Replace YARA rule file request

This API is used to update or replace the YARA rule file in the existing ruleset.

PUT https://<etp_instance_addr>/api/v1/policies/policy_uuid/configuration/rules/yara/rulesets/ruleset_uuid/file

Required header:

x-fireeye-api-key: <key>—Specifies your personal API key.

Content-Type: multipart/form-data—Content-type of the request body.

Options

Request body

It must be a YARA file as a new_file.yara attachment.

Example of the request

Values for ID and other fields are for illustration only.

PUT https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets/2aed1c8a-96c2-464a-46c7-1cfb135642a9/file

Example of the response

{
    "data": {
        "policy_master_uuid": "uuid1",
        "uuid": "ruleset1_uuid",
        "name": "ruleset1",
        "description": "desc1",
        "override_rule_weights": true,
        "default_file_weight": 49,
        "content_type": "base",
        "attachment_type": "common",
        "yara_file_name": "new_file.yara",
        "enabled": true
    },
    "meta": {
        "total": 1,
        "copyright": "Copyright 2021 FireEye Inc",
        "type": "Yara Rules"
    }
}

cURL code sample: replace YARA rule file

curl -k -XPUT https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets/2aed1c8a-96c2-464a-46c7-1cfb135642a9/file -H 'Content-Type:multipart/form-data' -H 'x-fireeye-api-key: <feye-key>' -F file=@/Users/mukthi.alva/Downloads/2.yara

This cURL sample includes the following options:

Results

This example returns the ruleset with the replaced YARA rule file.