What this endpoint does

Discovers threat detection profiles available to your organization — the entry point for the detection profile workflow. Detection profiles are preconfigured rule sets that automatically curate indicators and detection rules. After finding profile UUIDs here, fetch indicators via Threat Detection: Get Profile Indicators or rules via Threat Detection: Get Profile Rules. Supply either ids (array of known UUIDs, max 100) or enterprise (your org's identifier, e.g., uhash:XXXXXXXXXX) — at least one is required. An empty body or empty ids array returns 400.

Response data

Returns the detection profiles your organization has configured — each one is a curated ruleset for SIEM and EDR deployments, distinct from prevention profiles (which focus on block lists for firewalls/proxies) and hunting profiles (which run on a scheduled job-based workflow). Use profile UUIDs from this response to pull indicators and detection rules for ingestion into your SIEM or EDR platform. Detection profiles provide continuously-updated content without the job-polling workflow required by hunting profiles. If the response is empty, your organization may not have detection profiles configured, or the filter doesn't match any profiles.

200List of threat detection profiles matching the query

400Too many profiles requested