List Detections
get_detectionsRetrieve detection rules filtered by threat ID, type, severity, or keyword search. Returns detection name, query content, severity, confidence, data sources, and MITRE mappings.
Instructions
Get detection rules with filtering. Filter by threat ID, detection type (spl/kql/sigma), severity, or keyword search. Returns detection name, query/rule content, severity, confidence, data sources, and MITRE mappings.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | Detection language filter | |
| limit | No | Max results (default 50, max 200) | |
| offset | No | Pagination offset (default 0) | |
| search | No | Keyword search (matches detection name and description) | |
| severity | No | Severity level filter | |
| threat_id | No | Filter detections for a specific threat ID |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| count | No | ||
| has_more | No | ||
| next_offset | No |