Search Detections
search_detectionsRead-onlyIdempotent
Search detection rules by keyword to find detections matching specific topics like ransomware or lateral movement. Filter by type and severity for targeted results.
Instructions
Search detection rules by keyword — matches against detection names and descriptions. Filter by type and severity. WHEN TO USE: for finding detections by topic (e.g. 'ransomware', 'lateral movement', 'credential dumping'). To list every detection for a specific threat, use get_detections(threat_id=...) instead. Returns has_more/next_offset for paging.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | Detection language filter | |
| limit | No | Max results per page (default 25, max 200). | |
| query | Yes | Search term (matches detection name and description) | |
| offset | No | Pagination offset (0-based). Pass next_offset from the previous response to page through results. | |
| severity | No | Severity level filter |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| count | No | ||
| has_more | No | ||
| next_offset | No |