Use this endpoint to update an existing Hunting Ruleset object attributes as follows:

{
  "data": {
    "type": "hunting_ruleset",
    "id": "{id}",
    "attributes": {
      "enabled": true,
      "limit": 10,
      "name": "bar",
      "notification_emails": ["notifications@acme.com"],
      "rules": "rule foo {condition: false}"
    }
  }
}

It returns the updated Hunting Ruleset object.

🚧
Automatically add Hunting rulesets matches to an IoC Collection
Note that Hunting rulesets can be associated with IoC Collections. To automatically add IoCs matching your Hunting ruleset to an IoC Collection, apart from creating the association between the two objects (add Hunting rulesets associations,add IoC Collection associations), you have to enable the associated_collections_feed_enabled parameter of the ruleset as in the first example.

Examples

Update the associated_collections_feed_enabled parameter of the 20899097850 Hunting ruleset to automatically add its matches to associated IoC Collections.

import requests

payload = {
    "data":
    {
      "type": "hunting_ruleset",
      "id": "20899097850",
      "attributes": {
      "associated_collections_feed_enabled": True
    }
  }
}
id = "20899097850"
url = f"https://www.virustotal.com/api/v3/intelligence/hunting_rulesets/{id}"
headers = {
    "accept": "application/json","x-apikey": <api-key>,"content-type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)

200200

400400