---
title: "Get Detection"
method: GET
path: "/connect/detection/{id}"
tags: ["Detections"]
---

# Get Detection

`GET /connect/detection/{id}`

Retrieves a specific detection given an internal detection ID. This ID is unique only to this particular grid.
Use the "Query Data" API to search for detections using other criteria, specifying a query parameter that includes the following, at a minimum: _index:"*:so-detection"

## Path parameters

- `id` string, required

## Response `200`

The detection was successfully retrieved

- ModelDetection
  - `aiSummary` string — The detection summary generated by artificial intelligence
  - `aiSummaryReviewed` boolean — Reserved for future use
  - `author` string — The original author of this detection. This can be a mixture of email address, organization name, first name, or any freeform value
  - `category` string — Used for categorizing this detection into a broader grouping such as firewalls or web servers
  - `content` string — The underlying detection rule source content
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — Brief explanation of this detection
  - `engine` string — The engine that processes this detection
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `isCommunity` boolean — Indicates whether this detection originated from a community ruleset. Duplicated detections will show 'false'.
  - `isEnabled` boolean — Indicates whether this detection is currently enabled in the Security Onion grid
  - `isReporting` boolean — Indicates whether this detection is currently triggering alerts. Not yet fully implemented.
  - `isSummaryStale` boolean — Indicates whether this detection's AI summary is current (true) or if the detection source has changed but the generated summary has not yet been updated to reflect the change"
  - `kind` string — The kind of object. This is a read-only field.
  - `language` 'sigma' | 'suricata' | 'yara' — The language that this detection uses.
  - `license` string — The license that applies to this detection
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `overrides` ModelOverride[] — A list of tuning overrides that apply to this detection.
    - `count` integer — (suricata only) For treshold overrides, this is the number of occurrences allowed, within the given seconds interval, before this detection triggers an alert. Must be non-negative and greater than 0.
    - `createdAt` string — The date and time when this override was created
    - `customFilter` string — (elastalert only) The custom filter applied to Sigma detections before the detection will trigger an alert.
    - `ip` string — (suricata only) The IP address or network value, must be in CIDR format: x.x.x.x/y
    - `isEnabled` boolean — Indicates whether this override is enabled
    - `note` string — An optional operational note for this override
    - `regex` string — (suricata only) Regular expression for matching modify overrides
    - `seconds` integer — (suricata only) For treshold overrides, this is the number of seconds that the occurrence threshold must occur within. Must be non-negative and greater than 0.
    - `thresholdType` 'threshold' | 'limit' | 'both' — (suricata only) Threshold type, for threshold overrides
    - `track` 'by_src' | 'by_dst' | 'by_either' — (suricata only) Track type for suppress and threshold overrides (by_either only applies to suppress overrides)
    - `type` 'customFilter' | 'modify' | 'suppress' | 'threshold' — The type of override; available values vary between detection engines
    - `updatedAt` string — The date and time when this override was last modified
    - `value` string — (suricata only) The value needing to match the regex in order for this override to apply
  - `product` string — Used by Sigma rules for filtering log outputs to a specific product, such as the Windows eventlog types
  - `publicId` string — The public ID shared across all Security Onion grids
  - `ruleset` string — The name of the ruleset from which this detection originated, or __custom__ if the ruleset was created outside of a ruleset
  - `service` string — Used by Sigma rules for filtering a subset of log ouputs to a specific server.
  - `severity` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' — The severity classification of this detection
  - `sourceCreated` string — The date and time when the underlying detection rule source was created. This is not when the detection was added to this grid.
  - `sourceUpdated` string — The date and time when the underlying detection rule source was last updated. This is not when the detection was updated in this grid.
  - `tags` string[] — An optional list of user-defined tags, useful for grouping similar detections together
  - `title` string — Summarized title of the detection
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `404` — Detection not found
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)