Rules - Efflux

What a rule does

A rule tags scan and URL results. It does not block, delete, or notify by itself. When a result matches, the rule's tags are applied. Create returns 201.

POST/v3/rules

Create a rule

API reference

Request fields

Field	Notes
`rule_name`	Name shown on the rule
`description`	Optional
`queries`	One or more match queries. Every field inside a query must match
`run_all_queries`	When `true`, every query can match and apply its tags. When `false`, the first matching query wins
`tags`	Tags applied when the rule matches

Each query can set fields, headers, cookies, and its own tags (applied when that query is the one that matched).

A field value uses exactly one operator: eq, contains, lazy, lazy_contains, in, or regex.

Header conditions use name and val (same operators), or any_val to require only that the header name exists. Do not combine any_name with any_val.

curl -sS -X POST "https://api.efflux.io/v3/rules" \
  -H "Authorization: Bearer $EFFLUX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "rule_name": "Open SSH",
    "description": "Tag hosts serving SSH",
    "run_all_queries": false,
    "tags": ["ssh"],
    "queries": [
      {
        "fields": {
          "port": { "eq": "22" },
          "service": { "contains": "ssh" }
        }
      }
    ]
  }'