cURL
curl -X GET "https://app.cotool.ai/api/detection-rules/proposals" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/detection-rules/proposals"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/detection-rules/proposals', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/api/detection-rules/proposals")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/detection-rules/proposals"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"proposals": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"description": "<string>",
"query": "<string>",
"siemPlatform": "<string>",
"reasoning": "<string>",
"mitreTechniqueIds": [
"<string>"
],
"mitreTechniqueNames": [
"<string>"
],
"mitreTacticIds": [
"<string>"
],
"dataSourcesRequired": [
"<string>"
],
"suggestedTuning": {
"exclusions": [
"<string>"
],
"thresholds": [
"<string>"
],
"expectedVolume": "<string>"
},
"validationResult": {
"valid": true,
"details": {
"syntaxOk": true,
"executionOk": true,
"resultCount": 123,
"executionTimeMs": 123
},
"error": "<string>"
},
"volumeCheckResult": {
"checkedAt": "2023-11-07T05:31:56Z",
"rowCount": 123,
"executionTimeMs": 123,
"timeRangeHours": 123,
"bytesScanned": 123,
"sampleResults": [
{}
],
"querySnapshot": "<string>",
"bestEstimate": {
"count": 1,
"timeRangeHours": 2,
"source": "<string>"
}
},
"prUrl": "<string>",
"prMergedAt": "2023-11-07T05:31:56Z",
"publishedAt": "2023-11-07T05:31:56Z",
"publishedRuleId": "<string>",
"jobRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dismissedReason": "<string>",
"dismissedBy": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dismissedAt": "2023-11-07T05:31:56Z",
"publishingStartedAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"grade": 10,
"gradeReason": "<string>",
"testResultsSummary": "<string>",
"detectionIntent": {
"methodLabel": "<string>",
"rationale": "<string>",
"keyKnobs": {}
},
"platformConfig": {
"version": 123,
"platform": "<string>",
"queries": [
{
"name": "<string>",
"query": "<string>",
"dataSource": "logs",
"groupByFields": [
"<string>"
],
"distinctFields": [
"<string>"
]
}
],
"cases": [
{
"condition": "<string>",
"name": "<string>"
}
],
"options": {
"evaluationWindow": 123,
"keepAlive": 123,
"maxSignalDuration": 123,
"decreaseCriticalityBasedOnEnv": true
},
"isEnabled": true
}
}
],
"total": 123
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}Detection Rules
List detection rule proposals
Retrieve all detection rule proposals for the organization.
GET
/
api
/
detection-rules
/
proposals
cURL
curl -X GET "https://app.cotool.ai/api/detection-rules/proposals" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/detection-rules/proposals"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/detection-rules/proposals', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/api/detection-rules/proposals")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/detection-rules/proposals"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"proposals": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"description": "<string>",
"query": "<string>",
"siemPlatform": "<string>",
"reasoning": "<string>",
"mitreTechniqueIds": [
"<string>"
],
"mitreTechniqueNames": [
"<string>"
],
"mitreTacticIds": [
"<string>"
],
"dataSourcesRequired": [
"<string>"
],
"suggestedTuning": {
"exclusions": [
"<string>"
],
"thresholds": [
"<string>"
],
"expectedVolume": "<string>"
},
"validationResult": {
"valid": true,
"details": {
"syntaxOk": true,
"executionOk": true,
"resultCount": 123,
"executionTimeMs": 123
},
"error": "<string>"
},
"volumeCheckResult": {
"checkedAt": "2023-11-07T05:31:56Z",
"rowCount": 123,
"executionTimeMs": 123,
"timeRangeHours": 123,
"bytesScanned": 123,
"sampleResults": [
{}
],
"querySnapshot": "<string>",
"bestEstimate": {
"count": 1,
"timeRangeHours": 2,
"source": "<string>"
}
},
"prUrl": "<string>",
"prMergedAt": "2023-11-07T05:31:56Z",
"publishedAt": "2023-11-07T05:31:56Z",
"publishedRuleId": "<string>",
"jobRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dismissedReason": "<string>",
"dismissedBy": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dismissedAt": "2023-11-07T05:31:56Z",
"publishingStartedAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"grade": 10,
"gradeReason": "<string>",
"testResultsSummary": "<string>",
"detectionIntent": {
"methodLabel": "<string>",
"rationale": "<string>",
"keyKnobs": {}
},
"platformConfig": {
"version": 123,
"platform": "<string>",
"queries": [
{
"name": "<string>",
"query": "<string>",
"dataSource": "logs",
"groupByFields": [
"<string>"
],
"distinctFields": [
"<string>"
]
}
],
"cases": [
{
"condition": "<string>",
"name": "<string>"
}
],
"options": {
"evaluationWindow": 123,
"keepAlive": 123,
"maxSignalDuration": 123,
"decreaseCriticalityBasedOnEnv": true
},
"isEnabled": true
}
}
],
"total": 123
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}Authorizations
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Query Parameters
Filter by status (comma-separated for multiple)
Filter by SIEM platform
Max results to return (default 50)
Offset for pagination
Include dismissed proposals (true/false, default false)
Was this page helpful?
⌘I