Skip to main content

​
search_detection_rules

Search the detection rule library by keyword, MITRE tactic/technique, or severity.

​
Parameters

ParameterTypeRequiredDescription
querystringNoFree-text search across rule name and documentation
mitre_tacticstringNoFilter by MITRE ATT&CK tactic ID (e.g., TA0001)
mitre_techniquestringNoFilter by MITRE ATT&CK technique ID (e.g., T1078)
severitystringNoFilter by severity: Informational, Low, Medium, High, Critical
At least one parameter must be provided.

​
Return Value

[
  {
    "uuid": "dr-abc123-...",
    "name": "Suspicious Auth - Impossible Travel",
    "severity": "High",
    "mitre_tactics": ["TA0001"],
    "mitre_techniques": ["T1078"],
    "documentation": "## Overview\nDetects authentication from two geographically distant locations..."
  }
]

​
Required Scope

alerts:read