Update Rule

PUT 
/api/v1/rules/:name

Replace a detection rule (re-runs creation pipeline, preserves created_at).

A replacement the hunt runner could not compile is refused with 422 and the stored rule is left as it was. A production+team write is routed to a review branch instead of the branch the runner git-syncs, and the X-DFE-Review-Required header says so.

Request

Responses

200

Successful Response

401

No valid session: the credentials are missing, invalid or expired, or the account behind them is disabled or blocked

403

Refused: the session lacks the action this route checks, or its account must replace an issued password first. A SCIM route answers a refused action in the RFC 7644 error envelope

422

Refused, nothing written. The body failed validation (code validation_error). Or the hunt runner could not compile the rule -- its SQL does not parse as one SELECT, names no <db>.<table> source, names a source that is not a table name (letters, digits, '_' and '-'), has no WHERE to detect with, or calls a function that reads outside the row (url, s3, a dictionary) or sends it to another service (the ai* functions), or carries a CEL filter that does not transpile (code invalid_sql, the errors in sql_errors). Or the rule matches every event in its source (code rule_matches_everything, the source and detection WHERE in context).

default

Problem details (RFC 9457)