Create batch rules from input records. Rules are created disabled.

Input record:

• name (required) - Rule name. A duplicate name is rejected
• query (required) - Rule query. Parsed before the rule is stored
• schedule (required) - Cron expression, e.g. */10 * * * *
• msg (required) - Event title template. $field inserts a log field value, e.g. SSH: $src_ip -> $dst_ip
• priority (required) - LOW, MEDIUM or HIGH
• description (optional) - Free-text description
• duration (optional) - Query window in seconds
• datetrunc (optional) - Timestamp truncation unit in seconds
• dataset_guid (optional) - Dataset GUID
• category_guid (optional) - Category GUID
• ticket_repo_guid (optional) - Ticket repository GUID
• suppress_key (optional) - Suppression key template, e.g. $src_ip$dst_ip. One event per distinct combination
• event_suppress_interval (optional) - Event suppression window in seconds
• ticket_suppress_interval (optional) - Ticket suppression window in seconds
• keep_alive (optional) - true or false
• enabled (optional) - true or false. false unless given
• mitre_tactics (optional) - MITRE tactic IDs in TA0011 form - a list, or a space- or comma-separated string
• mitre_techs (optional) - MITRE technique IDs in T1071.001 form - a list, or a space- or comma-separated string

A query that does not parse fails when its schedule first fires, hours later, so it is checked here instead.

run=VALUE

Optional. Create rule only if value is 't'

Output Fields