Update YARA ruleset attributes request

This API is used to update the YARA ruleset attributes.

PATCH https://<etp_instance_addr>//api/v1/policies/policy_uuid/configuration/rules/yara/rulesets/ruleset_uuid/attributes

Required header:

x-fireeye-api-key: <key>—Specifies your personal API key.

Content-Type: application/json—Content-type of the request body.

Options

policy_uuid—Universally unique identifier (UUID) of the policy.
ruleset_uuid—UUID of the ruleset.

Request body schema

The following table provides the request body schema:

Parameter	Mandatory field	Data type	Value	Description
`name`	No	string	-	Name of the ruleset.
`description`	No	string	-	Description of the ruleset.
`content_type`	No	string	base/active/base_and_active	Content type of the request body. `base`: This includes all contents of an e-mail message like headers, body, and attachments. `active`: This includes only attachments that have active content like macros embedded in them. For example, macros within MS Office documents. `base_and_active`: This includes both file and macros embedded in them. For example, MS Office documents and macros within them.
`attachment_type`	No	string	3gp, 7zip, a3x, accdb, ace, acrobatsecuritysettings, ahk, alz, apk, app, applet, arj, asf, ashx, asp, aspx, au3, avi, bat, bz2, cab, chm, cmd, com, com1, contact, css, csv, daa, dll, dmg, doc, docm, docx, dwg, dylib, eeml, egg, elf, eml, eot, exe, fas, fdf, flv, gen, gz, hlp, hml, hta, htm, hwp, hwpx, hwt, ico, inf, jar, js, jsp, jtd, lnk, lsp, lurl, lzh, mach-o, mht, mhtml, midi, mov, mp3, mp4, mpg, mpkg, msg, msi, mso, one, pdf, php, pkg, pl, png, ppsx, ppt, pptx, ps1, pub, pyc, qt, rar, raw32, raw64, rb, reg, rm, rmi, rtf, scf, sct, settingcontent-ms, sh, swf, tiff, tnef, unk, url-applet, uue, vbs, vcf, vcs, war, wav, wma, woff, wsf, xcoff, xdp, xls, xlsx, xml, xps, xsl, zip, common, custom_ehdr, custom_ehdr_hdr_only, custom_ehdr_body_only	`attachment_type`: This represents the email part to which yara rules are applied. If `common` is selected, rules are applied to all the supported file types. When a specific attachment extension is selected, rules are applied to only that specific type. If `custom_ehdr` is selected, rules are applied to header and body. If `custom_ehdr_hdr_only` is selected, rules are applied to only header. If `custom_ehdr_body_only` is selected, rules are applied to only body.
`enabled`	No	boolean	true/false	This is the API request enabled or disabled.
`override_rule_weights`	No	boolean	true/false	Use true to override the weight given in YARA rule file and use the weight in the `default_file_weight` field of the meta.json file.
`default_file_weight`	No	integer	-	This is the global weight of the file. This is optional.

Important
This API cannot be used to update the yara_file_name attribute. Only the PUT API can be used to update the yara_file_name.

Request body

{
    "enabled": true,
    "override_rule_weights": true,
    "default_file_weight": 49
}

Example of the request

Values for ID and other fields are for illustration only.

PATCH https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets/2aed1c8a-96c2-464a-46c7-1cfb135642a9/attributes -H 'Content-Type: application/json'

Example of the response

{
    "data": {
        "policy_master_uuid": "uuid1",
        "uuid": "ruleset1_uuid",
        "name": "ruleset1",
        "description": "desc1",
        "override_rule_weights": true,
        "default_file_weight": 49,
        "content_type": "base",
        "attachment_type": "common",
        "yara_file_name": "filename.yara",
        "enabled": true
    },
    "meta": {
        "total": 1,
        "copyright": "Copyright 2021 FireEye Inc",
        "type": "Yara Rules"
    }
}

cURL code sample: update YARA ruleset attributes

curl -k -XPATCH https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets/2aed1c8a-96c2-464a-46c7-1cfb135642a9/attributes -H 'Content-Type: application/json' -H 'x-fireeye-api-key: <feye-key>' -d '{"default_file_weight": 50}'

This cURL sample includes the following options:

-X PATCH—This option changes the HTTP method to PATCH.
--header "Content-Type: application/json"—This header specifies that the server's response body is expected to be in JSON format.
--header 'x-fireeye-api-key: <feye-key>'—This header specifies your personal API key.
https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets/2aed1c8a-96c2-464a-46c7-1cfb135642a9/attributes—The update YARA ruleset attributes URL. Replace etp.us.fireeye.com with the IP address of your Email Security — Cloud instance and 6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9 with the UUID of the YARA policy.

Results

This example returns the updated YARA ruleset.