Chainsaw: read a rule
chainsaw_get_ruleRead a single rule's YAML and parsed summary, or list a rule directory, by kind and path to inspect detection logic.
Instructions
Read one rule's YAML and parsed summary, or list a rule directory.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | chainsaw, sigma or custom. | |
| path | Yes | Rule path relative to that kind's root, e.g. rules/windows/process_creation/proc_creation_win_lsass_dump.yml or evtx/credential_access. Directories return their children. |