cURL
curl -X POST "https://app.cotool.ai/api/detection-library/:slug/add" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/detection-library/{slug}/add"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/detection-library/{slug}/add', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.post("https://app.cotool.ai/api/detection-library/{slug}/add")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/detection-library/{slug}/add"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"chatId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"revision": "<string>",
"name": "<string>",
"summary": "<string>",
"description": "<string>",
"toolNames": [
"<string>"
],
"mitreTechniqueIds": [
"<string>"
],
"metadataStatus": "pending",
"librarySlug": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"publishedVersionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"recentHits": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"executionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity": "<string>",
"entityType": "<string>",
"severity": "low",
"headline": "<string>",
"summary": "<string>",
"evidence": {},
"closedAt": "2023-11-07T05:31:56Z",
"lastSeenAt": "2023-11-07T05:31:56Z",
"lastSeenExecutionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"seenCount": 123,
"linkedAlert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"status": "open",
"derivedDisposition": "true_positive",
"assignedAgent": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
}
},
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
],
"feedback": {
"detectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"windowDays": 123,
"dispositions": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
},
"statuses": {
"open": 1,
"inProgress": 1,
"escalated": 1,
"duplicate": 1,
"dismissed": 1,
"expired": 1
},
"precision": {
"value": 0.5,
"numerator": 1,
"denominator": 1
},
"versions": [
{
"versionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"version": 123,
"dispositions": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
},
"precision": {
"value": 0.5,
"numerator": 1,
"denominator": 1
}
}
],
"falsePositiveEntities": [
{
"entity": "<string>",
"entityType": "<string>",
"count": 123
}
],
"actorSplit": {
"human": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
},
"agent": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
}
},
"scheduledExecutions": {
"total": 1,
"succeeded": 1,
"failed": 1,
"interrupted": 1,
"running": 1,
"successRate": 0.5,
"averageRuntimeMs": 1,
"errorCount": 1,
"recentErrors": [
{
"message": "<string>",
"count": 123,
"lastOccurredAt": "2023-11-07T05:31:56Z"
}
],
"lastScheduledRunAt": "2023-11-07T05:31:56Z",
"lastFinishedStatus": "succeeded"
},
"volume": {
"hits": 1,
"alerts": 1,
"lastResultAt": "2023-11-07T05:31:56Z",
"lastAlertAt": "2023-11-07T05:31:56Z"
},
"everEscalated": 1,
"meanTimeToDispositionSeconds": 1
}
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}Detections
Add a detection library entry
Creates an org-owned detection from the entry, publishes its notebook as version 1, and enables the entry’s default schedule.
POST
/
api
/
detection-library
/
{slug}
/
add
cURL
curl -X POST "https://app.cotool.ai/api/detection-library/:slug/add" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/detection-library/{slug}/add"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/detection-library/{slug}/add', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.post("https://app.cotool.ai/api/detection-library/{slug}/add")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/detection-library/{slug}/add"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"chatId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"revision": "<string>",
"name": "<string>",
"summary": "<string>",
"description": "<string>",
"toolNames": [
"<string>"
],
"mitreTechniqueIds": [
"<string>"
],
"metadataStatus": "pending",
"librarySlug": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"publishedVersionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"recentHits": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"executionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"entity": "<string>",
"entityType": "<string>",
"severity": "low",
"headline": "<string>",
"summary": "<string>",
"evidence": {},
"closedAt": "2023-11-07T05:31:56Z",
"lastSeenAt": "2023-11-07T05:31:56Z",
"lastSeenExecutionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"seenCount": 123,
"linkedAlert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"status": "open",
"derivedDisposition": "true_positive",
"assignedAgent": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
}
},
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
],
"feedback": {
"detectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"windowDays": 123,
"dispositions": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
},
"statuses": {
"open": 1,
"inProgress": 1,
"escalated": 1,
"duplicate": 1,
"dismissed": 1,
"expired": 1
},
"precision": {
"value": 0.5,
"numerator": 1,
"denominator": 1
},
"versions": [
{
"versionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"version": 123,
"dispositions": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
},
"precision": {
"value": 0.5,
"numerator": 1,
"denominator": 1
}
}
],
"falsePositiveEntities": [
{
"entity": "<string>",
"entityType": "<string>",
"count": 123
}
],
"actorSplit": {
"human": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
},
"agent": {
"truePositive": 1,
"falsePositive": 1,
"benign": 1
}
},
"scheduledExecutions": {
"total": 1,
"succeeded": 1,
"failed": 1,
"interrupted": 1,
"running": 1,
"successRate": 0.5,
"averageRuntimeMs": 1,
"errorCount": 1,
"recentErrors": [
{
"message": "<string>",
"count": 123,
"lastOccurredAt": "2023-11-07T05:31:56Z"
}
],
"lastScheduledRunAt": "2023-11-07T05:31:56Z",
"lastFinishedStatus": "succeeded"
},
"volume": {
"hits": 1,
"alerts": 1,
"lastResultAt": "2023-11-07T05:31:56Z",
"lastAlertAt": "2023-11-07T05:31:56Z"
},
"everEscalated": 1,
"meanTimeToDispositionSeconds": 1
}
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}{
"error": "<string>"
}{
"error": "<string>"
}Authorizations
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Path Parameters
Pattern:
^[a-z0-9]+(-[a-z0-9]+)*$Response
Successful response
Caller-owned editor chat on detail responses; always null in catalog rows
Pattern:
^[0-9a-f]{64}$1–3 sentence plain-prose headline of what the detection is meant to detect. No bullet lists.
Operational GitHub-flavored markdown: typically two or three bullets covering the signal and the fire condition
Available options:
pending, ready, failed Detection library entry this detection was added from, when any
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Was this page helpful?
⌘I