What this endpoint does

Updates an existing YARA rule's source code and/or renames it. The rule is recompiled and validated server-side on update — a 400 means compilation failed. Identify the rule by its current filename in the path. To rename, set a different name in the request body; future requests must use the new name. Always read the current rule source with Sandbox: Get YARA Rule before updating to avoid overwriting content. Find available rule filenames with Sandbox: List YARA Rules. Include triage_score, description, and triage_description (ending with a period) in the YARA meta: section for best integration with analysis results.

Response data

Returns an empty JSON object {} on success. The updated rule content is not returned — call Sandbox: Get YARA Rule with the (possibly new) filename to confirm the update and check for compilation warnings. The compiler may flag style issues like triage_description not ending with a period — these are warnings, not errors, but addressing them improves how matches display in analysis reports.