Update an MPE Rule on the basis of MPE Policy Id and MPE Rule Id.

put

https://localhost:8501/lr-admin-api/mpepolicies/{mpePolicyId}/mperules/{mpeRuleId}

* Update the properties of an MPE rule based on the MPE Policy Id and MPE Rule Id provided by the user.

* Override Data Management Settings is enabled then def message archive mode can not be set to defalut.

* MPERuleId provided in path parameter will considered for update operation.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

mpePolicyId

integer

required

The id of a specific MPE policy.

mpeRuleId

integer

required

-2147483647 to 2147483647

The MPE Rule Id stored in the database.

Body Params

The properites of the MPE Rule including all the required parameters, associated to a specific MPE policy.

mpeRuleID

integer

-2147483648 to 2147483647

The Object Id generated by LogRhythm. Required for PUT operations (updates).

enabled

boolean

Individual MPE Rule is enabled or not.

overrideDataManagementSettings

boolean

Override logsource log data management settings.

defMsgArchiveMode

string

enum

Allowed:

dropLog

boolean

Drop log enabled or not

dropRaw

boolean

Drop raw enabled or not.

noAHC

boolean

Disable automatic host contextualization.

riskRating

integer

enum

Defaults to 0

* 0 - No Rating
* 1 - Low-Low
* 2 - Low-Medium
* 3 - Low-High
* 4 - Medium-Low
* 5 - Medium-Medium
* 6 - Medium-High
* 7 - High-Low
* 8 - High-Medium
* 9 - High-High

forwardedAsEvent

boolean

Is event.

logMartRecord

object

Responses

200Returns all the properties of an MPE rule based on the MPE Policy Id and MPE Rule Id

403A User without the correct permissions tried to update the MPE rule associated to specified MPE policy Id.

404If no MPE Policy or MPE Rule found, error message will be returned.