Update stream rule

Updates a specified stream rule.

Required Permissions

Requires the ADMIN role or higher.

HTTP Request

PUT /api/sonar/stream-rules/:guid

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     -d priority="MEDIUM" \
     -d name="Access to known botnet networks" \
     -d msg="Access to known botnet networks: $dst_ip" \
     -d schema_code="session" \
     -d commands="[{'template_id': 3, 'query': 'matchnet invert=t field=dst_ip guid=697393b6-aecf-4e9d-a32c-8724cd8f067e verify=f', 'field_name': 'dst_ip', 'args':{'subnet':'697393b6-aecf-4e9d-a32c-8724cd8f067e'}}]" \
     -X PUT \
     https://HOSTNAME/api/sonar/stream-rules/5a6b63f0-87d5-49c4-a5a1-94da4141b2f5

Request Parameters

Key	Required	Type	Description	Note
priority	Yes	String	Priority	`LOW` or `MEDIUM` or `HIGH`
guid	Yes	String	Stream rule GUID	36 characters
name	Yes	String	Stream rule name	Minimum 1 to maximum 255 characters
description	No	String	Stream rule Description	Maximum 2,000 characters
msg	Yes	String	Message template	Minimum 1 to maximum 2,000 characters
enabled	No	Boolean	Whether the rule is enabled or not	`true` or `false`
category_guid	No	String	Stream rule category GUID	36 characters
schema_code	Yes	String	Log schema code	Minimum 1 to maximum 50 characters
logger_guids	Yes	Array	Logger GUID list
commands	Yes	Array	List of stream rules	At leat 1 command required. Refer to the below description.
address_group_guid	No	String	Address group GUID	36 characters
address_field	No	String	Address field	Address group field name. Maximum 50 characters.
ticket_issue_cond	No	String	Ticket issuance condition	One of `NEVER`, `ETIR_THRESHOLD`, `ALWAYS`. If omitted, the existing value is kept.
ticket_repo_guid	No	String	Ticket repository GUID	Required when `ticket_issue_cond` is not `NEVER`. 36 characters
ticket_assignee_guid	No	String	Ticket assignee GUID	If specified, ticket is assigned automatically.
ticket_suppress_interval	No	32-bit integer	Suppression period for duplicated ticket in seconds	If set to `0` or not specified, duplicate tickets are not merged.
event_suppress_interval	No	32-bit integer	Suppression period for duplicated event in seconds	If set to `0` or not specified, duplicate events are not merged.
suppress_key	No	String	Suppress key field	Macro in `$field` format available. Max. 2,000 characters
keep_alive	No	Boolean	Whether to keep the suppression timer alive	`true` to keep the timer alive, `false` to reset it.
audit_category_guid	No	String	Audit category GUID	36 characters. If not specified, an auto audit request is not sent.
reviewer_guid	No	String	Reviewer GUID	36 characters
auditor_guid	No	String	Auditor GUID	36 characters. If not specified, the department head is assigned as default.
audit_days	No	32-bit integer	Audit due date	Minimum 1 to maximum 365 days
employee_key_field	No	String	Employee number field	Maximum 50 characters. If not specified, an auto audit request is not sent.
alarm_group_guid	No	String	Alarm group GUID	36 characters
field_order	No	String	Evidence field output order	Maximum 2,000 characters
user_note	No	String	Explanation request message	Maximum 2,000 characters
mitre_techniques	No	String List	MITRE ATT&CK technique ID	Comma-separated IDs. Related tactics are automatically included.
mitre_tactics	No	String List	MITRE ATT&CK tactic ID	Comma-separated IDs. Used when specifying tactics only.
signature_app	No	String	Signature app name

Each array element in commands is as follows:

Key	Required	Type	Description
template_id	Yes	32-bit integer	Stream rule command template ID
query	Yes	String	Query string portion
field_name	No	String	Target field name
args	No	Map	Argument key/value
invert	No	Boolean	Whether to use an invert match option

Success Response

{}

Error Responses

Required argument is missing

HTTP status code 400

{
    "error_code": "null-argument",
    "error_msg": "schema_code should be not null"
}

Invalid argument length

HTTP status code 400

{
    "error_code": "invalid-argument",
    "error_msg": "'schema_code' must be shorter than or equal to 50 characters."
}

Invalid priority value

HTTP status code 400

{
    "error_code": "invalid-argument",
    "error_msg": "priority should be one of 'LOW', 'MEDIUM', 'HIGH'."
}

Identifier is not in valid GUID format

HTTP status code 400

{
    "error_code": "invalid-param-type",
    "error_msg": "category_guid should be guid type."
}

List of stream rule commands is not in valid JSON format

HTTP status code 400

{
    "error_code": "invalid-argument",
    "error_msg": "'commands' parameter should follow valid JSON syntax"
}

Stream rule is not found

HTTP status code 500

{
    "error_code": "illegal-state",
    "error_msg": "stream rule not found: 9071a6fe-6b91-4448-9761-7123381cb026"
}

Log schema is not found

HTTP status code 500

{
    "error_code": "illegal-state",
    "error_msg": "schema not found: unknown"
}

No privilege to create a stream rule

HTTP status code 500

{
    "error_code": "illegal-state",
    "error_msg": "no-permission"
}