# Rerun Detection

Triggers detection analysis for a finished simulation run against the SIEM/EDR integrations you specify, enriching the run with detection results. Works in two modes, chosen automatically:

First analysis — the run has no detection results yet. Picus analyses it and enriches the run with detection results for the given integrations. Re-analysis — the run already has detection results. Picus discards them and analyses the run again against the given integrations.

The attack simulation itself is never re-executed, so prevention results are untouched — only the detection half is computed. Use this when detection was never run for a completed run, or when an integration was down, unlicensed or misconfigured while the run was first analysed.

Requires the write:simulations scope. Rate limited to 50 requests per minute.

Asynchronous: a 200 response means the analysis has started, not that it finished. Poll GET /v1/simulations/{Id}/run/{RunId} to observe the new detection status and scores.

Important — in re-analysis mode the run's existing detection data is replaced: its detection results, previously generated reports and cached run comparison are deleted before the new analysis is written. Export anything you need to keep before calling. First-analysis mode deletes nothing.

integrations is required and must list at least one integration id; there is no default-to-all. Get ids from GET /v1/integrations, and agent liveness from GET /v1/integrations/agents. Every listed integration must be eligible: configured, currently healthy, and reachable through a connected agent whose status is Alive. Any ineligible integration rejects the whole request — an analysis against an unreachable integration yields no usable result, so an eligible subset is never run silently. When update_assessment is true, the parent simulation is also updated so future runs inherit the given integrations.

Errors:

422 — integrations is missing, null or empty, has more than 64 items, or the path ids are invalid.

400 with no error_code — a requested integration is not eligible; the message names each offending integration and the reason (unknown, not configured, unhealthy, or its connected agent is not alive). An integration that is unlicensed, or not on the account, is also rejected here.

400 error_code 1149 — the run cannot be analysed: not finished yet, an analysis is already in progress, it is a quick-threat run, or it has no completed prevention results.

400 error_code 1109 — run not found.

400 error_code 1108 — simulation not found.

400 error_code 1111 — no licensed integration device is available on the account.

423 — another operation holds the account lock; retry after it completes.

{
  "integrations": [
    12,
    34
  ]
}