What this endpoint does

Retrieves the full content of detection rules associated with a specific threat detection profile, filtered by rule format. Detection rules are platform-specific security rules (Sigma, Snort, YARA, and others) that Recorded Future automatically generates and curates based on the profile's threat criteria. You must specify at least one rule type to filter by in the filter.types field — supported formats include sigma, snort, yara, yaral, kql, fql, and s1ql, corresponding to common SIEM and security tool query languages. Use the Query Profiles endpoint with your enterprise ID to discover available profile IDs.

Response data

Returns an array of detection rule objects, each containing the rule's identifier, display name, rule type, associated MITRE ATT&CK techniques, and the complete rule definition in the content field. The content field contains the full, deployable rule text (e.g., complete Sigma YAML or Snort rule syntax) ready for import into your security tools. Each rule also includes a noteId linking it to the underlying Recorded Future analyst note from which it was derived.