---
title: "Get Signal"
method: GET
path: "/v1/signals/{id}"
tags: ["Signals"]
---

# Get Signal

`GET /v1/signals/{id}`

Shows details of a single Signal belonging to the account associated with your API credentials.

Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.
A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.

## Path parameters

- `id` integer, required

## Response `200`

Get Signal

- object
  - `signal` Signal — Signal model
    - `id` integer — A unique identifier for the signal.
    - `created_at` string, date-time — ISO-8601 formatted timestamp for when this signal was created.
    - `details` object — Additional details attached to this signal. These details differ based on the signal type and contain information about where the signal originated.
    - `entity` object — Additional details about the entity from which the signal originated. This will always contain an ID, Type and Name.
    - `investigated_at` string — ISO-8601 formatted timestamp for when this signal was investigated.
    - `investigation_context` string — Represents categories attached to the signal by a SOC analyst which give extra insight on the investigation.
    - `name` string — The name of the signal.
    - `organization` object — Contains information about the organization this signal came from. Includes the organization ID and name.
    - `status` string — The status of the signal. Can be one of: `reported`, `closed`
    - `type` string — The type of the signal. Can be one of: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this signal was last updated.

## Other responses

- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)