loading…
Create and Tune Detection Rules for Suspicious Activity
/api/mcp/srv-detection-engineeringMCP enable + token are only for calling from an external client — the playground below needs neither.
Create a new threat hunt with hypothesis, search queries, and target data sources
{
"type": "object",
"required": [
"name",
"hypothesis",
"queries"
],
"properties": {
"name": {
"type": "string"
},
"queries": {
"type": "array",
"items": {
"type": "object",
"required": [
"query"
],
"properties": {
"query": {
"type": "string"
},
"query_type": {
"enum": [
"spl",
"kql",
"sigma"
],
"type": "string"
},
"data_source": {
"type": "string"
}
}
}
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"hypothesis": {
"type": "string"
},
"assigned_to": {
"type": "string"
},
"mitre_techniques": {
"type": "array",
"items": {
"type": "string",
"pattern": "^T[0-9]{4}(\\.[0-9]{3})?$"
}
}
}
}Retrieve a specific detection rule by ID including metadata, logic, and test cases
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"detection_id": {
"type": "string"
},
"include_tests": {
"type": "boolean",
"default": false
},
"include_history": {
"type": "boolean",
"default": false
}
}
}Retrieve a specific notable event by ID including raw events, enrichment data, and investigation timeline
{
"type": "object",
"required": [
"notable_id"
],
"properties": {
"notable_id": {
"type": "string"
},
"include_enrichment": {
"type": "boolean",
"default": true
},
"include_raw_events": {
"type": "boolean",
"default": true
}
}
}List detection rules with filters for status, severity, data source, and MITRE ATT&CK techniques
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"author": {
"type": "string"
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"enum": [
"enabled",
"disabled",
"testing",
"deprecated"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"data_source": {
"type": "string"
},
"mitre_technique": {
"type": "string",
"pattern": "^T[0-9]{4}(\\.[0-9]{3})?$"
}
}
}List threat intelligence indicators with filters for type, source, confidence, and expiration status
{
"type": "object",
"required": [],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"limit": {
"type": "integer",
"default": 100
},
"offset": {
"type": "integer",
"default": 0
},
"source": {
"type": "string"
},
"expired": {
"type": "boolean"
},
"confidence": {
"enum": [
"high",
"medium",
"low"
],
"type": "string"
},
"indicator_type": {
"enum": [
"ip",
"domain",
"url",
"hash",
"email",
"file_path",
"registry_key"
],
"type": "string"
}
}
}List notable events and alerts with filters for status, severity, assigned analyst, and time range
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"enum": [
"new",
"in_progress",
"resolved",
"false_positive",
"duplicate"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"latest_time": {
"type": "string"
},
"detection_id": {
"type": "string"
},
"earliest_time": {
"type": "string"
}
}
}Search security events using SPL, KQL, or Sigma queries with time range and field filters
{
"type": "object",
"required": [
"query"
],
"properties": {
"index": {
"type": "string",
"description": "Index or data source to search"
},
"limit": {
"type": "integer",
"default": 1000,
"maximum": 10000
},
"query": {
"type": "string",
"description": "SPL, KQL, or Sigma query string"
},
"query_type": {
"enum": [
"spl",
"kql",
"sigma"
],
"type": "string",
"default": "spl"
},
"latest_time": {
"type": "string",
"description": "ISO timestamp or relative time like now"
},
"earliest_time": {
"type": "string",
"description": "ISO timestamp or relative time like -24h"
}
}
}Update the status, severity, or assignment of a notable event with analyst comments
{
"type": "object",
"required": [
"notable_id"
],
"properties": {
"status": {
"enum": [
"new",
"in_progress",
"resolved",
"false_positive",
"duplicate"
],
"type": "string"
},
"comment": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"notable_id": {
"type": "string"
},
"assigned_to": {
"type": "string"
},
"disposition": {
"enum": [
"true_positive",
"false_positive",
"benign_positive",
"unknown"
],
"type": "string"
}
}
}Validate detection rule syntax, test against sample data, and check for performance issues
{
"type": "object",
"required": [
"detection_content",
"format"
],
"properties": {
"format": {
"enum": [
"sigma",
"spl",
"kql",
"yara"
],
"type": "string"
},
"test_data": {
"type": "string",
"description": "Sample log data or event to test against"
},
"detection_content": {
"type": "string",
"description": "Detection rule in Sigma, SPL, KQL, or YARA format"
},
"performance_check": {
"type": "boolean",
"default": true
}
}
}