Correlation - Update Correlation Rule

URI

https://164.99.19.131:8443/SentinelRESTServices/correlation/rules/{id}

Supported Methods

PUT

This API updates the correlation rule specified by {id} and/or changes the actions associated with the rule.

Authentication

Authentication Types
Sentinel Permissions Needed

URL Parameters

None.

Success Codes

Fault Codes

Request Data

Object type: Request object for Correlation rule edit
Correlation rule edit.
FieldRequiredDescription
actionsfalseThis indicates the actions to be executed when a rule fires.
activefalseThis is a Boolean value. If true, the rule is enabled and deployed, otherwise the rule is disabled. This is applicable only if the rule is deployed in a correlation engine.
deployedfalseThis is Boolean value. If true, the rule is deployed into a correlation engine.
ruledescriptionfalseThis is the description of the rule.
ruleIdtrueThis is the unique identifier of the rule.
rulelgfalseThis is the correlation rule language.
rulenamefalseThis is the name of the rule.
updatetimefalseThe time to initiate action execution when a rule fires.

Response Data

Object type: Response object for Correlation rule edit
Correlation rule edit.
FieldDescription
actionsThis indicates the actions to be executed when a rule fires.
activeThis is a Boolean value. If true, the rule is enabled and deployed, otherwise the rule is disabled. This is applicable only if the rule is deployed in a correlation engine.
deployedThis is Boolean value. If true, the rule is deployed into a correlation engine.
durationThe time duration within which the rule should fire.
isGateThis is a Boolean value. If true, the rule is a composite rule. Otherwise, the rule is a sequence/simple rule.
offlineThis is a Boolean value. If true, the engine is in stopped or error state. This is applicable only if the rule is deployed into a correlation engine.
ruledescriptionThis is the description of the rule.
ruleIdThis is the unique identifier of the rule.
rulelgThis is the correlation rule language.
rulenameThis is the name of the rule.
updatetimeThe time to initiate action execution when a rule fires.

Sample Request

PUT correlation/rules/1E6470B0-C4AF-102E-B6AA-0019B94687A1
{"ruleId":"2476D076-3E12-102E-9265-000C29D8AA3D", "rulename":"Failure Then Success", "ruledescription":"Failure Then Success", "rulelg":"sequence(filter(((e.XDASClass = 2) AND (e.XDASIdentifier = 0) AND (e.XDASOutcome = 1))),filter(((e.XDASClass = 2) AND (e.XDASIdentifier = 0) AND (e.XDASOutcome = 0))) ,300,discriminator(e.InitiatorUserName))", "active":false, "deployed":false, "updatetime":0, "actions":["777E5100-1960-102B-9985-001321B5C0B3"]}

Sample Response for application/json
Status: 200
{"ruleId":"1E6470B0-C4AF-102E-B6AA-0019B94687A1","rulename":"Failure Then Success","ruledescription":"Failure Then Success","rulelg":"sequence(filter(((e.XDASClass = 2) AND (e.XDASIdentifier = 0) AND (e.XDASOutcome = 1))),filter(((e.XDASClass = 2) AND (e.XDASIdentifier = 0) AND (e.XDASOutcome = 0))) ,300,discriminator(e.InitiatorUserName))","isGate":"false","duration":"0","updatetime":"0","deployed":"false","active":"false","offline":"false","actions":["777E5100-1960-102B-9985-001321B5C0B3"]}