What this endpoint does

This operation retrieves the current status, configuration, and results of a specific Auto Sigma job. Use this endpoint to poll for job completion after creating a job via the Create Auto Sigma Job endpoint — the status field progresses through CREATED, RUNNING, and FINISHED (or FAILED) states. Once a job reaches FINISHED status, the response includes the generated Sigma detection rules and the behavioral patterns identified from the analyzed malware samples. The family_counts field provides a breakdown of how many malware samples matched each family tag, which is useful for understanding the scope and diversity of the analyzed dataset even before rules are generated.

Response data

The response contains the job's identity fields (job_id, name, timestamps), its processing status, the original query parameters, and result data. The n_matched_hashes field shows how many malware samples matched the query, and family_counts breaks this down by malware family. The sigma_rules array contains the generated Sigma detection rules, each with a YAML-formatted rule, a rule_id for use with the Update Sigma Rule and Retry Sigma Rule endpoints, classification status (such as "True Positive", "New", or "Needs Tuning"), and pattern matching stats. The patterns array contains the behavioral patterns detected across analyzed samples, including process images and command-line patterns with associated statistics.