Skip to main content

Rule Config

View as Markdown

Per-catalog rule-related config. Singleton. Name format: catalogs/{catalog}/ruleConfig.

RuleConfig object​

Per-catalog rule-related config. Singleton. Name format: catalogs/{catalog}/ruleConfig.

namestringBetaIDImmutable
versionint64BetaOutput only

Monotonic version, bumped on each update. Informational; use etag for optimistic concurrency.

update_timestringBetaOutput only
updated_byobjectBetaOutput only
Show child attributesHide child attributes
idstringBeta

User / service-principal ID.

principal_typestringBeta

Whether this principal is a regular user, service principal, or system principal.

Values:

  • REGULAR_USER
  • SERVICE_PRINCIPAL
  • SYSTEM_USER
emailstringBeta

Email (regular users only).

display_namestringBeta

Display name (user or SP name).

etagstringBetaOutput only

Opaque entity tag for optimistic concurrency. Returned on every read; pass it back as the Update request's etag to make the update conditional on the resource being unchanged.

default_scheduleobjectBeta

Default schedule for rules that don't specify one.

Show child attributesHide child attributes
at_least_everystringBeta

Defines the minimum cadence as a duration string. It may contain components for days, hours, minutes, and seconds (e.g. 5d, 5d3h, 3d2h5m12s, 12m16s).

cron_expressionstringBeta

Defines the schedule using a Quartz cron expression.

continuousbooleanBeta

Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and streaming rules run continuously without it.

enabledbooleanBeta

Sets whether the job is scheduled to run. Defaults to true.

detection_categoriesarray of stringBeta

Available detection categories a rule can be tagged with. Reads return the value as supplied. When empty, rules can be tagged with the default categories: Static Signature, Fuzzy Signature, Behavioral, Statistical, and Learning (AI/ML). The categories in effect are reported in effective_detection_categories.

default_signal_collation_windowstringBeta

Default duration string for signal deduplication when a rule doesn't override it — compact day/hour/minute/second components, e.g. 5d, 1h. Reads return the value as supplied; there is no server default, so it is unset until set. An empty value clears it.

default_folderstringBeta

Schema name of the registered folder (in this catalog) that a new rule is placed in when the request does not specify a schema. Must name a schema registered as a folder. Omit to clear. Reads return the value as supplied; the folder's current schema name is reported in effective_default_folder.

effective_detection_categoriesarray of stringBetaOutput only

The detection categories in effect: detection_categories when set, otherwise the default categories.

effective_default_folderstringBetaOutput only

The current schema name of the default_folder folder. Tracks UC schema renames. Unset when no default is configured, or when the folder's schema no longer exists or is not visible to the caller.

Get the rule config for a catalog Beta​

GET /api/2.0/lakewatch/{name=catalogs/*/ruleConfig}

Returns the detection-rule configuration for a catalog.

API scopes: lakewatch

Parameters​

namestringRequiredpath

Response​

Returns the RuleConfig object.

Update the rule config for a catalog Beta​

PATCH /api/2.0/lakewatch/{name=catalogs/*/ruleConfig}

Updates the detection-rule configuration for a catalog.

API scopes: lakewatch

Parameters​

namestringRequiredIDImmutablepath
update_maskstringRequiredquery
etagstringquery

Optimistic-concurrency precondition: if set and it does not match the resource's current etag, the update is rejected as a conflict (HTTP 409).

Request body​

default_scheduleobject

Default schedule for rules that don't specify one.

Show child attributesHide child attributes
at_least_everystring

Defines the minimum cadence as a duration string. It may contain components for days, hours, minutes, and seconds (e.g. 5d, 5d3h, 3d2h5m12s, 12m16s).

cron_expressionstring

Defines the schedule using a Quartz cron expression.

continuousboolean

Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and streaming rules run continuously without it.

enabledboolean

Sets whether the job is scheduled to run. Defaults to true.

detection_categoriesarray of string

Available detection categories a rule can be tagged with. Reads return the value as supplied. When empty, rules can be tagged with the default categories: Static Signature, Fuzzy Signature, Behavioral, Statistical, and Learning (AI/ML). The categories in effect are reported in effective_detection_categories.

default_signal_collation_windowstring

Default duration string for signal deduplication when a rule doesn't override it — compact day/hour/minute/second components, e.g. 5d, 1h. Reads return the value as supplied; there is no server default, so it is unset until set. An empty value clears it.

default_folderstring

Schema name of the registered folder (in this catalog) that a new rule is placed in when the request does not specify a schema. Must name a schema registered as a folder. Omit to clear. Reads return the value as supplied; the folder's current schema name is reported in effective_default_folder.

Response​

Returns the RuleConfig object.