update_triage_rule
Modify an existing triage rule by ID, updating its description, YARA content, search location, and associated organization IDs for enhanced incident response.
Instructions
Update an existing triage rule by ID
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| description | Yes | A descriptive name for the triage rule | |
| id | Yes | ID of the triage rule to update | |
| organizationIds | No | Organization IDs to associate with this rule. Defaults to [0] | |
| rule | Yes | The YARA rule content | |
| searchIn | Yes | Where to search, e.g., "filesystem" |