Detect and Respond Detection Categories

List Detection Categories

get

Returns an array of Detection Categories.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Responses
200

List of Requested Detection Categories

application/json
get
/api/v1/rule-engine/categories

Delete All Custom Detection Categories

delete

Deletes all custom detection categories.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Responses
delete
/api/v1/rule-engine/categories

No content

Fetch Detection Category

get

Fetches a specific detection category from the NAME supplied in the path.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
namestringRequired

The NAME of the detection category to be returned.

Responses
200

Requested Detection Category

application/json
get
/api/v1/rule-engine/category/{name}

Create or Update Detection Category

put

Create or update a detection category given the provided object.

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
namestringRequired

The NAME of the detection category to be created or updeted.

Body

Detection Category Create or Update Config

descriptionstringOptional

Detection category description

Example: T1041 Exfiltration Over C2 Channel
Responses
200

Requested Detection Category

application/json
put
/api/v1/rule-engine/category/{name}

Delete Detection Model

delete

Deletes a detection model

Authorizations
AuthorizationstringRequired
Bearer authentication header of the form Bearer <token>.
Path parameters
namestringRequired

The NAME of the detection category to be deleted.

Responses
delete
/api/v1/rule-engine/category/{name}

No content

Last updated