Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Detections API

List all detection rules

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_find</span></div>

Refer to Spaces for more information.

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.

get/api/detection_engine/rules/_find

Query parameters

fieldsstring[]

List of alert.attributes field names to return for each rule (for example name, enabled). If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or use comma-separated values when supported by your client.

filterstring

Search query

Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:

  • name
  • enabled
  • tags
  • createdBy
  • interval
  • updatedBy

info Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.

sort_field'created_at' | 'createdAt' | 'enabled' | 'execution_summary.last_execution.date' | 'execution_summary.last_execution.metrics.execution_gap_duration_s' | 'execution_summary.last_execution.metrics.total_indexing_duration_ms' | 'execution_summary.last_execution.metrics.total_search_duration_ms' | 'execution_summary.last_execution.status' | 'name' | 'risk_score' | 'riskScore' | 'severity' | 'updated_at' | 'updatedAt'

Field to sort by

sort_order'asc' | 'desc'

Sort order

pageinteger

Page number

per_pageinteger

Rules per page

gaps_range_startstring

Gaps range start

gaps_range_endstring

Gaps range end

gap_fill_statusesSecurityDetectionsAPIGapFillStatus[]

Gap fill statuses

gap_auto_fill_scheduler_idstring

Gap auto fill scheduler ID used to determine gap fill status for rules

Response

Successful response

info These fields are under development and their usage or schema may change: execution_summary.

pageinteger required
perPageinteger required
totalinteger required