---
title: "Update a Sigma Rule"
method: POST
path: "/v1/auto-sigma/jobs/{jobId}/{ruleId}"
tags: ["Auto Sigma"]
---

# Update a Sigma Rule

`POST /v1/auto-sigma/jobs/{jobId}/{ruleId}`

## Request

- Base URL: `https://api.recordedfuture.com/malware-intelligence`
- URL: `https://api.recordedfuture.com/malware-intelligence/v1/auto-sigma/jobs/{jobId}/{ruleId}`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Classify a Sigma rule's detection quality and optionally update its YAML content.

## Path parameters

- `jobId` string, required
- `ruleId` string, required

## Request body

- UpdateSigmaRuleRequest: Request to update a Sigma rule's classification or YAML content.
  - `rule_yaml` string: Sigma rule in YAML format
  - `status` 'True Positive' | 'False Positive' | 'Benign Behavior' | 'No Root Cause' | 'Needs Tuning' | 'New': Selected status of the rule

## Response `200`

Successful Response

- boolean: Boolean indicating if rule was updated or not

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Job or rule not found

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/revisions/190a3d1d0680?raw)