ContrastAPI

Bulk Sigma Rule Lookup

bulk_sigma_rule_lookup

Read-onlyIdempotent

Bulk Sigma rule lookup — retrieve full records for up to 50 rule UUIDs in a single request instead of N separate sigma_rule_lookup calls. Designed for triage workflows where multiple rule ids are known (e.g., from a SIEM alert batch or a tagged detection bundle). Each item is the same shape as sigma_rule_lookup with status ok/not_found/invalid_format and an error field when applicable. Up to 50 rule ids per call (same cap for Free and Pro). Each rule_id consumes 1 unit of the hourly quota; ids beyond the caller's remaining quota land in skipped_due_to_rate_limit instead of failing the whole batch (parity with bulk_cve/ioc). Free: 30/hr, Pro: 500/hr. Returns {results [{rule_id, status, rule, error}], total, processed, skipped_due_to_rate_limit, successful, failed, partial, summary, next_calls}.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`rule_ids`	Yes	List of Sigma rule UUIDs in RFC 4122 format. Up to 50 per call (same cap for Free and Pro). Each rule_id counts as 1 request toward the hourly quota. Per-item validation: invalid-format ids return status='invalid_format', unknown UUIDs return status='not_found' — the whole call does not fail.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedJun 2, 2026
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / verdict / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
Changed1 schema field changedMay 25, 2026
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"object"New value: +"array"
```

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "failed": {
+          "type": "integer"
+        },
+        "next_calls": {
+          "type": "object"
+        },
+        "partial": {
+          "type": "boolean"
+        },
+        "processed": {
+          "type": "integer"
+        },
+        "results": {
+          "type": "array"
+        },
+        "skipped_due_to_rate_limit": {
+          "type": "array"
+        },
+        "successful": {
+          "type": "integer"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "total": {
+          "type": "integer"
+        },
+        "verdict": {
+          "type": "object"
+        }
+      },
+      "required": [],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -{
-  "$defs": {
-    "BulkSigmaRuleLookupItem": {
-      "additionalProperties": false,
-      "properties": {
-        "error": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "rule": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/SigmaRule"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "rule_id": {
-          "type": "string"
-        },
-        "status": {
-          "enum": [
-            "ok",
-            "not_found",
-            "invalid_format"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "rule_id",
-        "status"
-      ],
-      "type": "object"
-    },
-    "BulkSigmaRuleLookupResponse": {
-      "additionalProperties": false,
-      "properties": {
-        "failed": {
-          "type": "integer"
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "partial": {
-          "type": "boolean"
-        },
-        "processed": {
-          "type": "integer"
-        },
-        "results": {
-          "items": {
-            "$ref": "#/$defs/BulkSigmaRuleLookupItem"
-          },
-          "type": "array"
-        },
-        "skipped_due_to_rate_limit": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "successful": {
-          "type": "integer"
-        },
-        "summary": {
-          "type": "string"
-        },
-        "total": {
-          "type": "integer"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "SigmaDetection": {
-      "properties": {
-        "condition": {
-          "type": "string"
-        },
-        "selections": {
-          "additionalProperties": true,
-          "type": "object"
-        }
-      },
-      "type": "object"
-    },
-    "SigmaRule": {
-      "properties": {
-        "author": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "description": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "detection": {
-          "$ref": "#/$defs/SigmaDetection"
-        },
-        "detection_summary": {
-          "type": "string"
-        },
-        "falsepositives": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "level": {
-          "enum": [
-            "informational",
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "license": {
-          "type": "string"
-        },
-        "logsource": {
-          "additionalProperties": true,
-          "type": "object"
-        },
-        "modified": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "references": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "rule_id": {
-          "type": "string"
-        },
-        "source_url": {
-          "type": "string"
-        },
-        "status": {
-          "enum": [
-            "test",
-            "stable",
-            "experimental",
-            "unsupported",
-            "deprecated"
-          ],
-          "type": "string"
-        },
-        "tags": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "title": {
-          "type": "string"
-        },
-        "updated_at": {
-          "type": "string"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "rule_id",
-        "title",
-        "detection"
-      ],
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/BulkSigmaRuleLookupResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Changed3 schema fields changedMay 18, 2026

changedInput schema / properties / rule_ids / description

Previous value: -"List of Sigma rule UUIDs in RFC 4122 format. Up to 50 per call (Pro tier) or 10 (free tier). Each id counts as 1 request toward the rate limit. Per-item validation: invalid-format ids return status='invalid_format', unknown UUIDs return status='not_found' — the whole call does not fail."New value: +"List of Sigma rule UUIDs in RFC 4122 format. Up to 50 per call (same cap for Free and Pro). Each rule_id counts as 1 request toward the hourly quota. Per-item validation: invalid-format ids return status='invalid_format', unknown UUIDs return status='not_found' — the whole call does not fail."

addedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / processed
```
Added value: +{
+  "type": "integer"
+}
```
addedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / skipped_due_to_rate_limit
```
Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
```

Changed137 schema fields changedMay 17, 2026
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / description
```
Removed value: -"Single item in bulk lookup response."
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / error / default
```
Removed value: -null
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / error / description
```
Removed value: -"Error message when status != 'ok'"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / error / title
```
Removed value: -"Error"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / rule / default
```
Removed value: -null
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / rule / description
```
Removed value: -"Full rule when status='ok'"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / rule_id / description
```
Removed value: -"Echoed input rule UUID"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / rule_id / title
```
Removed value: -"Rule Id"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / status / description
```
Removed value: -"'ok' = rule found; 'not_found' = UUID not in index; 'invalid_format' = invalid UUID"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / properties / status / title
```
Removed value: -"Status"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupItem / title
```
Removed value: -"BulkSigmaRuleLookupItem"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / description
```
Removed value: -"Bulk rule lookup response."
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / failed / default
```
Removed value: -0
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / failed / description
```
Removed value: -"Count of items with status != 'ok'"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / failed / title
```
Removed value: -"Failed"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / next_calls / default
```
Removed value: -null
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / next_calls / description
```
Removed value: -"Suggested follow-up tool calls (atlas_technique_lookup, cve_lookup, etc.)"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / next_calls / title
```
Removed value: -"Next Calls"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / partial / default
```
Removed value: -false
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / partial / description
```
Removed value: -"True when at least one item was not_found or invalid_format"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / partial / title
```
Removed value: -"Partial"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / results / description
```
Removed value: -"Per-rule outcome, preserving input order"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / results / title
```
Removed value: -"Results"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / successful / default
```
Removed value: -0
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / successful / description
```
Removed value: -"Count of items with status='ok'"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / successful / title
```
Removed value: -"Successful"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / summary / default
```
Removed value: -""
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / summary / description
```
Removed value: -"One-line aggregate (e.g., '3/5 rules found')"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / summary / title
```
Removed value: -"Summary"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / total / default
```
Removed value: -0
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / total / description
```
Removed value: -"Total unique rule IDs submitted"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / total / title
```
Removed value: -"Total"
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / verdict / default
```
Removed value: -null
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / properties / verdict / description
```
Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
```
- removedOutput schema / $defs / BulkSigmaRuleLookupResponse / title
```
Removed value: -"BulkSigmaRuleLookupResponse"
```
- removedOutput schema / $defs / ErrorDetail / description
```
Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / description
```
Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / title
```
Removed value: -"Code"
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / description
```
Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / title
```
Removed value: -"Docs Url"
```
- removedOutput schema / $defs / ErrorDetail / properties / message / description
```
Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."
```
- removedOutput schema / $defs / ErrorDetail / properties / message / title
```
Removed value: -"Message"
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / description
```
Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / title
```
Removed value: -"Retry After Seconds"
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / description
```
Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / title
```
Removed value: -"Upgrade Url"
```
- removedOutput schema / $defs / ErrorDetail / title
```
Removed value: -"ErrorDetail"
```
- removedOutput schema / $defs / ErrorResponse / description
```
Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."
```
- removedOutput schema / $defs / ErrorResponse / title
```
Removed value: -"ErrorResponse"
```
- removedOutput schema / $defs / PivotHint / description
```
Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."
```
- removedOutput schema / $defs / PivotHint / properties / input / description
```
Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."
```
- removedOutput schema / $defs / PivotHint / properties / input / title
```
Removed value: -"Input"
```
- removedOutput schema / $defs / PivotHint / properties / params / default
```
Removed value: -null
```
- removedOutput schema / $defs / PivotHint / properties / params / description
```
Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."
```
- removedOutput schema / $defs / PivotHint / properties / params / title
```
Removed value: -"Params"
```
- removedOutput schema / $defs / PivotHint / properties / reason / description
```
Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."
```
- removedOutput schema / $defs / PivotHint / properties / reason / title
```
Removed value: -"Reason"
```
- removedOutput schema / $defs / PivotHint / properties / tool / description
```
Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."
