Method: curatedRuleSetDeployments.patch

Full name: projects.locations.instances.curatedRuleSetCategories.curatedRuleSets.curatedRuleSetDeployments.patch

Update a deployment of a curated rule set.

HTTP request


PATCH https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{curatedRuleSetDeployment.name}

Path parameters

Parameters
curatedRuleSetDeployment.name

string

The name of this deployment.

Query parameters

Parameters
updateMask

string (FieldMask format)

Optional. The list of fields to update. If no field mask or * is provided, all fields will be updated.

This is a comma-separated list of fully qualified names of fields. Example: "user.displayName,photo".
ruleSetDeploymentSyncDisabled

boolean

Optional. Controls the synchronization of live and alerting statuses between the Curated Rule Set and its individual rules when updating the rule set's deployment.

Default behavior (when false or unset): When you enable or disable the Curated Rule Set, this status is automatically applied to all individual rules within the set. For example: - Enabling the rule set: All its rules become active and will generate alerts if an alerting status is set. - Disabling the rule set: All its rules become inactive and stop generating alerts. Any prior individual on/off or alerting settings for rules in this set will be overridden by the set-level action.

Behavior when true: Enabling or disabling the Curated Rule Set will NOT change the current live or alerting status of the individual rules within it. This allows you to: - Keep a specific, useful rule running even if you disable the rest of the Curated Rule Set. - Disable a noisy rule without disabling the entire Curated Rule Set.

Request body

The request body contains an instance of CuratedRuleSetDeployment.

Response body

If successful, the response body contains an instance of CuratedRuleSetDeployment.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • chronicle.curatedRuleSetDeployments.update

For more information, see the IAM documentation.