# Rerun Detection

Re-analyses the detection results of the given simulation run against SIEM/EDR integrations. The rerun is asynchronous: a successful response means the re-analysis has started, and its outcome is observable through GET /v1/simulations/{Id}/run/{RunId}. integrations is required and must list at least one integration id — there is no default-to-all. Every listed integration must be eligible for rerun: configured, currently healthy, and reachable through a live connected agent. Any ineligible integration rejects the whole rerun, since a rerun against an unreachable integration yields no usable analysis. When update_assessment is true, the simulation is also updated so future runs inherit the given integrations.

Error codes: 1149 the run cannot be re-analysed (not finished yet, analysis in progress, quick-threat run or no completed prevention result), 1109 run not found, 1108 simulation not found, 1111 no licensed integration device available. A 422 is returned when integrations is missing or empty. A 400 with no error code is returned when a requested integration is not eligible (unknown, not configured, unhealthy, or its connected agent is not alive). A 423 response means another operation holds the account lock; retry after it completes.