HomeDocumentationAPI Reference
Log In
API Reference

Update whitelist rule

Update a whitelist rule.

Path Params
integer
required

whitelist ID to update

Body Params

Whitelist rule config.

A rule must say which sandflies it applies to, in one of three ways. all_sandflies is used if set; otherwise sandflies is used if it is not empty; otherwise the deprecated single sandfly is used. A request that gives none of the three is rejected. If both sandfly and a non-empty sandflies are given, sandfly must be one of the names in sandflies, or the request is rejected: a client that changes sandfly while sending back the sandflies it read would otherwise have its change silently ignored.

integer
required

whitelist ID to update. ID in URL and ID in JSON must match.

string
deprecated

Name of the single sandfly this rule relates to. Superseded by sandflies, and used only when neither sandflies nor all_sandflies is given. When sent together with a non-empty sandflies, it must be one of the names listed there. To change which sandflies a rule applies to, set sandflies and leave this property out.

sandflies
array of strings
Defaults to []

Names of the sandflies this rule applies to.

sandflies
boolean
Defaults to false

Apply this rule to every sandfly. Any names in sandflies are kept but not used while this is set, so clearing it restores them. Cannot be combined with exclude_sandfly, which together would stop every check from running on the matching hosts.

boolean
Defaults to false

Does this rule apply to all hosts. If true, host_ids and host_tags will be ignored.

host_ids
array of strings
Defaults to []

A list of host IDs that will have this rule applied.

host_ids
host_tags
array of strings
Defaults to []

A list of host tags. If a host matches any tag, it will have this rule applied.

host_tags
string
enum
Allowed:
rules
array of strings
Defaults to []

At least one rule is required if this isn't a sandfly exclusion whitelist. Rules are checked when the whitelist is saved: together they may be at most 1048576 bytes (1 MiB) long, and none may use the repeat builtin. A rule that reads data a particular result does not carry -- process fields on a result with no process data, for instance -- does not match that result.

rules
boolean
Defaults to false

If true, this sandfly will not run on configured hosts and disregard any rules.

boolean
Defaults to true

If true, the whitelist rule is enabled. If false, the whitelist will not be applied to results.

string

A descriptive comment about this whitelist rule.

Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json