```
- removedOutput schema / $defs / PivotHint / properties / tool / title
```
Removed value: -"Tool"
```
- removedOutput schema / $defs / PivotHint / title
```
Removed value: -"PivotHint"
```
- removedOutput schema / $defs / SigmaDetection / description
```
Removed value: -"Nested detection block — preserve raw YAML structure."
```
- removedOutput schema / $defs / SigmaDetection / properties / condition / default
```
Removed value: -"unknown"
```
- removedOutput schema / $defs / SigmaDetection / properties / condition / description
```
Removed value: -"Boolean condition syntax (e.g., 'all of selection_*', 'selection_a and selection_b')"
```
- removedOutput schema / $defs / SigmaDetection / properties / condition / title
```
Removed value: -"Condition"
```
- removedOutput schema / $defs / SigmaDetection / properties / selections / description
```
Removed value: -"Selection blocks keyed by name (e.g., {'selection_img': {...}, 'selection_cmd': {...}})"
```
- removedOutput schema / $defs / SigmaDetection / properties / selections / title
```
Removed value: -"Selections"
```
- removedOutput schema / $defs / SigmaDetection / title
```
Removed value: -"SigmaDetection"
```
- removedOutput schema / $defs / SigmaRule / description
```
Removed value: -"Full Sigma detection rule parsed from YAML."
```
- removedOutput schema / $defs / SigmaRule / properties / author / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / author / description
```
Removed value: -"Rule author(s); defaults to 'Unknown' if missing"
```
- removedOutput schema / $defs / SigmaRule / properties / author / title
```
Removed value: -"Author"
```
- removedOutput schema / $defs / SigmaRule / properties / date / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / date / description
```
Removed value: -"ISO-8601 creation date"
```
- removedOutput schema / $defs / SigmaRule / properties / date / title
```
Removed value: -"Date"
```
- removedOutput schema / $defs / SigmaRule / properties / description / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / description / description
```
Removed value: -"Multi-line rule description; may be None if omitted in YAML"
```
- removedOutput schema / $defs / SigmaRule / properties / description / title
```
Removed value: -"Description"
```
- removedOutput schema / $defs / SigmaRule / properties / detection / description
```
Removed value: -"Nested detection block with selections and condition"
```
- removedOutput schema / $defs / SigmaRule / properties / detection_summary / default
```
Removed value: -""
```
- removedOutput schema / $defs / SigmaRule / properties / detection_summary / description
```
Removed value: -"Human-readable summary (e.g., '2 selections, condition: all of selection_*')"
```
- removedOutput schema / $defs / SigmaRule / properties / detection_summary / title
```
Removed value: -"Detection Summary"
```
- removedOutput schema / $defs / SigmaRule / properties / falsepositives / description
```
Removed value: -"Known false-positive scenarios"
```
- removedOutput schema / $defs / SigmaRule / properties / falsepositives / title
```
Removed value: -"Falsepositives"
```
- removedOutput schema / $defs / SigmaRule / properties / level / default
```
Removed value: -"medium"
```
- removedOutput schema / $defs / SigmaRule / properties / level / description
```
Removed value: -"Detection alert severity"
```
- removedOutput schema / $defs / SigmaRule / properties / level / title
```
Removed value: -"Level"
```
- removedOutput schema / $defs / SigmaRule / properties / license / default
```
Removed value: -"DRL 1.1"
```
- removedOutput schema / $defs / SigmaRule / properties / license / description
```
Removed value: -"Detection Rule License version"
```
- removedOutput schema / $defs / SigmaRule / properties / license / title
```
Removed value: -"License"
```
- removedOutput schema / $defs / SigmaRule / properties / logsource / description
```
Removed value: -"Logsource metadata: {product, service, category, definition}"
```
- removedOutput schema / $defs / SigmaRule / properties / logsource / title
```
Removed value: -"Logsource"
```
- removedOutput schema / $defs / SigmaRule / properties / modified / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / modified / description
```
Removed value: -"ISO-8601 last modification date"
```
- removedOutput schema / $defs / SigmaRule / properties / modified / title
```
Removed value: -"Modified"
```
- removedOutput schema / $defs / SigmaRule / properties / next_calls / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / next_calls / description
```
Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."
