Update an existing detection.
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Detection UUID
New name for the detection
1 - 255New description
1000New category (set to null for intent-based detections)
baseline_anomaly, first_occurrence, sequence_pattern, privilege_escalation, custom, null New system prompt
1New SIEM query (set to null for intent-based detections)
1New SIEM platform type
New tool names
Optional updated per-tool-action configuration for the detection agent
Configuration for a specific tool action
Optional updated set of skills attached to the detection agent
New cadence for the detection (standard cadences)
hourly, daily, weekly, null Custom cron expression for detection schedule (takes precedence over detectionCadence if provided). Set to null to clear custom schedule and use detectionCadence. Must not run more frequently than hourly.
Tags for categorizing the detection agent
A tag label for categorizing agents (normalized to lowercase)
1 - 100Successful response
Agent configuration - can be either a built in (system-managed) or custom (user-created) agent
Unique identifier for the agent
Unique identifier of the organization that owns this agent
Human-readable name of the agent
Description of what the agent does and its purpose
Timestamp when the agent was created
Timestamp when the agent was last updated
Timestamp when the agent was soft-deleted, or null if not deleted
Array of tool names that this agent can use during execution
Per-tool-action configuration for this agent
Configuration for a specific tool action
Array of input configurations defining what inputs the agent expects
Model alias specifying which LLM model to use for this agent
Planning behavior mode for the agent
auto, never, always Type of agent: response (standard) or detection (security detection)
response, detection Whether this agent is built in to the system (true for built-in (system-managed) agents)
Type of built-in agent (e.g., threat-validation, threat-hunt)
threat-relevancy, threat-research, test-agent The cron schedule expression from the trigger (e.g., "0 * * * *" for hourly). Use cronToCadence() to derive display cadence.
Whether the detection schedule is enabled (from cron trigger)
Optional array of context documents (e.g., Google Docs, Notion pages) to provide to the agent
Optional reference to the Tines story import template used to create this agent
Optional array of triggers configured for this agent
Optional JSON schema describing the structured output the agent should emit (may include x-cotool metadata for preset UX; metadata is stripped before sending to the LLM)
Array of tags for categorizing the agent
A tag label for categorizing agents (normalized to lowercase)
1 - 100Array of reusable skills attached to this agent
Optional list of acceptance criteria evaluated for every run
20A user-configured acceptance criterion that must be satisfied for an agent run
1 - 500Category of detection (only for detection agents)
baseline_anomaly, first_occurrence, sequence_pattern, privilege_escalation, custom, null The SIEM query for the detection (only for detection agents)
The SIEM platform type (e.g., splunk, elastic) for the detection (only for detection agents)
Whether this detection is a suggestion (only for detection agents)
Timestamp of when this detection was last run (only for detection agents)
The currently active system prompt for this detection
Total runs in last 30 days
Triggered runs in last 30 days
Average LLM judge evaluation score (0-100) over last 30 days