Skip to main content
GET
cURL

Authorizations

Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Path Parameters

slug
string
required
Pattern: ^[a-z0-9]+(-[a-z0-9]+)*$

Response

Successful response

slug
string
required

Kebab-case library entry identity

name
string
required
summary
string
required

1–3 sentence plain-prose headline of what the detection is meant to detect

description
string
required

Operational GitHub-flavored markdown covering the signal and the fire condition

revision
string
required

SHA-256 of the entry notebook

Pattern: ^[0-9a-f]{64}$
toolNames
string[]
required

Tool actions the entry notebook calls

requiredLogSources
string[]
required

Cotool Logs warehouse sources the notebook queries (e.g. okta); eligibility requires the org to have their log ingest enabled

mitreTechniqueIds
string[]
required
defaultCronSchedule
string
required

Schedule enabled when the entry is added

defaultMinSeverity
enum<string>
required
Available options:
low,
medium,
high,
critical
eligible
boolean
required

Whether missingLogSources and missingTools are both empty

addedDetectionId
string<uuid> | null
required

The org detection created from this entry, when already added

content
string
required

The entry notebook source, for read-only preview

interpretation
object | null
required

Logic summary computed once per notebook revision and cached globally; null until the interpretation job produces it

missingLogSources
object[]

Required log sources the organization is not ingesting

missingTools
object[]

Required integration tool actions the organization cannot run