Update specific details of a rule.
Path Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| rule_id | string | optional | Pass the unique identifier of the rule. |
Body Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| name | string | optional | Pass the name of the rule within 50 characters. |
| description | string | optional | Pass the description of the rule within 2000 characters. |
| is_active | boolean | optional | Pass true to activate the rule. Else pass false. |
| status | string | optional | Pass the status of the rule. |
| tags | array | optional | Pass the list of tag IDs added to the rule. |
| trigger_on_update | boolean | optional | Pass true to trigger the rule after an update. Else pass false. |
| retry_on_broken | boolean | optional | Pass true to retry running the rule after a failed attempt. Else pass false. |
| run_rule_after_enrich | boolean | optional | Pass true to run the rule after every enrichment. Else pass false. |
| exclude_wl | boolean | optional | Pass true to exclude the allowed threat data from passing in the rule. Else pass false. |
| exclude_fp | boolean | optional | Pass true to exclude the false-positive threat data from passing in the rule. Else pass false. |
| is_follow | boolean | optional | Pass true to follow the rule. Else pass false. |
| is_manual_run | boolean | optional | Pass true to enable manually running the rule. Else pass false. |
Run it
Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).
Playground
Request parameters
Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.
Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.
Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.
Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.
curl --request PUT \
--url "https://cs-testv2.cyware.com/ctixapi/ingestion/rules/0039ac88-7fe2-4f0e-a472-7ccfe2f1db49/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
--data '{
"name": "sample rule",
"description": "sample rule description",
"is_active": false,
"status": "INACTIVE",
"tags": [],
"trigger_on_update": true,
"retry_on_broken": true,
"run_rule_after_enrich": true,
"exclude_wl": false,
"exclude_fp": false,
"is_follow": true,
"is_manual_run": true
}'View-only example — running live API calls requires a role with snippet testing access.
const url = "https://cs-testv2.cyware.com/ctixapi/ingestion/rules/0039ac88-7fe2-4f0e-a472-7ccfe2f1db49/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";
const response = await fetch(url, {
method: "PUT",
headers: {},
body: JSON.stringify({
"name": "sample rule",
"description": "sample rule description",
"is_active": false,
"status": "INACTIVE",
"tags": [],
"trigger_on_update": true,
"retry_on_broken": true,
"run_rule_after_enrich": true,
"exclude_wl": false,
"exclude_fp": false,
"is_follow": true,
"is_manual_run": true
}),
});
const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);View-only example — running live API calls requires a role with snippet testing access.
import requests
url = "https://cs-testv2.cyware.com/ctixapi/ingestion/rules/0039ac88-7fe2-4f0e-a472-7ccfe2f1db49/"
params = {
"AccessID": "<your access id>",
"Signature": "<your signature>",
"Expires": "<your expires>"
}
headers = {}
payload = {
"name": "sample rule",
"description": "sample rule description",
"is_active": false,
"status": "INACTIVE",
"tags": [],
"trigger_on_update": true,
"retry_on_broken": true,
"run_rule_after_enrich": true,
"exclude_wl": false,
"exclude_fp": false,
"is_follow": true,
"is_manual_run": true
}
response = requests.request("PUT", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)View-only example — running live API calls requires a role with snippet testing access.
{
"name": "sample rule",
"description": "sample rule description",
"is_active": false,
"status": "INACTIVE",
"tags": [],
"trigger_on_update": true,
"retry_on_broken": true,
"run_rule_after_enrich": true,
"exclude_wl": false,
"exclude_fp": false,
"is_follow": true,
"is_manual_run": true
}View-only example — running live API calls requires a role with snippet testing access.
{
"id": "0039ac88-7fe2-4f0e-a472-7ccfe2f1db49",
"name": "sample rule",
"description": "sample rule description",
"actions": [
{}
],
"rule": [
{}
],
"rule_source": [
{}
],
"no_conditions": false,
"is_active": false,
"status": "INACTIVE",
"tags": [],
"created_by": "029efea0-9324-4b9c-a10a-89db16724e0f",
"updated_by": "a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad",
"trigger_on_update": true,
"priority": 8,
"retry_on_broken": true,
"run_rule_after_enrich": true,
"exclude_wl": false,
"exclude_fp": false,
"is_follow": true,
"ctix_created": 1703853667,
"ctix_modified": 1704272116,
"is_manual_run": true,
"all_sources_and_collections": false
}View-only example — running live API calls requires a role with snippet testing access.