Skip to main content

​
Command overview

beacon rules remove removes one installed threat-detection rule from the local store by rule id.
Command syntax
Use beacon rules list first when you need to confirm the active rule ids. Built-in baseline rules are not in the store and cannot be removed. When the removed store rule shares its id with a baseline rule, the baseline copy becomes active again and the command says so.

​
Examples

Remove one rule from the user-mode store:
Remove a rule
Remove one rule from the system-mode store:
Remove a system-mode rule

​
Flags

beacon rules list

List active rules and rule ids.

beacon rules add

Install local rules into the store.