{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Updates a Priority Intelligence Requirement for the authenticated account. Changing the query increments its version; editing the requirement without saving a query marks the query stale. Activating a draft needs a free slot in the active PIR quota; setting `active` on a PIR the matcher paused resumes it without one.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","minLength":1},"priority_id":{"type":"string","format":"uuid"}},"required":["account_id","priority_id"],"additionalProperties":false},"body":{"type":"object","properties":{"confirm_query":{"description":"Write-only. `true` confirms the query still fits the requirement, clearing `query_stale` without changing the query or its version. Requires a query.","type":"boolean"},"dataset_scope":{"description":"`default`: every event dataset the account can read: Cloudforce One intelligence, datasets shared with the account, and the account's own datasets, such as Threat Signals. `datasets`: explicit dataset IDs. Analytics datasets are not matched. An active PIR can cover at most 50 datasets. Access is rechecked whenever the PIR is matched.","oneOf":[{"additionalProperties":false,"properties":{"type":{"type":"string","enum":["default"]}},"required":["type"],"type":"object"},{"additionalProperties":false,"properties":{"dataset_ids":{"type":"array","items":{"format":"uuid","type":"string"},"maxItems":50,"minItems":1},"type":{"type":"string","enum":["datasets"]}},"required":["type","dataset_ids"],"type":"object"}]},"digest_interval_hours":{"description":"Hours between digests: 6, 12, or 24. Used only when `notification_mode` is `digest`.","type":"integer","enum":[6,12,24]},"intent":{"type":["object","null"],"additionalProperties":false,"properties":{"clauses":{"type":"array","items":{"additionalProperties":false,"properties":{"actors":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"attacker_countries":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"categories":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"cves":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"keywords":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":5},"target_countries":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"target_industries":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"techniques":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20}},"required":["actors","attacker_countries","target_countries","target_industries","categories","techniques","cves","keywords"],"type":"object"},"maxItems":8,"minItems":1},"indicators":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"unsupported_terms":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20}},"required":["clauses","indicators","unsupported_terms"]},"labels":{"type":"array","items":{"maxLength":100,"type":"string"},"maxItems":50},"model":{"type":["string","null"],"maxLength":200,"minLength":1},"notification_mode":{"description":"`none` or `digest`. Notifications are opt-in. `immediate` is reserved and currently rejected.","type":"string","enum":["none","immediate","digest"]},"priority":{"type":"integer","minimum":0},"query":{"additionalProperties":false,"properties":{"branches":{"description":"Event List `searchBranches`: filters within a branch are ANDed, branches are ORed.","type":"array","items":{"items":{"anyOf":[{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","find"]},"value":{"type":"string","maxLength":512,"minLength":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"maxLength":512,"minLength":1,"type":"string"},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"}]},"maxItems":10,"minItems":1,"type":"array"},"maxItems":8,"minItems":1},"version":{"description":"Ignored. Accepted so a PIR read from the API can be sent back unchanged.","type":"integer"}},"required":["branches"],"type":["object","null"]},"query_source":{"type":["string","null"],"enum":["generated","edited"]},"requirement":{"type":"string","maxLength":4000,"minLength":1},"status":{"description":"`draft`: not monitored. `active`: monitored, unless `pause_reason` is set. Setting `active` on a PIR with a `pause_reason` resumes it. Moving a PIR back to `draft` and activating it again starts matching afresh with a 30-day backfill.","type":"string","enum":["draft","active"]},"title":{"type":["string","null"],"maxLength":200,"minLength":1},"tlp":{"type":"string"}}}},"required":["path"],"additionalProperties":false},"name":"Update a priority intelligence requirement","id":"cloudflare.put_pirupdate","example":{"path":{"account_id":"example","priority_id":"00000000-0000-4000-8000-000000000000"}},"maxRequests":1,"summary":false}}