list_detections
Read-only
Retrieve and filter security detections from Panther by type, severity, state, tags, and other criteria to monitor rules and policies.
Instructions
List detections from your Panther instance with support for multiple detection types and filtering.
Note: The output_ids filter is applied client-side after fetching all results from the API, as the Panther REST API does not support server-side filtering by outputID. For more efficient API-level filtering, consider using the 'tag' parameter if your detections are tagged by environment.
Permissions:{'all_of': ['View Rules', 'View Policies']}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| detection_types | No | One or more detection types - rules, scheduled_rules, simple_rules, or policies. | |
| cursor | No | Optional cursor for pagination from a previous query (only supported for single detection type) | |
| limit | No | Maximum number of results to return per detection type | |
| name_contains | No | Substring search by name (case-insensitive) | |
| state | No | Filter by state - 'enabled' or 'disabled' | |
| severity | No | Filter by severity levels - INFO, LOW, MEDIUM, HIGH, or CRITICAL. | |
| tag | No | A case-insensitive list of tags to filter by. | |
| log_type | No | A list of log types to filter by (applies to rules and simple-rules only). | |
| resource_type | No | Filter by resource types (applies to policies only) - list of resource type names | |
| compliance_status | No | Filter by compliance status (applies to policies only) - 'PASS', 'FAIL', or 'ERROR' | |
| created_by | No | Filter by creator user ID or actor ID | |
| last_modified_by | No | Filter by last modifier user ID or actor ID | |
| output_ids | No | Client-side filter by destination output IDs. Filters results after fetching from API to include only detections with at least one matching outputID. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||