Update detection rule

Update a detection rule by sending a new JSON structure.

Service endpoint	/rules/v2/{rule_id}
Optional query string parameters	—
Example	https://protectapi.cylance.com/rules/v2/c407f28a-3805-4014-b32c-0c2553ac1e10
Method	HTTP/1.1 PUT
Request headers	Accept: application/json Authorization: Bearer `JWT Token returned by Auth API` with the opticsrule:update scope encoded

Request

{
    "Name": "Name of Detection Rule",
    "Description": "Description of Detection Rule",
    "Severity": "High",
    "ObjectType": "DetectionRule",
    "OperatingSystems": [
        {
            "Name": "Windows"
        }
    ],
    "Plugin": {
        "Name": "OpticsDetector"
    },
    "Product": {
        "Name": "CylanceOPTICS"
    },
    "SchemaVersion": 1,
    "States": [
        {
            "Name": "MaliciousApp",
            "Scope": "Global",
            "Function": "Function",
            "FieldOperators": {
                "Function": {
                    "Type": "EqualsAny",
                    "Operands": [
                        {
                            "Source": "LiteralSet",
                            "Data": "badapp.exe"
                        }
                    ],
                    "OperandType": "string",
                    "Options": {
                        "IgnoreCase": true
                    }
                }
            },
            "Actions": [
                {
                    "Type": "AOI",
                    "ItemName": "InstigatingProcess",
                    "Position": "PostActivation"
                }
            ],
            "Filters": [
                {
                    "Type": "Event",
                    "Data": {
                        "Category": "Process",
                        "SubCategory": "",
                        "Type": "*"
                    }
                }
            ]
        }
    ],
    "Tags": [
        "CylanceOPTICS"
    ]                
}

Response

Please see the Response status codes for more information.

Request JSON schema

Field Name	Description
Description	This is the description for the detection rule.
Name	This is the name of the detection rule.
ObjectType	This is the type of object defined in this rule. DetectionRule ResponseRule
OperatingSystems	These are the affected operating systems. Name: This is the name of the type of operating system (like Windows, macOS, or Linux).
Plugin	This is the CylanceOPTICS plugin associated with the detection rule.
Product	This is the name of the product associated with the detection rule.
SchemaVersion	This is the version of the schema.
Severity	This is the severity assigned to the detection rule. Possible values are: High Medium Low Informational
States	This is the list of all available states. If no paths are specified, the states are transitioned in the order they are specified.
Tags	This is a list of tags associated with the detection rule.

Response JSON schema

Field Name	Description
Description	This is the description for the detection rule.
Id	This is the unique identifier for the detection rule.
Name	This is the name of the detection rule.
ObjectType	This is the type of object defined in this rule. DetectionRule ResponseRule
OperatingSystems	These are the affected operating systems. Name: This is the name of the type of operating system (like Windows, macOS, or Linux).
Plugin	This is the CylanceOPTICS plugin associated with the detection rule.
Product	This is the name of the product associated with the detection rule.
RuleSourceGrouping	This is the classification or designator for the rule source (for example, CylanceOPTICS ).
SchemaVersion	This is the version of the schema.
Severity	This is the severity assigned to the detection rule. The possible values are: High Medium Low Informational
States	This is the list of all available states. If no paths are specified, the states are transitioned in the order they are specified.
Tags	This is a list of tags associated with the detection rule.
Version	This is the version of the detection rule.

The response JSON schema contains the entirety of the detection rule Logic.

The "id" and "version" fields are automatically populated when the request is submitted.

Section:

Detection rule API