Skip to main content
Create a new rule.
External DocumentationTo learn more, visit the Chronicle documentation.

​
Parameters

ParameterDescription
RuleThe new rule to create in YARA-L 2.0 format.

​
Example Output

{
  "ruleId": "ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d",
  "versionId": "ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d@v_1605892700_409247000",
  "ruleName": "singleEventRule2",
  "metadata": {
    "author": "securityuser",
    "description": "single event rule that should generate detections"
  },
  "ruleText": "rule singleEventRule2 {
      meta:
        author = \"securityuser\"
        description = \"single event rule that should generate detections\"
      events:
        $e.metadata.event_type = \"NETWORK_DNS\"
      condition:
        $e
      }",
  "ruleType": "SINGLE_EVENT",
  "versionCreateTime": "2020-11-20T17:18:20.409247Z",
  "compilationState": "SUCCEEDED"
}

​
Workflow Library Example

Create New Rule with Chronicle and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I