# The RuleConfig object

Per-catalog rule-related config. Singleton.
 Name format: `catalogs/{catalog}/ruleConfig`.

## Attributes

- `name` (string, Beta, ID, Immutable)
- `version` (int64, Beta, Output only)
  Monotonic version, bumped on each update. Informational; use `etag` for
   optimistic concurrency.
- `update_time` (string, Beta, Output only)
- `updated_by` (object, Beta, Output only)
  - `id` (string, Beta)
    User / service-principal ID.
  - `principal_type` (string, Beta)
    Whether this principal is a regular user, service principal, or system principal.
    Possible values:
    - `REGULAR_USER`
    - `SERVICE_PRINCIPAL`
    - `SYSTEM_USER`
  - `email` (string, Beta)
    Email (regular users only).
  - `display_name` (string, Beta)
    Display name (user or SP name).
- `etag` (string, Beta, Output only)
  Opaque entity tag for optimistic concurrency. Returned on every read;
   pass it back as the Update request's `etag` to make the update
   conditional on the resource being unchanged.
- `default_schedule` (object, Beta)
  Default schedule for rules that don't specify one.
  - `at_least_every` (string, Beta)
    Defines the minimum cadence as a duration string. It may contain components
     for days, hours, minutes, and seconds (e.g. `5d`, `5d3h`, `3d2h5m12s`,
     `12m16s`).
  - `cron_expression` (string, Beta)
    Defines the schedule using a Quartz cron expression.
  - `continuous` (boolean, Beta)
    Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and
     streaming rules run continuously without it.
  - `enabled` (boolean, Beta)
    Sets whether the job is scheduled to run. Defaults to true.
- `detection_categories` (array of string, Beta)
  Available detection categories a rule can be tagged with. Reads return the
   value as supplied. When empty, rules can be tagged with the default categories:
   `Static Signature`, `Fuzzy Signature`, `Behavioral`, `Statistical`, and
   `Learning (AI/ML)`. The categories in effect are reported in
   `effective_detection_categories`.
- `default_signal_collation_window` (string, Beta)
  Default duration string for signal deduplication when a rule
   doesn't override it — compact day/hour/minute/second components, e.g.
   `5d`, `1h`. Reads return the value as supplied; there is no server default,
   so it is unset until set. An empty value clears it.
- `default_folder` (string, Beta)
  Schema name of the registered folder (in this catalog) that a new rule is
   placed in when the request does not specify a schema. Must name a schema
   registered as a folder. Omit to clear. Reads return the value as supplied; the
   folder's current schema name is reported in `effective_default_folder`.
- `effective_detection_categories` (array of string, Beta, Output only)
  The detection categories in effect: `detection_categories` when set,
   otherwise the default categories.
- `effective_default_folder` (string, Beta, Output only)
  The current schema name of the `default_folder` folder. Tracks UC schema
   renames. Unset when no default is configured, or when the folder's schema no
   longer exists or is not visible to the caller.

## Example

```json
{
  "name": "string",
  "version": 0,
  "update_time": "string",
  "updated_by": {
    "id": "string",
    "principal_type": "REGULAR_USER",
    "email": "string",
    "display_name": "string"
  },
  "etag": "string",
  "default_schedule": {
    "at_least_every": "string",
    "cron_expression": "string",
    "continuous": true,
    "enabled": true
  },
  "detection_categories": [
    "string"
  ],
  "default_signal_collation_window": "string",
  "default_folder": "string",
  "effective_detection_categories": [
    "string"
  ],
  "effective_default_folder": "string"
}
```