arrives, within seconds, instead of every evaluation interval. Only for a rule that fires on one event: not a correlation, a match count threshold of 1, no distinct count field and no regular expression. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `groupByField` string: Optional security-event field (e.g. principalHost, principalUser) to group matches by. One alert is opened per distinct value; empty groups all matches into one alert. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `distinctCountField` string: Optional security-event field (e.g. principalUser, principalIp) whose distinct values are counted instead of raw matching events. The match count threshold then applies to that distinct count. Empty values are not counted. Names that are not typed event columns are looked up in the event's attributes map. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `matchCountThreshold` number: Fire only when a group's count — distinct values when a distinct count field is set, matching events otherwise — reaches this number within one evaluation window. 1 fires on any match. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldCreateAlert` boolean: Whether matches open OneUptime alerts. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldWriteDetectionFinding` boolean: Whether matches also write a Detection Finding security event back into the events table. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldCreateIncident` boolean: Whether matches also open OneUptime incidents. Off by default: incidents drive on-call, SLAs and status pages, so opt in per rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `shouldCreateCase` boolean: Whether matches open security cases (or join the open case about the same entity), where the security team works them and playbooks respond. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `riskScore` number: What a match adds to the risk of the user, host or address it is about, from 0 to 100. Empty: by the rule's level. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `alertSeverityId` string, uuid: ID of the alert severity for alerts opened by this rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `incidentSeverityId` string, uuid: ID of the incident severity for incidents opened by this rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule]
    - `lastEvaluatedAt` object: When the detection engine last evaluated this rule. Null means it has never run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation]
    - `lastMatchAt` object: When this rule most recently matched security events. Null means it has never matched. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation]
    - `lastError` string: The most recent evaluation error, if any. Cleared on the next successful evaluation. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation]
    - `createdByUserId` string, uuid: ID of the user who created this detection rule. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation]
    - `deletedByUserId` string, uuid: ID of the user who deleted this detection rule. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation]

## Other responses

- `400`: Bad request. This response indicates that the request was malformed or contained invalid data.
- `401`: Unauthorized. This response indicates that the request requires user authentication.
- `402`: Payment Required. This response indicates that the request requires payment or a valid subscription.
- `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it.
- `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each.
- `405`: Project not found. This response indicates that the requested project does not exist or is not accessible.
- `408`: Request Timeout. This response indicates that the server timed out waiting for the request.
- `415`: Unable to reach server. This response indicates that the server is currently unreachable or down.
- `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource.
- `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

---

[API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)