```
- removedOutput schema / $defs / SigmaRule / properties / next_calls / title
```
Removed value: -"Next Calls"
```
- removedOutput schema / $defs / SigmaRule / properties / references / description
```
Removed value: -"List of reference URLs from the rule"
```
- removedOutput schema / $defs / SigmaRule / properties / references / title
```
Removed value: -"References"
```
- removedOutput schema / $defs / SigmaRule / properties / rule_id / description
```
Removed value: -"UUID of the rule (unique identifier)"
```
- removedOutput schema / $defs / SigmaRule / properties / rule_id / title
```
Removed value: -"Rule Id"
```
- removedOutput schema / $defs / SigmaRule / properties / source_url / default
```
Removed value: -""
```
- removedOutput schema / $defs / SigmaRule / properties / source_url / description
```
Removed value: -"GitHub URL to the rule in SigmaHQ repository (set by indexer)"
```
- removedOutput schema / $defs / SigmaRule / properties / source_url / title
```
Removed value: -"Source Url"
```
- removedOutput schema / $defs / SigmaRule / properties / status / default
```
Removed value: -"test"
```
- removedOutput schema / $defs / SigmaRule / properties / status / description
```
Removed value: -"Rule maturity level"
```
- removedOutput schema / $defs / SigmaRule / properties / status / title
```
Removed value: -"Status"
```
- removedOutput schema / $defs / SigmaRule / properties / tags / description
```
Removed value: -"Flattened tags list (attack.t1059, cve.2024-1234, detection.threat_hunting, etc.)"
```
- removedOutput schema / $defs / SigmaRule / properties / tags / title
```
Removed value: -"Tags"
```
- removedOutput schema / $defs / SigmaRule / properties / title / description
```
Removed value: -"Human-readable rule title"
```
- removedOutput schema / $defs / SigmaRule / properties / title / title
```
Removed value: -"Title"
```
- removedOutput schema / $defs / SigmaRule / properties / updated_at / default
```
Removed value: -""
```
- removedOutput schema / $defs / SigmaRule / properties / updated_at / description
```
Removed value: -"ISO-8601 timestamp when ContrastAPI last synced this rule"
```
- removedOutput schema / $defs / SigmaRule / properties / updated_at / title
```
Removed value: -"Updated At"
```
- removedOutput schema / $defs / SigmaRule / properties / verdict / default
```
Removed value: -null
```
- removedOutput schema / $defs / SigmaRule / properties / verdict / description
```
Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
```
- removedOutput schema / $defs / SigmaRule / title
```
Removed value: -"SigmaRule"
```
- removedOutput schema / $defs / Verdict / properties / completeness / default
```
Removed value: -"complete"
```
- removedOutput schema / $defs / Verdict / properties / completeness / description
```
Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."
```
- removedOutput schema / $defs / Verdict / properties / completeness / title
```
Removed value: -"Completeness"
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / description
```
Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / title
```
Removed value: -"Data Age Seconds"
```
- removedOutput schema / $defs / Verdict / properties / deterministic / description
```
Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."
```
- removedOutput schema / $defs / Verdict / properties / deterministic / title
```
Removed value: -"Deterministic"
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / description
```
Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / title
```
Removed value: -"Falsifiable Fields"
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / description
```
Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / title
```
Removed value: -"Sources Queried"
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / description
```
Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / title
```
Removed value: -"Sources Unavailable"
```
- removedOutput schema / $defs / Verdict / title
```
Removed value: -"Verdict"
```
- removedOutput schema / properties / result / title
```
Removed value: -"Result"
```
- removedOutput schema / title
```
Removed value: -"bulk_sigma_rule_lookupOutput"
```

Changed1 schema field changedMay 15, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit"
+]

AddedMay 12, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnly, idempotent), the description discloses per-item status handling (ok/not_found/invalid_format), quota consumption per rule_id, graceful degradation via skipped_due_to_rate_limit, Free/Pro limits, and the exact return structure—substantially exceeding the baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet rich, front-loaded with purpose, and every sentence conveys essential information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a complete schema, output schema, and annotations, plus detailed rate-limit and error-handling context, the description leaves no significant gaps for an agent to misuse the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully documents rule_ids (format, max 50, per-item validation, quota). The description adds no new parameter-level semantics; it mostly repeats or discusses output behavior, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it retrieves full records for up to 50 rule UUIDs in a single request, and contrasts with sigma_rule_lookup, making its purpose unambiguous and distinguishing it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: designed for triage workflows where multiple rule ids are known, and positioned as an alternative to N separate sigma_rule_lookup calls. It also notes parity with bulk_cve/ioc for rate-limit behavior, helping the agent decide when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ContrastAPI tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.