API endpoint and method for deleting unwanted HX conditions

We have several conditions to delete however the “delete” HTTP method is not allowed when specifying either the _id or UUID.


We already have the ability to disable a condition which results in a FP condition, but that’s not what we want in this case. Looking for eradication.

The issue is that some conditions for urlMonitorEvent/requestUrl token type were set to ‘equal’ and it should have been ‘contains’. A subsequent set of conditions with ‘contains’ were created but the original set of ‘equal’ conditions remains and needs to go.

Thank you,
BW

Hello, Bryon!
Although you cannot delete conditions, you can detach them from indicators. This may give you what you are looking for.
To detach conditions from indicators you can obtain a list of all indicators that use the condition using:

GET https://<IP_address>:<port_number>/hx/api/v3/conditions/<condition_id>/indicators

Then, for each indicator, detach the condition using:

DELETE https://<IP_address>:<port_number>/hx/api/v3/indicators///conditions//

Thanks for your reply Keith,
My next step after not being able to delete was to detach like you exampled. However I was getting server error replies and ended up just manually detaching the 45 conditions in the webUI. Hopefully I don’t need to do it again, but I’ll try detach via API again next time and send in some better info.

I’d prefer to not just have the conditions floating around in the ether, but its probably not causing an issue. If I accidentally added 45k bad conditions we would probably need to find another way.