Create Rule Within Rule Group - BlinkOps Documentation

Create a rule within a rule group.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter	Description
Comment	A comment to add to the new rule.
Description	The description of the new rule.
Disposition ID	The ID of the disposition.
Field Values	A list of JSON objects that represents the field values for the new rule. Note: At lease one field value is required. For Example: `[ { “final_value”: “string”, “label”: “string”, “name”: “string”, “type”: “string”, “value”: “string”, “values”: [ { “label”: “string”, “value”: “string” } ] } ]`
Name	The name of the new rule.
Pattern Severity	The `severity` of the new rule.
Rule Group ID	The ID of the `rule group` to associate the rule with.
Rule Type ID	The rule type ID for the new rule.

Example Output

{
	"meta": {
		"query_time": 0.012345678,
		"writes": {
			"resources_affected": 1
		},
		"powered_by": "mock-engine",
		"trace_id": "aabbccdd-eeff-0011-2233-445566778899"
	},
	"resources": [
		{
			"instance_id": "mock-123",
			"customer_id": "mock-customer-abc",
			"ruletype_id": "9",
			"ruletype_name": "File Modification",
			"comment": "Mock Data Entry",
			"enabled": true,
			"deleted": false,
			"magic_cookie": 7,
			"rulegroup_id": "mock-group-xyz",
			"version_ids": [
				"v1.0"
			],
			"instance_version": 2,
			"name": "MockRule",
			"description": "This is a mock rule for testing.",
			"pattern_id": "50001",
			"pattern_severity": "medium",
			"action_label": "Log Only",
			"disposition_id": 10,
			"field_values": [
				{
					"name": "FilePath",
					"value": "/tmp/test.txt",
					"label": "File Path",
					"type": "excludable",
					"values": [
						{
							"label": "include",
							"value": "/tmp/test.txt"
						}
					],
					"final_value": "/tmp/test.txt"
				},
				{
					"name": "OperationType",
					"value": "Write",
					"label": "Operation Type",
					"type": "inclusion",
					"values": [
						{
							"label": "include",
							"value": "Write"
						}
					],
					"final_value": "Write"
				},
				{
					"name": "FileSize",
					"value": "> 1000",
					"label": "File Size",
					"type": "numerical",
					"values": [
						{
							"label": "greater than",
							"value": "1000"
						}
					],
					"final_value": "> 1000"
				}
			],
			"created_by": "mock-user-1",
			"created_on": "2025-05-18T13:00:00.000000Z",
			"modified_by": "mock-user-2",
			"modified_on": "2025-05-18T13:15:00.000000Z",
			"committed_on": "2025-05-18T13:30:00.000000Z"
		}
	]
}