bulk_sigma_rule_lookup
Read-onlyIdempotent
Retrieve full Sigma rule records for up to 50 rule UUIDs in one request, reducing API calls during triage workflows. Each item returns status and error details.
Instructions
Bulk Sigma rule lookup — retrieve full records for up to 50 rule UUIDs in a single request instead of N separate sigma_rule_lookup calls. Designed for triage workflows where multiple rule ids are known (e.g., from a SIEM alert batch or a tagged detection bundle). Each item is the same shape as sigma_rule_lookup with status ok/not_found/invalid_format and an error field when applicable. Free: 30/hr (1 per item, max 10 items free tier), Pro: 500/hr (max 50 items). Returns {results [{rule_id, status, rule, error}], total, successful, failed, partial, summary, next_calls}.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| rule_ids | Yes | List of Sigma rule UUIDs in RFC 4122 format. Up to 50 per call (Pro tier) or 10 (free tier). Each id counts as 1 request toward the rate limit. Per-item validation: invalid-format ids return status='invalid_format', unknown UUIDs return status='not_found' — the whole call does not fail. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |