Create New Rule
Create a new rule.
External Documentation
To learn more, visit the Chronicle documentation.
Parameters
Parameter | Description |
---|---|
Rule | The new rule to create in YARA-L 2.0 format. |
Example Output
{
"ruleId": "ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d",
"versionId": "ru_1f54ab4b-e523-48f7-ae25-271b5ea8337d@v_1605892700_409247000",
"ruleName": "singleEventRule2",
"metadata": {
"author": "securityuser",
"description": "single event rule that should generate detections"
},
"ruleText": "rule singleEventRule2 {
meta:
author = \"securityuser\"
description = \"single event rule that should generate detections\"
events:
$e.metadata.event_type = \"NETWORK_DNS\"
condition:
$e
}",
"ruleType": "SINGLE_EVENT",
"versionCreateTime": "2020-11-20T17:18:20.409247Z",
"compilationState": "SUCCEEDED"
}
Workflow Library Example
Create New Rule with Chronicle and Send Results Via Email