What this endpoint does

This operation updates a specific Sigma rule within a completed Auto Sigma job, allowing analysts to classify the rule's detection quality or modify its YAML content. After reviewing rules generated by the Create Auto Sigma Job endpoint, use this endpoint to set each rule's classification status — such as "True Positive" for confirmed detections, "False Positive" for incorrect matches, "Needs Tuning" for rules requiring refinement, or "Benign Behavior" and "No Root Cause" for non-malicious patterns. You can also provide updated rule_yaml to refine the Sigma rule logic. Retrieve the job's rules and their IDs via the Get Sigma Job endpoint before calling this operation.

Response data

The response is a boolean value indicating whether the rule was successfully updated. A value of true confirms the update was applied. To verify the change, retrieve the job again via the Get Sigma Job endpoint and inspect the updated rule's status and rule fields in the sigma_rules array.