What this endpoint does

Retrieves the detection rules generated for a specific threat hunt job, filtered by rule format. Unlike the Get Profile Detection Rules endpoint which returns a profile's current rule set, this endpoint returns rules from a specific job execution — a point-in-time snapshot of rules that were relevant when the job was created. You must specify at least one rule type in filter.types — supported formats include sigma, snort, yara, yaral, kql, fql, and s1ql. Job IDs are obtained by polling the Get Pending Jobs endpoint when a hunting profile's schedule triggers a new job.

Response data

Returns an array of detection rule objects, each containing the rule's identifier, display name, rule format type, associated MITRE ATT&CK techniques, and the complete deployable rule content in the content field. Each rule also includes a noteId linking it to the source Recorded Future analyst note. The rule schema matches the detection profile rules format, enabling consistent rule processing across both detection and hunting workflows.