I am using CURL and pushing a POST message via the API.
I use the API and retrieve the rule id along with the filter id.
I then update the existing rule (add an additional IP to the rule).
I then do a -X PUT using the updated filter.
The result echoed back indicates success: true, the errors and messages are both empty as well. All the ID’s align but the Rule is essentially unchanged except for the “modified_on” value which contains the new timestamp.
However, the result filter.expression does not contain the new IP.