PUT /api/rules/{id}

{
  "yaml_content": "title: Updated Rule\n...",
  "redeploy": true
}

curl -X PUT \
  -H "Authorization: Bearer eyJ..." \
  -H "Content-Type: application/json" \
  -H "X-CSRF-Token: abc123..." \
  -d '{
    "yaml_content": "title: Updated Rule\nstatus: stable\nlogsource:\n  product: windows\n  service: security\ndetection:\n  selection:\n    EventID: 4625\n  condition: selection\nlevel: high",
    "redeploy": true
  }' \
  https://chad.example.com/api/rules/abc-123

{
  "id": "abc-123",
  "title": "Updated Rule",
  "yaml_content": "title: Updated Rule\n...",
  "status": "deployed",
  "severity": "high",
  "version": 4,
  "updated_at": "2024-01-15T15:00:00Z",
  "updated_by": "analyst@example.com"
}

{
  "webhook_enabled": false,
  "jira_enabled": false
}

{
  "detail": "Rule not found"
}

{
  "detail": "Invalid YAML syntax"
}

{
  "detail": "Validation failed",
  "errors": [
    {
      "field": "level",
      "message": "Invalid severity value"
    }
  ]
}

{
  "detail": "Not enough permissions"
}

import requests

updated_yaml = """
title: Enhanced Failed Login Detection
status: stable
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
  filter:
    User: 'ANONYMOUS LOGON'
  condition: selection and not filter
level: high
tags:
  - attack.credential_access
  - attack.t1110
"""

response = requests.put(
    f"{BASE_URL}/api/rules/abc-123",
    headers={
        "Authorization": f"Bearer {JWT_TOKEN}",
        "X-CSRF-Token": csrf_token
    },
    json={
        "yaml_content": updated_yaml,
        "redeploy": True
    }
)

if response.ok:
    rule = response.json()
    print(f"Updated to version {rule['version']}")

const response = await fetch(
  'https://chad.example.com/api/rules/abc-123',
  {
    method: 'PUT',
    headers: {
      'Authorization': `Bearer ${jwtToken}`,
      'Content-Type': 'application/json',
      'X-CSRF-Token': csrfToken
    },
    body: JSON.stringify({
      yaml_content: updatedYaml,
      redeploy: true
    })
  }
);

const rule = await response.json();
console.log(`Updated to version ${rule.version}`);