What this endpoint does

Retrieves detection rules from a specific threat detection profile, filtered by rule format. This is step 2 of the detection workflow: first discover profile UUIDs via Threat Detection: Query Profiles, then pass the profile id here. For indicators (IPs, domains, hashes, URLs) instead of rules, use Threat Detection: Get Profile Indicators. At least one rule type must be specified in filter.types — supported values: sigma, snort, yara, yaral, kql, fql, s1ql.

Response data

Returns detection rules ready for deployment into your SIEM or EDR — each rule's content field contains the complete, deployable rule text (Sigma YAML, Snort signatures, KQL queries, etc.) that can be directly imported into the corresponding platform. Rules are sourced from Insikt Group research and tagged with MITRE ATT&CK techniques for threat-informed prioritization. Detection profile rules are continuously updated unlike hunting job rules, which are point-in-time snapshots. An empty response is valid — not all profiles include rules for every supported format. Filter by type to match your security stack.