delete_correlation_rule
Delete a correlation rule by ID, requiring confirmation to prevent irreversible loss of detection coverage.
Instructions
Delete a correlation rule by id. Irreversible — deleting a rule silently removes detection coverage, so this requires confirm=True. confirm: must be True to actually delete. server: which configured server to target (default active/default).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| server | No | ||
| confirm | No | ||
| rule_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |