[ BUG ] Removing the only firewall rule left within a rule group keeps asking for rule id array about falconpy

[jshcodes]

Hi @GabrielNBJJ -

This bug is confirmed! When provided the necessary payload elements for this operation when there is only one rule in the rule group, the rule_ids keyword is being discarded. This only occurs when rule_ids is an empty list.

Thank you for reporting this issue, we are working on addressing it now. In the interim you can use a raw body payload to accomplish this operation.

from falconpy import FirewallManagement

firewall = FirewallManagement()

payload = {
    "id": "RULE_GROUP_ID",
    "diff_type": "application/json-patch+json",
    "rule_ids": [],
    "rule_versions": [],
    "tracking": "TRACKING ID HERE",
    "diff_operations": [
        {
            "op": "remove",
            "path": "/rules/0"
        }
    ]
}

firewall.update_rule_group(body=payload)