v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Detections

Create Detection

Creates a new detection by providing the detection object as the request body, in JSON format. Detections marked as community detections cannot be created with this API. While the public ID is required for some engines, the internal ID will always be populated by the server.

post/connect/detection/

Request body

aiSummarystring

The detection summary generated by artificial intelligence

aiSummaryReviewedboolean

Reserved for future use

authorstring

The original author of this detection. This can be a mixture of email address, organization name, first name, or any freeform value

categorystring

Used for categorizing this detection into a broader grouping such as firewalls or web servers

contentstring

The underlying detection rule source content

createTimestring

The date and time that this object was created. This is a read-only field.

descriptionstring

Brief explanation of this detection

enginestring

The engine that processes this detection

idstring

The ID assigned to this object by the server. This is a read-only field.

isCommunityboolean

Indicates whether this detection originated from a community ruleset. Duplicated detections will show 'false'.

isEnabledboolean

Indicates whether this detection is currently enabled in the Security Onion grid

isReportingboolean

Indicates whether this detection is currently triggering alerts. Not yet fully implemented.

isSummaryStaleboolean

Indicates whether this detection's AI summary is current (true) or if the detection source has changed but the generated summary has not yet been updated to reflect the change"

kindstring

The kind of object. This is a read-only field.

language'sigma' | 'suricata' | 'yara'

The language that this detection uses.

licensestring

The license that applies to this detection

operationstring

The operation that was applied to the object. This is a read-only field.

productstring

Used by Sigma rules for filtering log outputs to a specific product, such as the Windows eventlog types

publicIdstring

The public ID shared across all Security Onion grids

rulesetstring

The name of the ruleset from which this detection originated, or custom if the ruleset was created outside of a ruleset

servicestring

Used by Sigma rules for filtering a subset of log ouputs to a specific server.

The severity classification of this detection

sourceCreatedstring

The date and time when the underlying detection rule source was created. This is not when the detection was added to this grid.

sourceUpdatedstring

The date and time when the underlying detection rule source was last updated. This is not when the detection was updated in this grid.

tagsstring[]

An optional list of user-defined tags, useful for grouping similar detections together

titlestring

Summarized title of the detection

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

Example request

{
  "aiSummary": "This rule detects antivirus alerts reporting the presence of ransomware,...",
  "author": "Security Onion Solutions",
  "category": "ps_script",
  "content": "title: CobaltStrike Named Pipe\nid: ...\n logsource:\n ...\ncondition: selection\nfalsepositives:\n...",
  "createTime": "2024-11-14T15:03:22Z",
  "description": "Detects when a user fails to login to a grid node via SSH. Review associated logs for username and source IP.",
  "id": "PdFc-JIBLkNJ8-bDfz47",
  "isCommunity": true,
  "isEnabled": true,
  "kind": "case",
  "license": "DRL",
  "operation": "create",
  "overrides": [
    {
      "count": 10,
      "createdAt": "2024-12-06T14:36:45.579994541Z",
      "customFilter": "sofilter:\n  user.name: dresden",
      "ip": "1.2.3.4/32",
      "isEnabled": true,
      "note": "Exclude the SMTP server due to FPs",
      "regex": "content:xyz",
      "seconds": 120,
      "updatedAt": "2024-12-06T14:36:45.579994541Z",
      "value": "content:xyz content:!1.2.3.4/32"
    }
  ],
  "product": "windows",
  "publicId": "923421c7-9b1e-45d4-80cc-e21d060c8723",
  "ruleset": "__custom__",
  "service": "sshd",
  "title": "Security Onion - Grid Node Login Failure (SSH)",
  "updateTime": "2024-11-14T15:33:02Z",
  "userId": "socl_my_new_client"
}

Response

Returns the detection that was successfully created