Delete Rule Created By Mistake

[jpvonhemel]

Hello,

I have looked through the UI for a place that patrol rules are kept and that allows deletion, but I am not find this, or a way to delete rules that I created by mistake. I am on 6.4.5. Would some one mind helping me with how to delete a rule?

Thank you very much!

[pulse-triage[bot]]

In 6.4.5, Create rule can add permanent suppression rules but has no list/delete control in the UI. Reopen only undoes an individual finding’s dismissal, so it does not remove a separately created rule. Did you use Create rule on a finding, or a different control?

How Pulse handles triage

[jpvonhemel]

I created it when presented with a finding. I chose "add a rule" for this alert, from the dropdown, or something with wording like this. It was at the very bottom of the dropdown menu.

…

On Mon, Oct 5, 2026 at 10:24 AM pulse-triage[bot] ***@***.***> wrote: In 6.4.5, Create rule can add permanent suppression rules but has no list/delete control in the UI. Reopen only undoes an individual finding’s dismissal, so it does not remove a separately created rule. Did you use Create rule on a finding, or a different control? How Pulse handles triage <https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md> — Reply to this email directly, view it on GitHub <#2523?email_source=notifications&email_token=AE7YEA37PPC4EGDDUDOWMTL5SPDNXA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBXGYZDINZWUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-18762476>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE7YEA2IB2MU5X5O4CSCPM35SPDNXAVCNFSNUABIKJSXA33TNF2G64TZHM4TGMRYGI2TKMRUHNCGS43DOVZXG2LPNY5TCMBZGU2TGMBRUF3AE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[pulse-triage[bot]]

Use the snippet below in v6.4.5 to remove only the manually created rule you select; other rules and finding history remain, and future matching findings may appear again. Review it first, then run it in the developer console of your signed-in administrator Pulse tab with the correct organisation selected, without switching organisation or copying credentials; Cancel changes nothing, and keep the rule list private. If a request fails, stop and check the selected ID at /api/ai/patrol/suppressions in that same signed-in tab before trying again, because a lost response does not prove deletion failed.

One-rule removal snippet

(async () => {
  const cookie = (name) => {
    const row = document.cookie.split(';').find((part) => part.trim().startsWith(`${name}=`));
    return row ? decodeURIComponent(row.trim().slice(name.length + 1)) : '';
  };
  const org = cookie('pulse_org_id') || 'default';
  const headers = {
    Accept: 'application/json',
    'X-Requested-With': 'XMLHttpRequest',
    'X-Pulse-Org-ID': org,
  };
  const readRules = async () => {
    if ((cookie('pulse_org_id') || 'default') !== org) throw new Error('Organisation changed; stop.');
    const response = await fetch('/api/ai/patrol/suppressions', {
      credentials: 'same-origin', redirect: 'error', cache: 'no-store', headers,
    });
    if (!response.ok) throw new Error(`Rule list failed (HTTP ${response.status}); stop.`);
    const rules = await response.json();
    if (!Array.isArray(rules)) throw new Error('Unexpected rule list; stop.');
    return rules.filter((rule) => rule && rule.created_from === 'manual');
  };
  const rules = await readRules();
  console.table(rules.map((rule) => ({
    id: rule.id, resource: rule.resource_name || rule.resource_id || 'Any resource',
    category: rule.category || 'Any category', reason: rule.description,
  })));
  const id = prompt('Enter one exact rule ID from this list, or Cancel to keep all rules.');
  if (id === null || !id.trim()) return;
  const matches = rules.filter((rule) => typeof rule.id === 'string' && rule.id === id.trim());
  if (matches.length !== 1) throw new Error('ID must match exactly one listed manual rule; stop.');
  const rule = matches[0];
  if (!confirm(`Delete only ${rule.id}?\nResource: ${rule.resource_name || rule.resource_id || 'Any resource'}\nCategory: ${rule.category || 'Any category'}\nReason: ${rule.description}\nFuture matching findings may appear again.`)) return;
  if ((cookie('pulse_org_id') || 'default') !== org) throw new Error('Organisation changed; stop.');
  const csrf = cookie('pulse_csrf');
  if (!csrf) throw new Error('No browser CSRF token; stop and sign in normally, without pasting tokens.');
  const response = await fetch(`/api/ai/patrol/suppressions/${encodeURIComponent(rule.id)}`, {
    method: 'DELETE', credentials: 'same-origin', redirect: 'error',
    headers: { ...headers, 'X-CSRF-Token': csrf },
  });
  if (!response.ok) throw new Error(`Deletion not confirmed (HTTP ${response.status}); stop.`);
  if ((await readRules()).some((remaining) => remaining.id === rule.id)) {
    throw new Error('Rule is still listed; removal was not verified.');
  }
  console.info('Selected rule is no longer listed. Other rules were not deleted.');
})().catch((error) => console.error(error.message));

How Pulse handles triage

[jpvonhemel]

thank you. that did the trick!

[pulse-triage[bot]]

Published v6.6.0-rc.4 includes rule-removal controls: select the correct organisation, then open Patrol → Activity → Suppression rules and check the Rule ID and scope before Remove rule. This is a preview (Docker: rcourtman/pulse:6.6.0-rc.4), not stable v6.5.0; removing a rule allows future findings without reopening dismissed findings or deleting history. If you already have a rule to remove on that preview, does this avoid the console?

How Pulse handles triage