UpdateRule (V1) parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine V1 API (UpdateRule) to the modern Chronicle API (UpdateRule).

Protocol and mapping overview

Feature Legacy API (UpdateRule V1) Modern Chronicle API (UpdateRule)
HTTP method PATCH PATCH
Permissions Partner token or legacy API keys chronicle.googleapis.com/rules.update

Request payload field-by-field parity

The modern request scopes updates using canonical Google Cloud resource paths and applies FieldMask verification.

Legacy field (UpdateRuleRequest / Rule) Modern field (UpdateRuleRequest / Rule) Field type Parity and migration notes
rule.rule_id rule.name (in HTTP path) string Google Cloud scoping / resource unification: Legacy identified the target rule using rule_id. In the modern API, this is specified using the canonical rule resource name under rule.name: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id} (Revision tags must be omitted from name paths during updates).
rule.rule rule.text string Renamed: The YARA-L rule content for the new revision. Rename from rule to text in JSON.
rule.etag rule.etag string Direct map: Concurrency control token used in updates. If provided, the request succeeds only if it matches the server-computed value.
update_mask update_mask FieldMask Direct map / renaming: Standard FieldMask selecting updated fields. In JSON, serialize to updateMask and include text to push code changes.
rule.version_id / timestamps — — Ignored / output-only: Identifiers and timestamps are generated by the server.
rule.rule_name / author / metadata — — Ignored / output-only: Display name, author, and custom metadata map keys are extracted automatically from the YARA-L text block.
compilation_state / compilation_error — — Ignored / output-only: Populated post-compilation by the backend system.
alerting_enabled / live_rule_enabled — — Decoupled: Alert state and continuous evaluation are decoupled from the rule definition and managed under the RuleDeployment resource.

Response payload field-by-field parity

Both responses return the updated Rule representation, with the modern API enriching return structures with compilation diagnostics and parsed metadata.

Legacy field (Rule response V1) Modern field (Rule response) Field type Parity and migration notes
rule_id name string Consolidated: Legacy separate identifier strings are unified into the canonical Google Cloud resource path: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}.
rule text string Renamed: The YARA-L rule content. Rename to text in JSON.
etag etag string Direct map: Concurrency control token used in updates.
— revision_id string New field: Represents the unique version checksum string.
— display_name string New field: The user-specified title display name of the rule.
— author string New field: Author name metadata extracted from YARA-L comments.
— metadata map<string, string> New field: Structured user-defined YARA-L metadata headers.
— create_time Timestamp New field: Timestamp of when the rule was originally created.
— revision_create_time Timestamp New field: Timestamp when the rule revision was written.
— compilation_state / compilation_diagnostics enum / repeated Message New fields: Detailed compilation status and parse diagnostic warnings.
— type enum RuleType New field: Infers rule type (SINGLE_EVENT versus MULTI_EVENT).
— reference_lists repeated string New field: Extracted list of resource names for Reference Lists referenced in the Yara-L rule.
— allowed_run_frequencies repeated RunFrequency New field: Execution frequencies allowed for the rule based on Yara-L complexity (for example, LIVE, HOURLY, DAILY).
— scope string New field: Data RBAC scope resource name associated with the rule.
— near_real_time_live_rule_eligible bool New field: Flag indicating whether the rule is eligible for near-real-time streaming detection.
— data_tables repeated string New field: Resource names of Data Tables referenced by this rule.
— has_nonexistence_checks bool New field: Flag indicating whether the rule implements non-existence checks.

Key differences

  • Google Cloud project scoping integration:
    • Scoped natively under parent project instance folder bindings (projects/{project}/locations/{location}/instances/{instance}).
  • YARA-L field renaming:
    • The rule content parameter is renamed from rule in V1 to text in the modern Chronicle API.
  • Compilation reporting and syntax resolution:
    • Modern APIs automatically run compilation validations and expose rich warning objects (compilation_diagnostics), while resolving YARA-L references to Reference Lists and Data Tables.
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission validation check (chronicle.googleapis.com/rules.update).