---
title: "Create Detection"
method: POST
path: "/connect/detection/"
tags: ["Detections"]
---

# Create Detection

`POST /connect/detection/`

Creates a new detection by providing the detection object as the request body, in JSON format.
Detections marked as community detections cannot be created with this API.
While the public ID is required for some engines, the internal ID will always be populated by the server.

## Request body

- ModelDetection
  - `aiSummary` string — The detection summary generated by artificial intelligence
  - `aiSummaryReviewed` boolean — Reserved for future use
  - `author` string — The original author of this detection. This can be a mixture of email address, organization name, first name, or any freeform value
  - `category` string — Used for categorizing this detection into a broader grouping such as firewalls or web servers
  - `content` string — The underlying detection rule source content
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — Brief explanation of this detection
  - `engine` string — The engine that processes this detection
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `isCommunity` boolean — Indicates whether this detection originated from a community ruleset. Duplicated detections will show 'false'.
  - `isEnabled` boolean — Indicates whether this detection is currently enabled in the Security Onion grid
  - `isReporting` boolean — Indicates whether this detection is currently triggering alerts. Not yet fully implemented.
  - `isSummaryStale` boolean — Indicates whether this detection's AI summary is current (true) or if the detection source has changed but the generated summary has not yet been updated to reflect the change"
  - `kind` string — The kind of object. This is a read-only field.
  - `language` 'sigma' | 'suricata' | 'yara' — The language that this detection uses.
  - `license` string — The license that applies to this detection
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `overrides` ModelOverride[] — A list of tuning overrides that apply to this detection.
    - `count` integer — (suricata only) For treshold overrides, this is the number of occurrences allowed, within the given seconds interval, before this detection triggers an alert. Must be non-negative and greater than 0.
    - `createdAt` string — The date and time when this override was created
    - `customFilter` string — (elastalert only) The custom filter applied to Sigma detections before the detection will trigger an alert.
    - `ip` string — (suricata only) The IP address or network value, must be in CIDR format: x.x.x.x/y
    - `isEnabled` boolean — Indicates whether this override is enabled
    - `note` string — An optional operational note for this override
    - `regex` string — (suricata only) Regular expression for matching modify overrides
    - `seconds` integer — (suricata only) For treshold overrides, this is the number of seconds that the occurrence threshold must occur within. Must be non-negative and greater than 0.
    - `thresholdType` 'threshold' | 'limit' | 'both' — (suricata only) Threshold type, for threshold overrides
    - `track` 'by_src' | 'by_dst' | 'by_either' — (suricata only) Track type for suppress and threshold overrides (by_either only applies to suppress overrides)
    - `type` 'customFilter' | 'modify' | 'suppress' | 'threshold' — The type of override; available values vary between detection engines
    - `updatedAt` string — The date and time when this override was last modified
    - `value` string — (suricata only) The value needing to match the regex in order for this override to apply
  - `product` string — Used by Sigma rules for filtering log outputs to a specific product, such as the Windows eventlog types
  - `publicId` string — The public ID shared across all Security Onion grids
  - `ruleset` string — The name of the ruleset from which this detection originated, or __custom__ if the ruleset was created outside of a ruleset
  - `service` string — Used by Sigma rules for filtering a subset of log ouputs to a specific server.
  - `severity` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' — The severity classification of this detection
  - `sourceCreated` string — The date and time when the underlying detection rule source was created. This is not when the detection was added to this grid.
  - `sourceUpdated` string — The date and time when the underlying detection rule source was last updated. This is not when the detection was updated in this grid.
  - `tags` string[] — An optional list of user-defined tags, useful for grouping similar detections together
  - `title` string — Summarized title of the detection
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Response `200`

Returns the detection that was successfully created

- ModelDetection
  - `aiSummary` string — The detection summary generated by artificial intelligence
  - `aiSummaryReviewed` boolean — Reserved for future use
  - `author` string — The original author of this detection. This can be a mixture of email address, organization name, first name, or any freeform value
  - `category` string — Used for categorizing this detection into a broader grouping such as firewalls or web servers
  - `content` string — The underlying detection rule source content
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string — Brief explanation of this detection
  - `engine` string — The engine that processes this detection
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `isCommunity` boolean — Indicates whether this detection originated from a community ruleset. Duplicated detections will show 'false'.
  - `isEnabled` boolean — Indicates whether this detection is currently enabled in the Security Onion grid
  - `isReporting` boolean — Indicates whether this detection is currently triggering alerts. Not yet fully implemented.
  - `isSummaryStale` boolean — Indicates whether this detection's AI summary is current (true) or if the detection source has changed but the generated summary has not yet been updated to reflect the change"
  - `kind` string — The kind of object. This is a read-only field.
  - `language` 'sigma' | 'suricata' | 'yara' — The language that this detection uses.
  - `license` string — The license that applies to this detection
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `overrides` ModelOverride[] — A list of tuning overrides that apply to this detection.
    - `count` integer — (suricata only) For treshold overrides, this is the number of occurrences allowed, within the given seconds interval, before this detection triggers an alert. Must be non-negative and greater than 0.
    - `createdAt` string — The date and time when this override was created
    - `customFilter` string — (elastalert only) The custom filter applied to Sigma detections before the detection will trigger an alert.
    - `ip` string — (suricata only) The IP address or network value, must be in CIDR format: x.x.x.x/y
    - `isEnabled` boolean — Indicates whether this override is enabled
    - `note` string — An optional operational note for this override
    - `regex` string — (suricata only) Regular expression for matching modify overrides
    - `seconds` integer — (suricata only) For treshold overrides, this is the number of seconds that the occurrence threshold must occur within. Must be non-negative and greater than 0.
    - `thresholdType` 'threshold' | 'limit' | 'both' — (suricata only) Threshold type, for threshold overrides
    - `track` 'by_src' | 'by_dst' | 'by_either' — (suricata only) Track type for suppress and threshold overrides (by_either only applies to suppress overrides)
    - `type` 'customFilter' | 'modify' | 'suppress' | 'threshold' — The type of override; available values vary between detection engines
    - `updatedAt` string — The date and time when this override was last modified
    - `value` string — (suricata only) The value needing to match the regex in order for this override to apply
  - `product` string — Used by Sigma rules for filtering log outputs to a specific product, such as the Windows eventlog types
  - `publicId` string — The public ID shared across all Security Onion grids
  - `ruleset` string — The name of the ruleset from which this detection originated, or __custom__ if the ruleset was created outside of a ruleset
  - `service` string — Used by Sigma rules for filtering a subset of log ouputs to a specific server.
  - `severity` 'unknown' | 'informational' | 'low' | 'medium' | 'high' | 'critical' — The severity classification of this detection
  - `sourceCreated` string — The date and time when the underlying detection rule source was created. This is not when the detection was added to this grid.
  - `sourceUpdated` string — The date and time when the underlying detection rule source was last updated. This is not when the detection was updated in this grid.
  - `tags` string[] — An optional list of user-defined tags, useful for grouping similar detections together
  - `title` string — Summarized title of the detection
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `205` — Returns the detection that was successfully created and the status has been modified by a filter
- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `409` — Public ID conflicts with existing detection
- `423` — Rule synchronization is currently blocked
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)