What this endpoint does

This operation creates an asynchronous Auto Sigma job that analyzes malware samples from Recorded Future's Malware Intelligence platform and automatically generates Sigma detection rules based on the behavioral patterns observed. The query parameter selects which malware samples to analyze (e.g., sample.tags == "family:redline" to target a specific malware family), and the start_date and end_date parameters define the time window for sample selection (start date cannot be before 2023-11-01). After creating a job, use the Get Sigma Job endpoint with the returned job ID to check processing status and retrieve the generated Sigma rules. Use the Get Sigma Jobs endpoint to list all your Auto Sigma jobs.

Response data

The response contains a job_id (UUID) that uniquely identifies the created job. This ID is required to check job status, retrieve generated Sigma rules via the Get Sigma Job endpoint, retry failed rules via the Retry Sigma Rule endpoint, or update rules via the Update Sigma Rule endpoint. Jobs process asynchronously, so poll the Get Sigma Job endpoint to monitor progress until the job completes.