To learn more, visit the Chronicle documentation.

​
Parameters​

ParameterDescription
RuleThe new rule to create in YARA-L 2.0 format.

​
Example Output​

{  "ruleId": "ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d",  "versionId": "ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d@v_1605892700_409247000",  "ruleName": "singleEventRule2",  "metadata": {    "author": "securityuser",    "description": "single event rule that should generate detections"  },  "ruleText": "rule singleEventRule2 {      meta:        author = \"securityuser\"        description = \"single event rule that should generate detections\"      events:        $e.metadata.event_type = \"NETWORK_DNS\"      condition:        $e      }",  "ruleType": "SINGLE_EVENT",  "versionCreateTime": "2020-11-20T17:18:20.409247Z",  "compilationState": "SUCCEEDED"}

​
Workflow Library Example​

Create New Rule with Chronicle and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

Chronicle Custom ActionEnable Or Disable Rule Alerting