Interface RuleConfig

Schema name of the registered folder (in this catalog) that a new rule is placed in when the request does not specify a schema. Must name a schema registered as a folder. Omit to clear. Reads return the value as supplied; the folder's current schema name is reported in effective_default_folder.

Default schedule for rules that don't specify one.

Default duration string for signal deduplication when a rule doesn't override it — compact day/hour/minute/second components, e.g. 5d, 1h. Reads return the value as supplied; there is no server default, so it is unset until set. An empty value clears it.

Available detection categories a rule can be tagged with. Reads return the value as supplied. When empty, rules can be tagged with the default categories: Static Signature, Fuzzy Signature, Behavioral, Statistical, and Learning (AI/ML). The categories in effect are reported in effective_detection_categories.

The current schema name of the default_folder folder. Tracks UC schema renames. Unset when no default is configured, or when the folder's schema no longer exists or is not visible to the caller.

The detection categories in effect: detection_categories when set, otherwise the default categories.

Opaque entity tag for optimistic concurrency. Returned on every read; pass it back as the Update request's etag to make the update conditional on the resource being unchanged.

Monotonic version, bumped on each update. Informational; use etag for optimistic concurrency.