What this endpoint does

Retrieves the current status, configuration, and results of a specific Auto Sigma job. Use this to poll for job completion after creating a job via Create Auto Sigma Job — the status field progresses through CREATED, RUNNING, and FINISHED (or FAILED) states. Once finished, the response includes generated Sigma detection rules and identified behavioral patterns. Use rule IDs from the response with Update Sigma Rule to classify detection quality. If a job fails, use Retry Sigma Job to resubmit.

Response data

Returns the full output of a Sigma rule generation job — auto-generated Sigma detection rules ready for deployment to your SIEM, plus the behavioral patterns (process images, command-line patterns) the system identified from analyzing malware sandbox executions. Each Sigma rule is a complete YAML document that can be imported directly into Sigma-compatible platforms. The family counts breakdown shows which malware families contributed to the analyzed sample set and how many samples each family had, which helps you understand how representative the generated rules are. Rules start with a "New" classification status — use Update Sigma Rule to classify them as True Positive, False Positive, Needs Tuning, etc. as you validate them. The patterns array is populated only when the job reaches FINISHED status.