---
title: "Get result of a job"
method: GET
path: "/v1/auto-sigma/jobs/{jobId}"
tags: ["Auto Sigma"]
---

# Get result of a job

`GET /v1/auto-sigma/jobs/{jobId}`

Retrieve a specific Auto Sigma job's status, configuration, and generated detection rules.

## Path parameters

- `jobId` string, required

## Response `200`

Successful Response

- GetSigmaJobResponse — Detailed result of a Sigma rule generation job including status, generated rules, and patterns.
  - `jobId` string, required — A unique identifier for the Sigma job.
  - `name` string, required — The name of the Sigma job.
  - `created` string, date-time, required — The timestamp when the Sigma job was created.
  - `modified` string, date-time, required — The timestamp when the Sigma job was last updated.
  - `status` string, required — The current status of the Sigma job (e.g., "CREATED", "RUNNING", "FINISHED", "FAILED").
  - `query` string, required — The query that was used to find the initial hashes.
  - `startDate` string, date, required — Earliest date to include in the query (cannot be before 2023-11-01)
  - `endDate` string, date, required — Latest date to include in the query, defaults to today in UTC
  - `nMatchedHashes` number, required — Number of hashes matching the query during specified time range
  - `familyCounts` FamilyCounts, required — Statistics over number of matched hashes per malware family
  - `sigma_rules` SigmaRuleItem[], required — The Sigma Rules and associated stats.
    - `rule` string, required — Sigma rule in YAML format
    - `rule_id` string, required — Id of the generated rule
    - `stats` SigmaPatternStats — Statistics about patterns identified during Sigma rule generation.
      - `n_hashes` number, required — Number of hashes matching the pattern
      - `overlap` number, required — Number of hashes matching both pattern and job query
      - `family_counts` FamilyCounts, required — Statistics over number of matched hashes per malware family
    - `status` 'True Positive' | 'False Positive' | 'Benign Behavior' | 'No Root Cause' | 'Needs Tuning' | 'New', required — Selected status of the rule
    - `modified` string, date-time — The timestamp when the rule was last updated. Not present if rule was never updated.
  - `patterns` PatternItem[], required — The generated patterns and associated stats
    - `image` string — Parent image, optionally with wildcard replacement
    - `cmd_pattern` string — Command line, optionally with wildcard replacement
    - `matched_cmds` string[] — List of command lines matching this pattern
    - `stats` SigmaPatternStats — Statistics about patterns identified during Sigma rule generation.
      - `n_hashes` number, required — Number of hashes matching the pattern
      - `overlap` number, required — Number of hashes matching both pattern and job query
      - `family_counts` FamilyCounts, required — Statistics over number of matched hashes per malware family

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Page not found

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)